Skip to content

Remove minimumReleaseAge for google/oss-fuzz#9764

Merged
mergify[bot] merged 1 commit into
python-pillow:mainfrom
radarhere:renovate-github-actions
Jul 4, 2026
Merged

Remove minimumReleaseAge for google/oss-fuzz#9764
mergify[bot] merged 1 commit into
python-pillow:mainfrom
radarhere:renovate-github-actions

Conversation

@radarhere

Copy link
Copy Markdown
Member

It is unlikely that there will be a whole week where google/oss-fuzz doesn't receive a new commit, meaning that the minimum release age for Renovate is unlikely to ever pass.

Rather than manually triggering the 'github-actions' item in #6604 each month, this PR attempts to remove the minimum release age, just for GitHub Actions.

@hugovk

hugovk commented Jul 4, 2026

Copy link
Copy Markdown
Member

Rather than setting it to zero for all actions, can we set it to zero for just google/oss-fuzz?

Then we get extra protection from supply chain attacks, which are becoming more common against GitHub Actions:

https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

Perhaps like:

    "packageRules": [
      {
          "groupName": "github-actions",
          "matchManagers": ["github-actions"],
          "separateMajorMinor": false
      },
      {
          "matchManagers": ["github-actions"],
          "matchPackageNames": ["google/oss-fuzz**"],
          "minimumReleaseAge": "0 days"
      }
    ]

@radarhere

Copy link
Copy Markdown
Member Author

Why "google/oss-fuzz**" rather than "google/oss-fuzz"?

@radarhere
radarhere force-pushed the renovate-github-actions branch from e4b4430 to 1ab9e9a Compare July 4, 2026 10:11
@radarhere radarhere changed the title Remove minimumReleaseAge for GitHub Actions Remove minimumReleaseAge for google/oss-fuzz Jul 4, 2026
@hugovk

hugovk commented Jul 4, 2026

Copy link
Copy Markdown
Member

"google/oss-fuzz" is better 👍

@hugovk hugovk added the automerge Automatically merge PRs that are ready label Jul 4, 2026
@mergify
mergify Bot merged commit 5ca4ebc into python-pillow:main Jul 4, 2026
53 checks passed
@radarhere
radarhere deleted the renovate-github-actions branch July 4, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

automerge Automatically merge PRs that are ready

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants