Internal packages dont report age on PRs

[andrelin]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

"renovateVersion": "41.173.1"

Please tell us more about your question or problem

On Renovate PRs packages published to GitHub Packages from internal repositories show Age as Unknown (and Confidence as Neutral), despite metadata about age being present in the logs. Would be helpful to get the actual age of the packages displayed in the PR, like it is for public dependencies.

Logs (if relevant)

Logs

[RahulGautamSingh]

Which datasource do the packages belong to?

[andrelin]

This applies to both maven and npm packages.

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[andrelin]

I'd be happy to provide logs, but I don't know whats relevant to this issue.

[jamietanna]

If you can share a Job ID, I can see if there are relevant logs to add

[andrelin]

019a764b-cc38-7421-8037-9b89bbc0e115

[jamietanna]

That being said, I believe this:

Age as Unknown (and Confidence as Neutral)

is referring to the Merge Confidence functionality, which is only available for public packages.

We (Mend) are putting things in place to be able to provide Merge Confidence as an opt-in for Enterprise organisations' internal packages

The Merge Confidence badges are separate to the age checks that Renovate will perform for packages for i.e. minimumReleaseAge

[andrelin]

Yeah, I think it is related to Merge Confidence, If its not available for internal packages, then I think it shouldn't be on the PRs at all, displaying Age as Unknown is misleading to users.

Yeah, the age checks in Renovate seems to be working correctly.

[jamietanna]

Yeah, I think it is related to Merge Confidence, If its not available for internal packages, then I think it shouldn't be on the PRs at all, displaying Age as Unknown is misleading to users.

Thanks for the feedback - I appreciate your point, at this time, we're not going to make a change to how this is rendered.

We wouldn't want to modify the behaviour here as this could lead to someone trying to enumerate known private packages that Mend are aware of

Given the badges are (and are intended to be) public and unauthenticated i.e. https://developer.mend.io/api/mc/badges/age/maven/no.spk.felles:spk-verdityper/122.0.8, we'd not want to modify the defaults to make it possible to enumerate private packages

Additionally, an UNKNOWN doesn't necessarily mean that this package is a private one - it may "just" be that we've not (yet) fetched the data

We could possibly add some functionality to allow hiding anything with Age == UNKNOWN (edit: we've decided not to)

[andrelin]

Okay, thank you.
I understand, I don't think hiding age unknown is helpful if we don't know why they are unknown.

[jamietanna]

To clarify:

I understand, I don't think hiding age unknown is helpful if we don't know why they are unknown.

Do you mean you agree that we shouldn't make a change here to note why it's UNKNOWN, and leave behaviour as-is?

[andrelin]

I mean, it would be helpful to hide it when we know that it's UNKNOWN because it's an internal package and merge confidence isn't supported. But if it's UNKNOWN for a public package for other reasons, I dont think I want to hide that.

[jamietanna]

Gotcha - in this case, we wouldn't want to provide a way to distinguish, as then you could use the unauthenciated, public endpoints determine if there's a private package of a given name :(