Repository navigation
fix(renovate): unblock metadata-free digests and lockfile maintenance - #57
Merged
codeandsolder-git-wrangler[bot] merged 1 commit intoNov 12, 2026
Conversation
codeandsolder-git-wrangler
Bot
deleted the
maintenance/renovate-stability-deadlock-20261112
branch
November 12, 2026 16:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
Renovate upstream #45236 remains open. Its branch-level stability-days logic can indefinitely mark digest, pinDigest and lockFileMaintenance updates pending when the upgrade has no releaseTimestamp, including Docker Hub digests whose matched tag has long since aged. Observed: rust-web-fullstack #99 (opened October 10), #113, #117, and other green consumer PRs are stuck behind an impossible timestamp requirement.
Fix
Set minimumReleaseAgeBehaviour=timestamp-optional only for pin, pinDigest, digest and lockfile-only update types; add an explicit no-timestamp rule for GitHub runner labels. This follows Renovate minimum release age documentation while upstream is unfixed.
Normal major/minor/patch releases remain timestamp-required with the full three-day age policy. A real timestamp still incurs the age check. Semver compatibility rules, major-review rules, green-CI automerge, and the separate 72-hour Cargo quarantine are unchanged. Immutable digest pinning is preferable to retaining floating tags indefinitely; lockfile-only updates remain subject to downstream package-manager and CI policy.
Added policy invariants that fail if the global strict age gate, the exception scope, or automerge review behavior accidentally changes. Local policy script and git diff whitespace validation passed. GitHub CI validates the Renovate JSON with the upstream CLI.
Follow-up
After merge, re-evaluate old stability-days contexts on Docker digest and Cargo lockFileMaintenance PRs; do not override or force-merge any red CI checks.