fix(renovate): unblock metadata-free digests and lockfile maintenance

renovate-fleet.json

@@ -22,6 +22,24 @@
     "automergeType": "pr"
   },
   "packageRules": [
+    {
+      "description": "Do not deadlock immutable pins, digests and lockfile-only updates on missing upstream release timestamps (Renovate #45236)",
+      "matchUpdateTypes": [
+        "pin",
+        "pinDigest",
+        "digest",
+        "lockFileMaintenance",
+        "lockfileUpdate"
+      ],
+      "minimumReleaseAgeBehaviour": "timestamp-optional"
+    },
+    {
+      "description": "GitHub-hosted runner labels have no release timestamps and major runner updates still require review",
+      "matchDepTypes": [
+        "github-runner"
+      ],
+      "minimumReleaseAge": null
+    },
     {
       "description": "Automerge compatible 1.x+ minor and patch updates, pins and digests after required CI",
       "matchUpdateTypes": [

scripts/check-renovate-policy.cjs

@@ -21,6 +21,18 @@ assert.equal(firstRule.automerge,true);
 assert.equal(firstRule.minimumReleaseAge,null);
 assert.deepEqual(firstRule.matchUpdateTypes,['digest','pinDigest']);
 assert.deepEqual(firstRule.matchManagers,['github-actions']);
+// Renovate #45236: branch-level stability status has no usable timestamp for these update classes.
+// The global 72h timestamp-required policy remains intact for normal releases.
+const timestampOptional=fleet.packageRules.find(r=>r.minimumReleaseAgeBehaviour==='timestamp-optional');
+assert(timestampOptional);
+assert.deepEqual(timestampOptional.matchUpdateTypes,['pin','pinDigest','digest','lockFileMaintenance','lockfileUpdate']);
+assert.equal(Object.hasOwn(timestampOptional,'minimumReleaseAge'),false);
+assert.equal(Object.hasOwn(timestampOptional,'automerge'),false);
+const runners=fleet.packageRules.find(r=>r.matchDepTypes?.includes('github-runner'));
+assert(runners);
+assert.deepEqual(runners.matchDepTypes,['github-runner']);
+assert.equal(runners.minimumReleaseAge,null);
+assert.equal(Object.hasOwn(runners,'automerge'),false);
 const stable=fleet.packageRules.find(r=>r.matchCurrentVersion==='!/^0\\./');
 assert.equal(stable.automerge,true);
 assert(stable.matchUpdateTypes.includes('patch'));