renovate: enforce the soak (disable platformAutomerge) + kill the npm --before notice - #7
Merged
Merged
Conversation
minimumReleaseAge makes Renovate pass 'npm install --before=<now-soak>' to age-protect transitive deps. When the existing lockfile holds packages newer than that cutoff (e.g. a freshly-pinned direct dep, or a recent npm install), npm errors, Renovate retries without --before, and logs a noisy 'npm --before could not be enforced' artifact notice on every affected dependency PR. There is no flag to suppress just the notice (it's automatic in the npm post-update manager). The documented fix: lockFileMaintenance regenerates the lockfile from scratch WITH --before on a schedule, keeping the base lockfile clean so the fallback (and its notice) stops firing on regular dep PRs. Enabled with automerge + monthly schedule = one quiet self-merging PR per repo per month.
CRITICAL: minimumReleaseAge's soak is a NON-required 'renovate/stability-days' status check. With platformAutomerge:true (the Renovate default), GitHub's native auto-merge fires as soon as the REQUIRED checks pass and ignores the non-required stability check — so the soak is bypassed entirely. That's how the sharp 0.35.1 minor PR (jellyrock/jellyrock#657) merged ~11 min after CI instead of after its 5-day soak. platformAutomerge:false makes Renovate perform the merge itself, which honours minimumReleaseAge. Keeping stability-days NON-required is deliberate: a human can still merge a hotfix early, while Renovate's own automerge waits out the soak. (Same PR also enables lockFileMaintenance to stop the npm --before artifact notice — see the other commit.)
cewert
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two related hardening fixes to the soak/automerge policy added in #6.
1.
platformAutomerge: false— the important oneThe soak was being bypassed.
minimumReleaseAgeenforces its wait via a non-requiredrenovate/stability-daysstatus check. WithplatformAutomerge: true(the Renovate default), GitHub's native auto-merge fires as soon as the required checks pass and ignores that non-required check — so a soaking PR merges anyway.This already happened: jellyrock/jellyrock#657 (
sharp0.35.1, a minor) merged ~11 minutes after CI went green instead of after its 5-day soak.platformAutomerge: falsemakes Renovate do the merge itself, which honoursminimumReleaseAge. Keepingstability-daysnon-required is deliberate — a human can still merge a hotfix early, while Renovate's own automerge waits out the soak. (The alternative, makingstability-daysa required check, would enforce the soak but also block manual early-merge — not what we want.)Trade-off: automerge now happens on Renovate's run cadence (minutes–hours) rather than GitHub's instant native queue. Fine.
2.
lockFileMaintenance(automerge, monthly) — kills the--beforenoticeminimumReleaseAgemakes Renovate passnpm install --before=<now − soak>to age-protect transitive deps. When the existing lockfile holds packages newer than that cutoff, npm errors, Renovate retries without--before, and logs a noisy "npm--beforecould not be enforced …" notice on the PR. There's no flag to suppress just the notice. Monthly lock-file maintenance regenerates the lockfile from scratch with--before, keeping it clean so the notice stops recurring.README updated for both, with "don't revert this without …" guardrail notes.