chore: auto-merge safe GitHub Actions updates with a release-age cooldown

[robnester-rh]

What

Two changes to the shared org Renovate preset (config/renovate/renovate.json):

1. Auto-merge safe GitHub Actions updates — a packageRule that auto-merges github-actions minor/patch/digest/pinDigest updates (automerge: true + platformAutomerge: true). Majors are excluded, so the existing global major rule (automerge: false, 🚨 label) keeps breaking upgrades human-reviewed.
2. Release-age cooldown (required companion) — org-wide minimumReleaseAge: "5 days" + internalChecksFilter: "strict", with vulnerabilityAlerts.minimumReleaseAge: "0 days" so genuine security fixes skip the wait.

Why

Now that conforma is 100% SHA-pinned, Renovate opens a continuous stream of digest/minor/patch GitHub-Actions PRs to keep pins current. Each currently needs a human approval, so they pile up ("review rot") and pins risk going stale. This lets the safe ones flow automatically — but never a fresh release (cooldown guards against a compromised version being auto-adopted before the community can detect/yank it).

Safety

• Majors always require a human (automerge: false).
• CI is not bypassed — required status checks live in separate repo-level rulesets and Renovate waits for green checks.
• Cooldown prevents auto-adopting brand-new releases; security fixes are exempt.
• Non-Renovate PRs and human review are unaffected.

Note — separate follow-up required for auto-merge to actually fire

Renovate’s auto-merge waits for the required review; it does not bypass it. So this PR marks the safe PRs auto-mergeable, but they will only merge once Renovate is added as a bypass actor on the org “Baseline” ruleset (scoped to pull requests) — an org-settings change tracked in EC-2185 alongside this PR.

Ref: EC-2185

Co-Authored-By: Claude noreply@anthropic.com

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: d7b4f5ae-16a7-4329-8cfc-5d43c2a5d325

📥 Commits

Reviewing files that changed from the base of the PR and between ba9d07b and fbb1c5f.

📒 Files selected for processing (1)

• config/renovate/renovate.json

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

Renovate now delays standard releases for five days, bypasses that delay for vulnerability alerts, and automatically merges non-major GitHub Actions updates. Major GitHub Actions updates remain subject to manual review.

Changes

Renovate policy updates

Layer / File(s)	Summary
Release age filtering config/renovate/renovate.json	Standard updates require a five-day minimum release age. Vulnerability alerts use a zero-day age and bypass the cooldown.
GitHub Actions automerge config/renovate/renovate.json	Minor, patch, digest, and pinned-digest GitHub Actions updates use platform automerge. Major updates remain excluded.

Priority: ⬇️ Low — Defer this change because it is limited to shared Renovate automation for eligible GitHub Actions updates, with vulnerability alerts already exempt from the cooldown.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to fbb1c

The Renovate policy adds a five-day standard release cooldown, exempts vulnerability alerts, and auto-merges eligible non-major GitHub Actions updates while retaining manual review for major upgrades. No current merge-blocking risk is identified.

Suggested reviewers: st3penta

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main changes: safe GitHub Actions auto-merge and a release-age cooldown.
Description check	✅ Passed	The description accurately explains the Renovate configuration changes, safety constraints, cooldown behavior, and related follow-up work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.8)

config/renovate/renovate.json

File contains syntax errors that prevent linting: Line 4: Expected a property but instead found '// Base configuration presets - these provide sensible defaults'.; Line 5: End of file expected; Line 5: End of file expected; Line 6: Expected an array, an object, or a literal but instead found '// Run renovate each day before 4AM'.; Line 7: expected , but instead found ":prConcurrentLimit20"; Line 7: Expected an array, an object, or a literal but instead found '// Allow up to 20 open PRs simultaneously'.; Line 8: expected , but instead found ":automergePatch"; Line 8: Expected an array, an object, or a literal but instead found '// Auto-merge patch updates (safe changes)'.; Line 9: expected , but instead found ":semanticCommitsDisabled"; Line 9: Expected an array, an object, or a literal but instead found '// Use plain commit messages'.; Line 10: expected , but instead found ":ignoreUnstable"; Line 10: Expected an array, an object, or a literal but instead found '// Skip

... [truncated 5253 characters] ...

ile expected; Line 81: Expected a property but instead found '// Tekton: Safe to auto-merge (infrastructure as code)'.; Line 80: End of file expected; Line 81: End of file expected; Line 82: End of file expected; Line 82: End of file expected; Line 82: End of file expected; Line 82: End of file expected; Line 83: End of file expected; Line 83: End of file expected; Line 83: End of file expected; Line 83: End of file expected; Line 84: End of file expected; Line 84: End of file expected; Line 84: End of file expected; Line 84: End of file expected; Line 85: End of file expected; Line 85: End of file expected; Line 85: End of file expected; Line 85: End of file expected; Line 86: End of file expected; Line 86: End of file expected; Line 86: End of file expected; Line 86: End of file expected

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Auto-merge safe GitHub Actions updates after a release cooldown

✨ Enhancement ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Auto-merges non-major GitHub Actions updates after required checks pass.
• Delays new releases five days to reduce supply-chain risk.
• Exempts vulnerability fixes while preserving manual review for major upgrades.

Diagram

graph TD
  A["Renovate Update"] --> B{"Security Alert?"} -- "Yes" --> C["Immediate Eligibility"] --> E{"Safe Action Update?"} -- "Yes" --> F["CI-Gated Automerge"]
  B -- "No" --> D["Five-Day Cooldown"] --> E
  E -- "No" --> G["Existing Rules"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Scope cooldown to GitHub Actions

• ➕ Avoids delaying unrelated dependency updates
• ➕ Limits behavioral impact to the new automerge policy
• ➖ Provides weaker organization-wide supply-chain protection
• ➖ Requires duplicated policy if other ecosystems later adopt automerge

Recommendation: Keep the global five-day cooldown with the explicit vulnerability exemption; it provides consistent supply-chain protection beyond GitHub Actions while allowing urgent security fixes immediately. Complete the separately tracked Baseline ruleset bypass configuration for Renovate, otherwise required reviews will continue to block platform automerge.

Files changed (1) +20 / -0

Other (1) +20 / -0

renovate.jsonAdd guarded automerge and release-age policies +20/-0

Add guarded automerge and release-age policies

• Adds a strict five-day minimum release age across Renovate-managed dependencies while exempting vulnerability alerts. Enables platform automerge for minor, patch, digest, and pinDigest GitHub Actions updates, leaving major upgrades under the existing manual-review rule.

config/renovate/renovate.json

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗