From fbb1c5f790c030548088981d78ba2ee6978cf834 Mon Sep 17 00:00:00 2001 From: Rob Nester Date: Tue, 8 Sep 2026 09:56:57 -0400 Subject: [PATCH] chore: auto-merge safe GitHub Actions updates with a release-age cooldown Reduce Renovate "review rot" for GitHub Actions while preserving safety. - Auto-merge github-actions minor/patch/digest/pinDigest updates (platformAutomerge). Majors are excluded, so the existing major rule's automerge:false keeps breaking upgrades human-reviewed. - Add an org-wide minimumReleaseAge cooldown (5 days) with internalChecksFilter:strict so we never auto-adopt a freshly-published (possibly compromised) release; genuine security fixes are exempt via vulnerabilityAlerts.minimumReleaseAge:0. CI/status checks still gate every merge. For auto-merge to actually fire, Renovate must also be added as a bypass actor on the org "Baseline" ruleset (separate org-settings step); until then these PRs are marked auto-mergeable but still wait for the required review. Co-Authored-By: Claude Ref: EC-2185 --- config/renovate/renovate.json | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/config/renovate/renovate.json b/config/renovate/renovate.json index 2b8f1f2..98e426e 100644 --- a/config/renovate/renovate.json +++ b/config/renovate/renovate.json @@ -22,6 +22,16 @@ // Run go mod tidy after updating Go modules to prevent stale checksums in go.sum "postUpdateOptions": ["gomodTidy"], + // Supply-chain hardening: don't adopt a release until it has had time to be + // vetted (and yanked if malicious). Applies org-wide; security fixes are exempt below. + "minimumReleaseAge": "5 days", + "internalChecksFilter": "strict", // enforce the age gate even when other updates are pending + + // Genuine security (vulnerability) fixes bypass the cooldown so patches land promptly + "vulnerabilityAlerts": { + "minimumReleaseAge": "0 days" + }, + "packageRules": [ { // Global rule: All major updates get special treatment @@ -51,6 +61,16 @@ "matchManagers": [ "github-actions" ], "groupName": "github actions" }, + { + // Auto-merge SAFE GitHub Actions updates (minor/patch/digest) after the cooldown. + // Majors are excluded here, so the global major rule's automerge:false still + // applies to them (breaking upgrades always stay manual / human-reviewed). + "description": "Auto-merge safe (non-major) GitHub Actions updates", + "matchManagers": [ "github-actions" ], + "matchUpdateTypes": [ "minor", "patch", "digest", "pinDigest" ], + "automerge": true, + "platformAutomerge": true + }, { // Group JavaScript/Node.js dependency updates "description": "Group npm dependency updates",