Exempt first-party conforma/* Actions from Renovate cooldown

[robnester-rh]

Adds a github-actions packageRule matching conforma/* with minimumReleaseAge: 0 so our own already-reviewed reusable workflows/Actions propagate immediately. Third-party updates keep the 5-day cooldown.

Why: the cooldown defends against fresh third-party releases; applying it to first-party internal workflows just delays our own fixes. Combined with org-wide sha_pinning_required, that delay stranded consumers on a pre-pinning .fullsend SHA and broke their runs.

Ref: EC-2185

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: f96b10ee-cb19-4632-b885-8bd9d4135f26

📥 Commits

Reviewing files that changed from the base of the PR and between a350bbe and 7853e17.

📒 Files selected for processing (1)

• config/renovate/renovate.json

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Renovate now disables the five-day release-age cooldown for first-party conforma/* GitHub Actions and reusable workflows.

Changes

Renovate configuration

Layer / File(s)	Summary
First-party action update rule config/renovate/renovate.json	Adds a package rule for conforma/* GitHub Actions and reusable workflows. The rule sets minimumReleaseAge to 0 days.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 7853e

The change enables immediate Renovate updates for first-party conforma GitHub Actions while retaining the existing cooldown for third-party updates. No evidence-grounded merge blocker remains.

Suggested reviewers: st3penta, joejstuart

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: exempting first-party conforma/* Actions from the Renovate cooldown.
Description check	✅ Passed	The description explains the Renovate rule, its effect on first-party and third-party updates, and the reason for the change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.10)

config/renovate/renovate.json

File contains syntax errors that prevent linting: Line 4: Expected a property but instead found '// Base configuration presets - these provide sensible defaults'.; Line 5: End of file expected; Line 5: End of file expected; Line 6: Expected an array, an object, or a literal but instead found '// Run renovate each day before 4AM'.; Line 7: expected , but instead found ":prConcurrentLimit20"; Line 7: Expected an array, an object, or a literal but instead found '// Allow up to 20 open PRs simultaneously'.; Line 8: expected , but instead found ":automergePatch"; Line 8: Expected an array, an object, or a literal but instead found '// Auto-merge patch updates (safe changes)'.; Line 9: expected , but instead found ":semanticCommitsDisabled"; Line 9: Expected an array, an object, or a literal but instead found '// Use plain commit messages'.; Line 10: expected , but instead found ":ignoreUnstable"; Line 10: Expected an array, an object, or a literal but instead found '// Skip

... [truncated 5939 characters] ...

ile expected; Line 92: Expected a property but instead found '// Tekton: Safe to auto-merge (infrastructure as code)'.; Line 91: End of file expected; Line 92: End of file expected; Line 93: End of file expected; Line 93: End of file expected; Line 93: End of file expected; Line 93: End of file expected; Line 94: End of file expected; Line 94: End of file expected; Line 94: End of file expected; Line 94: End of file expected; Line 95: End of file expected; Line 95: End of file expected; Line 95: End of file expected; Line 95: End of file expected; Line 96: End of file expected; Line 96: End of file expected; Line 96: End of file expected; Line 96: End of file expected; Line 97: End of file expected; Line 97: End of file expected; Line 97: End of file expected; Line 97: End of file expected

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Exempt first-party Conforma Actions from Renovate cooldown

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bypasses Renovate’s release-age cooldown for first-party conforma/* GitHub Actions.
• Preserves the five-day supply-chain safeguard for third-party dependencies.
• Prevents SHA-pinning enforcement from stranding consumers on incompatible workflow digests.

Diagram

graph TD
  A["Renovate scan"] --> B["GitHub Actions"] --> C{"conforma package?"} -->|Yes| D["No cooldown"]
  C -->|No| E["Five-day cooldown"]

Loading

High-Level Assessment

The package rule is the most direct approach: combining the github-actions manager with an organization-scoped package-name regex narrowly overrides the global cooldown without weakening third-party protections. Enumerating repositories would be more brittle, while removing the global cooldown would unnecessarily reduce supply-chain safeguards.

Files changed (1) +11 / -0

Other (1) +11 / -0

renovate.jsonBypass cooldown for first-party Conforma Actions +11/-0

Bypass cooldown for first-party Conforma Actions

• Adds a GitHub Actions package rule matching 'conforma/*' and sets 'minimumReleaseAge' to zero days. Internal workflow digest updates can propagate immediately, while unmatched third-party dependencies retain the global five-day cooldown.

config/renovate/renovate.json

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗