From 7853e171a07195b3947200a230bef5cd65560891 Mon Sep 17 00:00:00 2001 From: Rob Nester Date: Wed, 9 Sep 2026 15:31:55 -0400 Subject: [PATCH] Exempt first-party conforma/* Actions from Renovate cooldown The 5-day minimumReleaseAge cooldown defends against freshly published third-party releases. Applying it to our own conforma/* reusable workflows and Actions is counterproductive: it delays adoption of already-reviewed internal fixes. Combined with org-wide sha_pinning_required, that delay strands consumers on a pre-pinning reusable-workflow SHA and breaks their runs (as happened with the .fullsend dispatch pin). Add a github-actions packageRule matching conforma/* with minimumReleaseAge 0 so internal digest bumps propagate immediately while third-party updates keep the cooldown. Co-Authored-By: Claude Ref: EC-2185 --- config/renovate/renovate.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/config/renovate/renovate.json b/config/renovate/renovate.json index 98e426e..ae68b77 100644 --- a/config/renovate/renovate.json +++ b/config/renovate/renovate.json @@ -71,6 +71,17 @@ "automerge": true, "platformAutomerge": true }, + { + // First-party conforma/* Actions & reusable workflows: skip the release-age + // cooldown. The cooldown defends against fresh THIRD-PARTY releases; our own + // internal, already-reviewed workflows should propagate immediately. Combined + // with org-wide sha_pinning_required, delaying an internal digest bump strands + // consumers on a pre-pinning SHA and breaks their runs (see EC-2173/EC-2185). + "description": "No release-age cooldown for first-party conforma/* Actions", + "matchManagers": [ "github-actions" ], + "matchPackageNames": [ "/^conforma\\//" ], + "minimumReleaseAge": "0 days" + }, { // Group JavaScript/Node.js dependency updates "description": "Group npm dependency updates",