Skip to content

fix(renovate): stop behind-base rebases resetting the pr-cooldown clock - #287

Merged
DevSecNinja merged 1 commit into
mainfrom
fix/renovate-cooldown-no-behind-base-rebase
Jul 27, 2026
Merged

fix(renovate): stop behind-base rebases resetting the pr-cooldown clock#287
DevSecNinja merged 1 commit into
mainfrom
fix/renovate-cooldown-no-behind-base-rebase

Conversation

@DevSecNinja

Copy link
Copy Markdown
Owner

Problem

The pr-cooldown gate (#286 / ADR 0005) measures the 14-day soak from the PR branch head commit date. But with automerge enabled, Renovate's effective rebaseWhen is behind-base-branch (the auto default resolves to this once automerge is on). So every time main advances, Renovate rebases each gated PR, rewrites the head commit with a fresh timestamp, and resets the cooldown clock. On an active repo the gated PRs would soak-reset forever and never merge — the exact perpetual-reset failure we set out to fix, moved from release-age to PR-age.

Confirmed by the repo owner: "Rebasing: Whenever PR is behind base branch."

Fix

Add rebaseWhen: "conflicted" to the ghcr.io/lscr.io/quay.io packageRule so Renovate only rebases on genuine merge conflicts. The head commit is then stable while the PR soaks, so the cooldown completes.

This is safe because branch protection is non-strict (strict_required_status_checks_policy: false): a behind-base gated PR still auto-merges once pr-cooldown passes — no rebase needed. Version bumps and conflict rebases still (correctly) restart the clock, since the merged content changed.

ADR 0005 updated to document the requirement so it isn't reverted.

Validation

packageRules.json5 parses as JSON5; ADR passes dprint check.

Refs DevSecNinja/truenas-apps#115

The pr-cooldown gate measures the soak from the PR branch head commit
date. With automerge enabled, Renovate's default rebaseWhen (auto ->
behind-base-branch) rebases gated PRs every time main advances, rewriting
the head commit and resetting the 14-day cooldown forever on an active
repo — defeating the soak introduced in #286 / ADR 0005.

Set rebaseWhen: "conflicted" on the ghcr.io/lscr.io/quay.io rule so
Renovate only rebases on real conflicts. Branch protection is non-strict
(strict_required_status_checks_policy=false), so a behind-base gated PR
still auto-merges once soaked without needing a rebase. Version bumps and
conflict rebases still (correctly) restart the clock.

Refs DevSecNinja/truenas-apps#115

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@DevSecNinja
DevSecNinja merged commit 53f8930 into main Jul 27, 2026
18 checks passed
@DevSecNinja
DevSecNinja deleted the fix/renovate-cooldown-no-behind-base-rebase branch July 27, 2026 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant