From 2e0e37d838dc697555404d2d4851e51b4ead4512 Mon Sep 17 00:00:00 2001 From: jklein Date: Mon, 24 Aug 2026 12:01:08 +0200 Subject: [PATCH] renovate: automerge minor updates, make the install-test blocking The two open Renovate PRs (#138 alpine 3.22 -> 3.24, #139 nginx 1.30.4 -> 1.31.4) never automerged because both are minor updates while the rule only covered patch and digest. Sidecar images barely move in patch steps, so patch-only would practically never fire. Automerging a chart update publishes it, so the install-test can no longer report failures without blocking: continue-on-error is gone and issue #22's stabilization phase ends here. Majors stay manual. --- .github/workflows/validate-charts.yml | 8 ++++---- README.md | 6 ++++-- renovate.json5 | 9 +++++++-- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.github/workflows/validate-charts.yml b/.github/workflows/validate-charts.yml index 5a56f3b..4448682 100644 --- a/.github/workflows/validate-charts.yml +++ b/.github/workflows/validate-charts.yml @@ -132,10 +132,10 @@ jobs: needs: [detect-changed-charts, build-chart] if: needs.detect-changed-charts.outputs.any-chart-changed == 'true' runs-on: ubuntu-latest - # Stabilization phase (issue #22): the job reports failures but does not - # block the PR. Promote to a required check (drop continue-on-error) once - # it has proven stable across several chart PRs. - continue-on-error: true + # Blocking since Renovate automerges patch/minor updates: a chart that no + # longer starts must stop the PR before it reaches main and publishes. This + # ends the stabilization phase of issue #22 - the job reported failures + # without blocking while it proved itself across several chart PRs. timeout-minutes: 30 strategy: fail-fast: false diff --git a/README.md b/README.md index 3d511c6..101f9db 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ Fixtures live at the **repo root** under `ci/` (deliberately *not* inside the ch - `ci//settings.env` — optional overrides (e.g. `INSTALL_TIMEOUT` for slow starters) - `ci/excluded-charts.txt` — charts that cannot run in CI, each with a justification. Currently: `satisfactory` (multi-GB image + 10GB+ Steam download), `template-chart` (scaffold with placeholder image) -Fixture images avoid Docker Hub where possible (`public.ecr.aws`/`ghcr.io`) to dodge runner rate limits. The job currently runs with `continue-on-error: true` (stabilization phase); it will be promoted to a required check once it has proven stable across several chart PRs. When adding a new chart, add its `ci//` fixtures (or an entry in `ci/excluded-charts.txt`) — the install-test fails if both are missing. The script also runs locally against any existing cluster: `k3d cluster create t && ci/run-install-test.sh && k3d cluster delete t`. +Fixture images avoid Docker Hub where possible (`public.ecr.aws`/`ghcr.io`) to dodge runner rate limits. The job **blocks the PR** on failure — the stabilization phase of #22 ended when Renovate started automerging patch/minor updates, since a chart that no longer starts must not reach `main` and publish unattended. When adding a new chart, add its `ci//` fixtures (or an entry in `ci/excluded-charts.txt`) — the install-test fails if both are missing. The script also runs locally against any existing cluster: `k3d cluster create t && ci/run-install-test.sh && k3d cluster delete t`. ## Dependency updates (Renovate) @@ -90,9 +90,11 @@ Everything is derived from the base commit, so the script is idempotent across t > > Without that entry Renovate skips the task without an error and every chart PR stays red on the version check. +If the dependency dashboard reports `Failed to look up github-releases package …: no-result` for third-party repos, that is the instance's GitHub credentials, not this config: a GitHub App installation token is not a good fit for looking up repos the app is not installed on. Give the instance a separate read-only PAT as `GITHUB_COM_TOKEN` for github.com datasource lookups. + ### PR policy -- **Automerge** for `patch` and `digest` updates, after a `minimumReleaseAge` of 3 days and only once the PR pipeline is green. Renovate merges itself rather than using GitHub auto-merge, which would merge immediately as long as `validate-charts` is not a required check. Everything else is merged by hand. +- **Automerge** for `patch`, `minor` and `digest` updates, after a `minimumReleaseAge` of 3 days and only once the PR pipeline is green — install-test included, which is why that job no longer runs with `continue-on-error`. Minor is in scope because the sidecar images barely move in patch steps (`alpine 3.22` → `3.24`, `nginx 1.30.4` → `1.31.4` are both minor), so a patch-only rule would practically never fire. Renovate merges itself rather than using GitHub auto-merge, which would merge immediately as long as `main` has no required status checks. Majors are merged by hand. - **Majors** arrive one line at a time (`separateMultipleMajor`): a v1 → v3 jump produces a PR for the latest v2 first and then one for v3 — the stepwise procedure the versioning section requires. - `prConcurrentLimit: 10` / `prHourlyLimit: 4` keep the k3d install-tests from all starting at once. - The manually dispatched `change-app-version.yml` still exists for one-off bumps, but the normal path for app updates is now a Renovate PR. diff --git a/renovate.json5 b/renovate.json5 index ef29f8a..220bf98 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -71,8 +71,13 @@ enabled: false, }, { - description: "Patch and digest updates merge themselves once the PR pipeline is green.", - matchUpdateTypes: ["patch", "digest"], + description: [ + "Patch, minor and digest updates merge themselves once the PR pipeline is green.", + "Minor is included because the sidecar images barely move in patch steps —", + "alpine 3.22 -> 3.24 and nginx 1.30.4 -> 1.31.4 are both minor, so a patch-only", + "rule would practically never fire. Majors stay manual.", + ], + matchUpdateTypes: ["patch", "minor", "digest"], automerge: true, automergeType: "pr", // Renovate waits for the checks itself instead of handing the PR to