feat: show upstream release time in PR bodies #14

Merged

ryangr0 merged 1 commit from feat/pr-body-release-visibility into main

2026-08-05 09:12:06 +00:00

ryangr0 commented

2026-08-05 09:12:00 +00:00

Owner

Renovate exposes no soak countdown. When minimumReleaseAge holds an update back,
the only signal is a renovate/stability-days status reading "Updates have not
met minimum release age requirement" — no date, no remaining time. Answering
"when does this actually merge?" meant querying the registry by hand.

Adds two columns built from the releaseTimestamp and newVersionAgeInDays template
fields. Renovate's default columns are [Package, Type, Update, Change, Pending]
and it drops any column empty on every row, which is why PRs commonly render only
three.

Both are self-hosted and deliberately NOT taken from Mend. The Merge Confidence
API covers go, maven, npm, nuget, packagist, pypi and rubygems only — not docker
or helm — so its Age/Adoption/Passing/Confidence badges are blank for container
and chart traffic, which is most of this org's dependency volume. These work for
every datasource including private and pull-through-proxy registries.

The age column is named "Age (d)" rather than "Age" on purpose: Age is a
built-in Mend badge definition, and mergeConfidence:all-badges (already in
extends) legitimately uses it for the datasources Mend does support. Overloading
the name would silently replace a real badge with a plain number there.

The existing Merge Confidence note is left as-is. It says "where supported",
which is accurate — all-badges already scopes those columns via
matchDatasources, so no broken images are rendered on docker PRs today.

An em dash in Released is information, not absence: it means the datasource
reports no timestamp, which is the normal case for ghcr.io/quay.io/proxied
registries and precisely why minimumReleaseAgeBehaviour: timestamp-optional
exists. No timestamp = no soak to wait out.

Summary

Presets affected

Consumer impact

Checklist

Documentation and examples are updated if behavior changed
The validator passes for every shared preset
The release/tagging impact is described

Renovate exposes no soak countdown. When minimumReleaseAge holds an update back, the only signal is a `renovate/stability-days` status reading "Updates have not met minimum release age requirement" — no date, no remaining time. Answering "when does this actually merge?" meant querying the registry by hand. Adds two columns built from the releaseTimestamp and newVersionAgeInDays template fields. Renovate's default columns are [Package, Type, Update, Change, Pending] and it drops any column empty on every row, which is why PRs commonly render only three. Both are self-hosted and deliberately NOT taken from Mend. The Merge Confidence API covers go, maven, npm, nuget, packagist, pypi and rubygems only — not docker or helm — so its Age/Adoption/Passing/Confidence badges are blank for container and chart traffic, which is most of this org's dependency volume. These work for every datasource including private and pull-through-proxy registries. The age column is named "Age (d)" rather than "Age" on purpose: `Age` is a built-in Mend badge definition, and mergeConfidence:all-badges (already in extends) legitimately uses it for the datasources Mend does support. Overloading the name would silently replace a real badge with a plain number there. The existing Merge Confidence note is left as-is. It says "where supported", which is accurate — all-badges already scopes those columns via matchDatasources, so no broken images are rendered on docker PRs today. An em dash in `Released` is information, not absence: it means the datasource reports no timestamp, which is the normal case for ghcr.io/quay.io/proxied registries and precisely why minimumReleaseAgeBehaviour: timestamp-optional exists. No timestamp = no soak to wait out. ## Summary ## Presets affected ## Consumer impact ## Checklist - [ ] Documentation and examples are updated if behavior changed - [ ] The validator passes for every shared preset - [ ] The release/tagging impact is described

ryangr0 added 1 commit

2026-08-05 09:12:00 +00:00

feat: show upstream release time in PR bodies

Validate Renovate presets / validate (default.json) (pull_request) Successful in 1m41s

Details

Validate Renovate presets / validate (grouped.json) (pull_request) Successful in 1m40s

Details

Validate Renovate presets / validate (safe-automerge.json) (pull_request) Successful in 6m49s

Details

Validate Renovate presets / validate all presets (pull_request) Successful in 8m52s

Details

8f05775ee4

Renovate exposes no soak countdown. When minimumReleaseAge holds an update back,
the only signal is a `renovate/stability-days` status reading "Updates have not
met minimum release age requirement" — no date, no remaining time. Answering
"when does this actually merge?" meant querying the registry by hand.

Adds two columns built from the releaseTimestamp and newVersionAgeInDays template
fields. Renovate's default columns are [Package, Type, Update, Change, Pending]
and it drops any column empty on every row, which is why PRs commonly render only
three.

Both are self-hosted and deliberately NOT taken from Mend. The Merge Confidence
API covers go, maven, npm, nuget, packagist, pypi and rubygems only — not docker
or helm — so its Age/Adoption/Passing/Confidence badges are blank for container
and chart traffic, which is most of this org's dependency volume. These work for
every datasource including private and pull-through-proxy registries.

The age column is named "Age (d)" rather than "Age" on purpose: `Age` is a
built-in Mend badge definition, and mergeConfidence:all-badges (already in
extends) legitimately uses it for the datasources Mend does support. Overloading
the name would silently replace a real badge with a plain number there.

The existing Merge Confidence note is left as-is. It says "where supported",
which is accurate — all-badges already scopes those columns via
matchDatasources, so no broken images are rendered on docker PRs today.

An em dash in `Released` is information, not absence: it means the datasource
reports no timestamp, which is the normal case for ghcr.io/quay.io/proxied
registries and precisely why minimumReleaseAgeBehaviour: timestamp-optional
exists. No timestamp = no soak to wait out.

ryangr0 merged commit 34815f45ea into main

2026-08-05 09:12:06 +00:00

ryangr0 referenced this pull request from a commit

2026-08-05 09:12:08 +00:00

Merge pull request 'feat: show upstream release time in PR bodies' (#14) from feat/pr-body-release-visibility into main