chore(renovate): show real release age and fetch changelogs (!98)

Three gaps in the Renovate setup, all about having enough in front of you at review time.

### Age reads UNKNOWN

`config:recommended` already brings in `mergeConfidence:age-confidence-badges`, so the Age column existed — it just rendered grey. Fetching the badge SVGs from `developer.mend.io` directly shows why: Mend's index covers Maven Central but has nothing for Google's Maven repo, so every androidx/compose coordinate is blank. No token changes it; the JSON API behind the badges answers 401 for everyone.

| coordinate | registry | age badge |
| --- | --- | --- |
| `androidx.compose:compose-bom` | Google Maven | UNKNOWN |
| `androidx.core:core-ktx` | Google Maven | UNKNOWN |
| `com.google.truth:truth` | Maven Central | 2y |
| `org.jetbrains.kotlin:kotlin-stdlib` | Maven Central | 1y (confidence high, passing 99%) |

Age is now computed from `newVersionAgeInDays`, which Renovate derives itself to evaluate `minimumReleaseAge` — Google Maven serves `last-modified` on its POMs, so it's populated where Mend is blank, and the number agrees with the tiers it's read against. Mend keeps the Confidence column, which still resolves for the Maven Central half (Kotlin, Gradle, AGP, the test stack).

### Empty release notes

We run against Gitea, but the packages are *released* on GitHub, so changelog lookups were going out unauthenticated against a 60/h limit. `RENOVATE_GITHUB_COM_TOKEN` lifts that.

**Needs a secret before it does anything:** a github.com PAT with **no scopes ticked**, added as repo secret `GITHUB_COM_TOKEN`. Until then the var resolves empty, which is exactly today's behaviour.

### Nothing expressed how settled a release is

Cooling-off scaled by blast radius: 30 days major, 20 minor, 10 patch/digest.

Deliberately advisory. Renovate's default `internalChecksFilter: strict` would suppress the PR outright until the version aged in; `none` opens it at the highest version immediately, so merging ahead of the window stays a decision rather than a wait. A too-young release still gets a yellow `renovate/stability-days` check — `setStability` computes that from `minimumReleaseAge` + `releaseTimestamp` independently of the filter — and with `automerge: false` nothing acts on it.

### Notes

Validated with `renovate-config-validator` against the pinned 43.232.0. Config is read from the default branch, so the open bump PRs keep their current tables until the next run after this merges.

Reviewed-on: #98

.gitea/workflows/renovate.yml

@@ -39,4 +39,9 @@ jobs:
           RENOVATE_REPOSITORIES: '["makiolaj/calendula"]'
           # Commits/PRs authored as the bot, not a real maintainer.
           RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@jeanlucmakiola.de>'
+          # Read-only github.com PAT (no scopes needed). We run on Gitea, but
+          # nearly every dependency is *released* on GitHub — without this,
+          # changelog/release-note lookups hit the 60/h anonymous rate limit
+          # and PRs arrive with an empty "Release Notes" section.
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
           LOG_LEVEL: info

renovate.json5

@@ -7,6 +7,23 @@
     ":semanticCommits",
   ],
 
+  // `config:recommended` brings in mergeConfidence:age-confidence-badges, whose
+  // Age column is a Mend badge. Mend's Merge Confidence index only covers Maven
+  // Central: org.jetbrains.kotlin, junit, truth, turbine et al resolve, but
+  // every androidx/compose artifact lives on Google's Maven repo and comes back
+  // as a grey UNKNOWN — i.e. most of this project. Renovate already knows the
+  // real answer, since it derives release timestamps itself for the
+  // minimumReleaseAge rules below (Google Maven serves `last-modified` on its
+  // POMs), so take the age from there and leave Mend to the Confidence column,
+  // which still carries signal for the Maven Central half.
+  prBodyDefinitions: {
+    Age: "{{#if releaseTimestamp}}{{{newVersionAgeInDays}}} d{{else}}unknown{{/if}}",
+  },
+  // Default heading links to the Merge Confidence docs; this column is ours now.
+  prBodyHeadingDefinitions: {
+    Age: "Age",
+  },
+
   // No automerge: a dependency bump goes through the same review (and, for
   // anything touching the build, the same on-device check) as a feature
   // before it can ride a release — see docs/RELEASING.md and the
@@ -15,6 +32,16 @@
 
   // One reviewable surface; the dashboard issue lists everything pending.
   dependencyDashboard: true,
+
+  // The cooling-off periods below are advisory, not a gate: "none" turns off
+  // filtering on the minimumReleaseAge check, so the PR is opened at the
+  // highest version straight away and merging early stays a judgement call.
+  // (Renovate's default here is "strict", which suppresses the PR entirely
+  // until the release has aged in.) A still-young release carries a pending
+  // `renovate/stability-days` check so it's visible which side of the line
+  // it's on; with automerge off, nothing acts on that check by itself.
+  internalChecksFilter: "none",
+
   labels: ["dependencies"],
   prConcurrentLimit: 5,
   prHourlyLimit: 0,
@@ -30,6 +57,21 @@
   },
 
   packageRules: [
+    // Cooling-off period, scaled by blast radius: how long a release should
+    // have been out (and un-yanked, un-hotfixed) before it's considered
+    // settled. Advisory only — see `internalChecksFilter` above.
+    {
+      matchUpdateTypes: ["major"],
+      minimumReleaseAge: "30 days",
+    },
+    {
+      matchUpdateTypes: ["minor"],
+      minimumReleaseAge: "20 days",
+    },
+    {
+      matchUpdateTypes: ["patch", "digest", "pin", "rollback"],
+      minimumReleaseAge: "10 days",
+    },
     // material3 is deliberately pinned to the 1.5 *alpha* line for the
     // Expressive APIs (see gradle/libs.versions.toml). Follow the alpha train
     // but keep it in its own PR, reviewed in isolation; revisit the pin when
@@ -52,5 +94,15 @@
       ],
       groupName: "test dependencies",
     },
+    // Last word on the PR table. The merge-confidence preset sets prBodyColumns
+    // from inside a packageRule of its own, and only for the datasources Mend
+    // supports — so a plain top-level prBodyColumns would lose to it for maven
+    // deps, and the Gradle wrapper / Actions / container bumps would keep the
+    // default columns and show no age at all. A rule declared after it wins,
+    // and gives every PR the same table.
+    {
+      matchPackageNames: ["*"],
+      prBodyColumns: ["Package", "Type", "Change", "Age", "Confidence"],
+    },
   ],
 }