The Age badge was already there — config:recommended pulls in
mergeConfidence:age-confidence-badges — it just rendered as a grey
UNKNOWN. Fetching the badge SVGs from developer.mend.io directly shows
why: Mend's Merge Confidence index covers Maven Central (truth 2y,
junit-jupiter 1y, kotlin-stdlib 1y / confidence high / passing 99%) but
has nothing for anything served off Google's Maven repo, so every
androidx and compose coordinate comes back UNKNOWN. That's the bulk of
this project, and no token changes it — the JSON API behind the badges
answers 401 for everyone, npm included.
So take the age from the one place that does know. Renovate derives
release timestamps itself to evaluate minimumReleaseAge, and Google
Maven serves last-modified on its POMs, so newVersionAgeInDays is
populated where Mend is blank. Redefining the column costs one template
and makes the number agree with the cooling-off tiers it's read against.
Mend keeps the Confidence column, which still resolves for the Maven
Central half — Kotlin, Gradle, AGP, the test stack — and those are the
bumps where a compatibility signal is worth having. Dropped the
all-badges preset added in the previous commit: Adoption and Passing
have the same Google Maven gap, so they'd have been two more empty
columns. A trailing packageRule pins the same column set for every PR,
including the Gradle wrapper and Actions bumps that Mend's preset never
touched and which showed no age at all.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three gaps in the Renovate setup, all about having enough information in
front of you at review time:
- The PR table had no Age/Adoption/Passing/Confidence columns. Those are
Mend's Merge Confidence badges, which self-hosted Renovate only emits
behind the `mergeConfidence:all-badges` preset. No credentials involved
— Renovate embeds badge URLs and the browser resolves them on view.
- Release notes came back empty. We run against Gitea, but the packages
are *released* on GitHub, so changelog lookups were going out
unauthenticated against a 60/h limit. A scopeless read-only PAT
(GITHUB_COM_TOKEN secret) lifts that.
- Nothing expressed how settled a release is. Cooling-off is now scaled
by blast radius: 30 days major, 20 minor, 10 patch/digest.
The age tiers are deliberately advisory. Renovate's default
`internalChecksFilter: strict` would suppress the PR outright until the
version aged in; "none" opens it at the highest version immediately and
leaves a pending stability check behind, so merging ahead of the window
stays a decision rather than a wait.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
renovate.json5 (config:recommended + semantic commits, no automerge,
dependency dashboard; material3 stays on its 1.5-alpha pin in an
isolated PR; test deps grouped; github-actions manager watches
.gitea/workflows). Cadence owned by .gitea/workflows/renovate.yml
(Mondays 05:00 UTC + manual dispatch), self-hosted via
renovatebot/github-action, scoped to makiolaj/calendula.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
