Three gaps in the Renovate setup, all about having enough information in
front of you at review time:
- The PR table had no Age/Adoption/Passing/Confidence columns. Those are
Mend's Merge Confidence badges, which self-hosted Renovate only emits
behind the `mergeConfidence:all-badges` preset. No credentials involved
— Renovate embeds badge URLs and the browser resolves them on view.
- Release notes came back empty. We run against Gitea, but the packages
are *released* on GitHub, so changelog lookups were going out
unauthenticated against a 60/h limit. A scopeless read-only PAT
(GITHUB_COM_TOKEN secret) lifts that.
- Nothing expressed how settled a release is. Cooling-off is now scaled
by blast radius: 30 days major, 20 minor, 10 patch/digest.
The age tiers are deliberately advisory. Renovate's default
`internalChecksFilter: strict` would suppress the PR outright until the
version aged in; "none" opens it at the highest version immediately and
leaves a pending stability check behind, so merging ahead of the window
stays a decision rather than a wait.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Jean-Luc Makiola
f36a74246b