Skip to content

ci(renovate): stop the hourly limit starving grouped updates #682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamw7 merged 1 commit into from
Aug 25, 2026
Merged

ci(renovate): stop the hourly limit starving grouped updates #682

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"before 06:00 on monday"
],
"prConcurrentLimit": 5,
"prHourlyLimit": 2,
"prHourlyLimit": 0,
"rebaseWhen": "conflicted",
"vulnerabilityAlerts": {
"enabled": false
Expand Down
11 changes: 9 additions & 2 deletions docs/adr/0005-renovate-dependency-updates.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,15 @@ arrived ungrouped and unscheduled.
The committed configuration extends `config:recommended` and adds only what this
repository's shape calls for:

- **`schedule` (Monday before 06:00 UTC) with concurrency limits** — batches the
noise the *Consequences* section anticipates into one weekly window.
- **`schedule` (Monday before 06:00 UTC) with `prConcurrentLimit: 5`** — batches
the noise the *Consequences* section anticipates into one weekly window, capped
at five open pull requests. The hourly limit is deliberately off
(`prHourlyLimit: 0`): Renovate scans the repository about once a day, so only a
single scan falls inside the weekly window, and an hourly cap of two meant that
one scan opened two pull requests and rate-limited the rest until the *next*
week. A grouped update that keeps losing that race is never reviewed at all —
the GitHub Actions group sat rate-limited behind two Maven bumps — so the
concurrent limit alone now sets the ceiling.
- **`vulnerabilityAlerts: { enabled: false }` and `osvVulnerabilityAlerts: false`**
— the division of labour above, expressed as configuration rather than
convention: Renovate declines security-driven bumps so Dependabot
Expand Down
Loading