Skip to content

Conversation

@jamietanna
Copy link
Contributor

@jamietanna jamietanna commented Oct 13, 2025

Changes

As noted in #38324, there could be a bug occur with branches not being
automagically deleted, where:

  1. repository does not "Automatically delete head branches"
  2. minimumReleaseAge is used to gate a release update, as the release
    is not passing that check
  3. a group that includes that release is set up
  4. a branch is created for all updates except the minimumReleaseAge
    (as expected)
  5. the PR is merged
  6. the branch is not deleted
  7. next time Renovate runs, it sees the branch created - albeit out of
    date - so it treats this as permission to update the package gated by
    minimumReleaseAge

As a step towards fixing this long-term, we can introduce a log warning
to inform repo owners that they may be susceptible to issues.

Context

Please select one of the below:

  • This closes an existing Issue: #
  • This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

Relates to #38325.

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

  • No — I did not use AI for this contribution.
  • Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
  • Yes — substantive assistance (AI generated non‑trivial portions of code, tests, or documentation).
  • Yes — other (please describe):

Documentation (please check one with an [x])

  • I have updated the documentation, or
  • No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

  • Code inspection only, or
  • Newly added/modified unit tests, or
  • No unit tests but ran on a real repository, or
  • Both unit tests + ran on a real repository

The public repository:

Comment on lines +591 to +592
documentationUrl:
'https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches',
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find us using documentationUrl before - is there any prior art?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so, but we should IMO link only our documentation

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think linking to GitHub's official docs will be an issue? Are you concerned about URLs breaking in the future? Or perhaps more that we should "only" try and point to things that we own? (And avoiding a precedent being set, where someone may then think this can be any arbitrary docs?

@jamietanna jamietanna force-pushed the feat/warn-on-no-delete branch from ffe673e to 93f1283 Compare October 13, 2025 09:56
As noted in #38324, there could be a bug occur with branches not being
automagically deleted, where:

1. repository does not "Automatically delete head branches"
1. `minimumReleaseAge` is used to gate a release update, as the release
   is not passing that check
1. a group that includes that release is set up
1. a branch is created for all updates except the `minimumReleaseAge`
   (as expected)
1. the PR is merged
1. the branch is not deleted
1. next time Renovate runs, it sees the branch created - albeit out of
   date - so it treats this as permission to update the package gated by
   `minimumReleaseAge`

As a step towards fixing this long-term, we can introduce a log warning
to inform repo owners that they may be susceptible to issues.
@jamietanna jamietanna force-pushed the feat/warn-on-no-delete branch from 93f1283 to 2693ffe Compare October 14, 2025 09:56
Copy link
Collaborator

@RahulGautamSingh RahulGautamSingh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure if we should do this.

  1. It is not necessary that users only use the github functionality to delete branches, as some can use GH actions to do so.

  2. In some cases we were updating existing branches with PRs, not exactly the same as orphan branches.

documentationUrl:
'https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches',
},
'Repository does not have "Automatically delete head branches" set, which could cause Renovate to re-use a repository in some cases',
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'Repository does not have "Automatically delete head branches" set, which could cause Renovate to re-use a repository in some cases',
'Repository does not have "Automatically delete head branches" set, which could cause Renovate to re-use a branch in some cases',

@jamietanna jamietanna requested a review from viceice October 16, 2025 09:10
@jamietanna jamietanna added this to the v42 milestone Oct 20, 2025
Copy link
Member

@secustor secustor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see conversation else LGTM

Comment on lines +591 to +592
documentationUrl:
'https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so, but we should IMO link only our documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants