feat(githubaction): support dependency cooldown in autodiscovery by loispostula · Pull Request #10151 · updatecli/updatecli

loispostula · 2026-08-28T10:38:40Z

Follows #8966 (Golang) and #9915 (npm) in the dependency cooldown epic #7866.

The github/action crawler now accepts an age window and propagates it to the release, tag, and branch sources it generates, so a freshly published Action version can be held back until it has cooled down:

autodiscovery:
  crawlers:
    github/action:
      age:
        minimum: '7d'

The four source kinds the crawler emits gained the same age setting, since none of them could honor it before:

kind	date used
`githubrelease`	release publication date, newly requested from the GraphQL API (`publishedAt`, falling back to `createdAt` for drafts)
`gittag`	commit date already carried by `gitgeneric.TagRefs`
`gitbranch`	latest commit date already carried by `gitgeneric.BranchRefs`
`gitea/release`	`scm.Release.Published`, falling back to `Created`

The filter narrows down which version a source picks, so it applies to sources only. Conditions check that a specific reference exists and keep matching every one, which the generated manifests rely on for their dependson: condition#release gating.

The age: block emitted into a generated manifest now comes from a single shared age.ManifestTemplate snippet rather than being pasted per source.

Test

To test this pull request, you can run the following commands:

cd pkg/plugins/autodiscovery/githubaction && go test
cd pkg/plugins/resources/githubrelease && go test
cd pkg/plugins/resources/gittag && go test
cd pkg/plugins/resources/gitbranch && go test
cd pkg/plugins/resources/gitea/release && go test
cd pkg/plugins/utils/age && go test

Additional Information

Checklist

I have updated the documentation via pull request in website repository.
I have tested this pull request manually with a custom Updatecli build and it works as expected.

Both are still open on my side: the new age setting on the crawler and on the four resources needs a website PR, and I have only exercised this through the unit tests, not against the live GitHub and Gitea APIs.

Tradeoff

Two cases where an age window cannot be honored are reported as errors rather than silently ignored, since a cooldown that quietly stops applying is worse than a loud failure:

githubrelease falls back to git tags when a repository publishes no release, and that fallback only reports tag names. Note this is not reachable from the generated manifests, where the release source is gated behind a condition checking the reference really is a release.
gittag with lsRemote: true lists tags without their dates, so the combination is rejected at validation time.

age is opt-in with no default, matching the Golang crawler. The npm crawler defaults to minimum: 3d, so the two conventions still differ.

Potential improvement

Teach SearchTags to return commit dates via the GraphQL committedDate inline fragment, so the githubrelease git tag fallback can honor a cooldown instead of refusing.
Apply the cooldown to the Docker images referenced by a workflow, which needs age on dockerimage and dockerdigest first.
The Golang and npm crawlers still inline their own copy of the age: manifest block and could move to the shared age.ManifestTemplate added here.

The github/action crawler now accepts an `age` window and propagates it to the release, tag, and branch sources it generates, so a freshly published Action version can be held back until it has cooled down. The four source kinds it emits gained the same `age` setting, since none of them could honor it before: * githubrelease, from the release publication date newly requested from the GraphQL API. The git tag fallback only reports tag names, so an age window is reported as an error there rather than silently ignored. * gittag and gitbranch, from the dates already carried by TagRefs/BranchRefs. `lsRemote` lists tags without their dates and is rejected alongside `age`. * gitea/release, from the release publication date, falling back to its creation date. The filter narrows down which version to pick, so it applies to sources only: conditions check that a specific reference exists and keep matching every one. Ref updatecli#8999 Signed-off-by: Loïs Postula <lois@postu.la>

The scenario left `credentials` empty, so the crawler fell back to the GITHUB_TOKEN of whatever environment ran the test and emitted it in the generated manifest. That passes locally and fails on CI runners. Pin an explicit token like every other GitHub scenario in this table does. Signed-off-by: Loïs Postula <lois@postu.la>

mergify · 2026-08-28T11:57:39Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

Copilot

🟡 Changes recommended

The new Gitea cooldown filtering lacks regression coverage for exclusion and all-filtered behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds dependency cooldown support to GitHub Action autodiscovery and its generated release, tag, and branch sources.

Changes:

Adds shared age-window matching and manifest templating.
Filters GitHub/Gitea releases, Git tags, and Git branches by age.
Propagates crawler age settings into generated manifests with tests.

File summaries

File	Description
`pkg/plugins/utils/age/main.go`	Adds matching and shared template helpers.
`pkg/plugins/utils/age/main_test.go`	Tests age-window matching.
`pkg/plugins/scms/github/release.go`	Retrieves release publication dates.
`pkg/plugins/resources/gittag/utils.go`	Filters dated tags.
`pkg/plugins/resources/gittag/source.go`	Applies source age filtering.
`pkg/plugins/resources/gittag/source_test.go`	Tests tag cooldown behavior.
`pkg/plugins/resources/gittag/main.go`	Adds and validates age configuration.
`pkg/plugins/resources/gittag/condition.go`	Excludes age from conditions.
`pkg/plugins/resources/githubrelease/source.go`	Filters releases by publication age.
`pkg/plugins/resources/githubrelease/source_test.go`	Tests release cooldown behavior.
`pkg/plugins/resources/githubrelease/main.go`	Adds release age configuration.
`pkg/plugins/resources/gitea/release/source.go`	Applies Gitea release filtering.
`pkg/plugins/resources/gitea/release/main.go`	Adds age-aware release discovery.
`pkg/plugins/resources/gitea/release/condition.go`	Excludes age from conditions.
`pkg/plugins/resources/gitea/release/age_test.go`	Tests publication-date fallback.
`pkg/plugins/resources/gitbranch/source.go`	Filters branches by commit age.
`pkg/plugins/resources/gitbranch/source_test.go`	Tests branch cooldown behavior.
`pkg/plugins/resources/gitbranch/main.go`	Adds branch age configuration.
`pkg/plugins/autodiscovery/githubaction/workflowGHAManifest.go`	Supplies age to templates.
`pkg/plugins/autodiscovery/githubaction/utils_test.go`	Registers the age fixture.
`pkg/plugins/autodiscovery/githubaction/testdata/age/.github/workflows/updatecli.yaml`	Adds cooldown discovery input.
`pkg/plugins/autodiscovery/githubaction/templateGHAGitHub.go`	Emits age for GitHub sources.
`pkg/plugins/autodiscovery/githubaction/templateGHAGitea.go`	Emits age for Gitea sources.
`pkg/plugins/autodiscovery/githubaction/main.go`	Exposes and validates crawler age.
`pkg/plugins/autodiscovery/githubaction/main_test.go`	Verifies generated cooldown manifests.

Review details

Files reviewed: 25/25 changed files
Comments generated: 2
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…ry version

…t releases

…crawler tests

loispostula added 2 commits August 28, 2026 12:36

olblak added the enhancement New feature or request label Aug 28, 2026

Merge branch 'main' into feat/githubaction-autodiscovery-cooldown

d38d26a

olblak requested a balanced review from Copilot September 3, 2026 11:21

Copilot started reviewing on behalf of olblak September 3, 2026 11:22 View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Comment thread pkg/plugins/resources/gitea/release/main.go

Comment thread pkg/plugins/utils/age/main.go

olblak and others added 6 commits September 3, 2026 14:14

Merge branch 'main' into feat/githubaction-autodiscovery-cooldown

d86dc35

Merge branch 'main' into feat/githubaction-autodiscovery-cooldown

2747d5e

fix(source): skip rather than fail when the age filter holds back eve…

d6c5f3d

…ry version

fix(githubrelease): keep the git tag fallback for repositories withou…

887ff50

…t releases

test(githubaction): stop the environment token from leaking into the …

e02b3c2

…crawler tests

Merge branch 'main' into feat/githubaction-autodiscovery-cooldown

540f22f

olblak approved these changes Sep 4, 2026

View reviewed changes

Merge branch 'main' into feat/githubaction-autodiscovery-cooldown

84de9cc

olblak enabled auto-merge (squash) September 4, 2026 12:26

olblak added resource-githubRelease Resource of kind GitHub Release autodiscovery All things related to the autodiscovery feature resource-gittag Resource of kind Git Tag resource-gitbranch labels Sep 4, 2026

olblak merged commit 4911e3f into updatecli:main Sep 4, 2026
8 checks passed

Navigation Menu

Uh oh!

feat(githubaction): support dependency cooldown in autodiscovery - #10151

feat(githubaction): support dependency cooldown in autodiscovery#10151
olblak merged 10 commits into
updatecli:mainfrom
loispostula:feat/githubaction-autodiscovery-cooldown

loispostula commented Aug 28, 2026

Uh oh!

mergify Bot commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

loispostula commented Aug 28, 2026

Test

Additional Information

Checklist

Tradeoff

Potential improvement

Uh oh!

mergify Bot commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants