From 877cfdf3b6fa0d92349129e3ef00476ff40add90 Mon Sep 17 00:00:00 2001
From: James Cameron <james.cameron@octopus.com>
Date: Mon, 20 Jul 2026 15:58:11 +1000
Subject: [PATCH] ci: exempt pin and digest updates from minimumReleaseAge

---
 renovate-config.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/renovate-config.js b/renovate-config.js
index 0091014..2830bb7 100644
--- a/renovate-config.js
+++ b/renovate-config.js
@@ -39,5 +39,16 @@ module.exports = {
       ],
       pinDigests: true,
     },
+    {
+      // pin/pinDigest/digest updates have no release timestamp, so
+      // minimumReleaseAge can never be satisfied and its stability check
+      // would leave those PRs pending forever.
+      // https://github.com/renovatebot/renovate/issues/40288
+      matchUpdateTypes: ['pin', 'pinDigest', 'digest'],
+      minimumReleaseAge: null,
+      prBodyNotes: [
+        '**Manual supply-chain check:** `minimumReleaseAge` cannot be enforced for pin/digest updates because they have no release timestamp. Before merging, confirm this commit SHA has been published for at least **2 days**.',
+      ],
+    },
   ],
 };