Why does gitLabIgnoreApprovals require usePlatformAutomerge?

[aav7fl]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab ghcr.io/renovatebot/renovate:37.280.0@sha256:41d577babe0af3f75c1f0784b13fcf3a6850515622b584526f574c23e21366cb

Please tell us more about your question or problem

Related Discussions:

• automergeSchedule ignored if platformAutomerge is true #21371
• Renovate bot can't always automerge in monorepo with codeowners rules applied #19820

(I'm going to use the word MR to mean merge request since that's what GitLab calls them)

Our usage of Renovate looks a little like this:

• Automatically create new MRs for dependency updates outside of business hours using schedule
• Bypass approver checks using gitLabIgnoreApprovals=true (while still "requiring" them for developers)
• Auto-merge the MRs that pass the pipeline checks using platformAutomerge=true

Our simplified config

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  "prConcurrentLimit": 3,
  "platformAutomerge": true,
  "gitLabIgnoreApprovals": true,
  "schedule": [
    "after 10pm every weekday",
    "before 5am every weekday",
    "every weekend"
  ],
  "packageRules": [
    {
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "digest"
      ],
      "automerge": true
    }
  ],
  "timezone": "America/Detroit",
}

Automerging During Work Hours

We're facing an issue with Renovate auto-merging dependency updates during our business hours. This causes disruptions for developers who are actively working on merging their own code changes.

Here's the scenario:

1. Overnight, some dependency MRs might fail pipeline tests due to external factors (e.g., downstream service maintenance).
2. When developers merge any code the next day, Renovate rebases and often auto-merges those dependency MRs when the pipeline completes without any errors (due to platformAutomerge=true).
3. Other developers then have to rebase their work on top of Renovate's merges, re-triggering lengthy pipeline runs (30+ minutes). This results in lost productivity.

We were hoping to resolve this by using the automergeSchedule feature to restrict Renovate's auto-merging to outside of business hours.

Invalid config with `automergeSchedule` set

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  "prConcurrentLimit": 3,
  "platformAutomerge": true,
  "gitLabIgnoreApprovals": true,
  "automergeSchedule": [
    "after 10pm every weekday",
    "before 5am every weekday",
    "every weekend"
  ],
  "schedule": [
    "after 10pm every weekday",
    "before 5am every weekday",
    "every weekend"
  ],
  "packageRules": [
    {
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "digest"
      ],
      "automerge": true
    }
  ],
  "timezone": "America/Detroit",
}

automergeSchedule

Unfortunately, automergeSchedule doesn't work as we expected. If platformAutomerge=true, then automergeSchedule is ignored.

This limitation is documented in the Renovate docs: https://docs.renovatebot.com/configuration-options/#automergeschedule

It's mostly due to the fact that an MR is marked for automerge in GitLab as soon as it's created by Renovate.

Ok. That's fine. We'll disable platformAutomerge and handle the automerge ourselves each time Renovate runs.

Invalid config with `platformAutomerge=false`

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  "prConcurrentLimit": 3,
  "platformAutomerge": false,
  "gitLabIgnoreApprovals": true,
  "automergeSchedule": [
    "after 10pm every weekday",
    "before 5am every weekday",
    "every weekend"
  ],
  "schedule": [
    "after 10pm every weekday",
    "before 5am every weekday",
    "every weekend"
  ],
  "packageRules": [
    {
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "digest"
      ],
      "automerge": true
    }
  ],
  "timezone": "America/Detroit",
}

automerge

This sorta works. It now creates the MRs outside of business hours and it doesn't merge them during business hours. But now it doesn't merge them at all.

Now all of the MRs created by Renovate suddenly require approvals.

The problem with platformAutomerge=false is that we lose the ability to use gitLabIgnoreApprovals=true.

This is noted in the docs: https://docs.renovatebot.com/configuration-options/#gitlabignoreapprovals

Also show in the source code:

renovate/lib/modules/platform/gitlab/index.ts

Lines 651 to 656 in f05bf76

	if (platformOptions?.usePlatformAutomerge) {
	try {
	if (platformOptions?.gitLabIgnoreApprovals) {
	await ignoreApprovals(pr);
	}

This means that Renovate will create MRs and try to auto-merge them, but fail until someone manually approves the MR. This isn't very automatic and quickly creates a backlog dependency updates.

What we'd like to have is Renovate automatically create MRs outside of business hours, merge them if they pass our pipeline, but freeze any merges during business hours. We keep hitting config conflicts each time we think we've solved it like that.

Possible Solutions

• Allow gitLabIgnoreApprovals=true with platformAutomerge=false. I'm not sure why this is gated in the code?
• Make automergeSchedule work with platformAutomerge=true by only marking the MR for automerge:
  1. After the pipeline passes
  2. During the auto-merge schedule
     1. This isn't be very precise as changes aren't checked or applied until the next time Renovate runs, but it would be close enough. This would differ how it's done today, where the automerge is set on MR creation in GitLab.
• Create a bot that would auto-approve the MRs created by Renovate. But that feels a little reckless?
• Allow Renovate to bypass branch rules and merge directly to main without opening an MR (automergeType=branch). But we really prefer to see these changes in GitLab and want to avoid this due to how our pipelines run.
• Petition GitLab to allow certain users to bypass approvals, just like GitHub. (Low chance of that happening. A similar request has been open since 2017: https://gitlab.com/gitlab-org/gitlab/-/issues/4161)
• Something else I'm not seeing?

Questions

1. Are we not using Renovate as intended, or are these unforeseen limitations that we're running into?
2. If this seems wrong, how should be be approaching auto-merging outside of hours?

Thanks!

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[aav7fl]

I'm wondering if it's possible to allow the bot to auto-approve its own MR in our GitLab. I know there's a Renovate config for it.

https://docs.renovatebot.com/configuration-options/#autoapprove

Auto-approving your own MR is currently disabled in our GitLab for MRs.

• https://docs.renovatebot.com/configuration-options/#autoapprove

But I'm still looking if there is a way to override this property for certain users based on these configuration options since I found this quote:

"Users with specific permissions can always approve work"

• https://docs.gitlab.com/ee/user/project/merge_requests/approvals/#configuration-options-for-approvals

[rarkins]

A PR would be welcome to "ungate" the auto approve

[aav7fl]

A PR would be welcome to "ungate" the auto approve

Thanks. Can you think of any reason that it was gated in the first place? I'm trying to figure out if it says straightforward as just removing the condition, updating the tests, and updating the docs.

[rarkins]

• Remove GitLab approval rules when automerging #6577

[aav7fl]

Thanks! MR opened. Did my best to follow the guidelines. Tested locally.

• fix(config): Remove usePlatformAutomerge restriction with gitLabIgnoreApprovals #29972