From d6abe0a778769e9b80f375edb32ed07cfc7f28cc Mon Sep 17 00:00:00 2001
From: Marian Steinbach <marian@giantswarm.io>
Date: Thu, 30 Jul 2026 09:46:50 +0200
Subject: [PATCH] chore: restrict Renovate to nights, drop PR limits, skip
 releases

Renovate ran at any time of day and was throttled by the org preset
(prConcurrentLimit 10, branchConcurrentLimit 10, prHourlyLimit 2), which
drip-fed dependency PRs through working hours.

Invert that: extend schedule:nonOfficeHours (weeknights 22:00-05:00 UTC plus
weekends), stay fully idle outside it via updateNotScheduled, and remove all
three limits so the backlog lands in one nightly batch.

Also suffix commit messages with "[do not release]" so dependency merges no
longer cut a release. Because merges here are squashed with PR_TITLE + BLANK
body, the suffix reaches main through the PR title, which is where
on-merge-create-release.yml looks for the marker. Dockerfile updates are
exempted: publishing only happens on the v* tags that workflow creates, and
the Dockerfile pins the hugo and nginx images that build and serve the site.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 renovate.json5 | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/renovate.json5 b/renovate.json5
index 3a3c43b883..572a31af29 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,6 +1,37 @@
 {
   extends: [
     'github>giantswarm/renovate-presets:default.json5',
+    // Only act during non-office hours: weeknights 22:00-05:00 plus all weekend.
+    // Resolves to ['* 0-4,22-23 * * 1-5', '* * * * 0,6'].
+    'schedule:nonOfficeHours',
+  ],
+  // The schedule above is interpreted in UTC (Renovate's default), stated for clarity.
+  timezone: 'UTC',
+  // Stay completely idle outside the schedule: don't even rebase or automerge
+  // branches that already exist.
+  updateNotScheduled: false,
+  // No throttling inside the window. The Giant Swarm preset caps these at 10/10/2;
+  // these top-level values override it. 0 means "no limit".
+  prConcurrentLimit: 0,
+  branchConcurrentLimit: 0,
+  prHourlyLimit: 0,
+  // Keep dependency merges from cutting a release. The suffix ends up in the PR
+  // title, which is the whole commit message on main (squash merges here use
+  // PR_TITLE + BLANK body), where .github/workflows/on-merge-create-release.yml
+  // looks for it. `commitBody` would not work: squashing discards the branch commit.
+  commitMessageSuffix: '[do not release]',
+  packageRules: [
+    {
+      // Exception: the Dockerfile pins the hugo and nginx images that build and
+      // serve the site, and publishing only happens on the `v*` tags created by
+      // the release workflow. These updates must release, or the merged pins
+      // would not reach docs.giantswarm.io.
+      description: 'Let Dockerfile updates cut a release, since they change the published site',
+      matchFileNames: [
+        'Dockerfile',
+      ],
+      commitMessageSuffix: '',
+    },
   ],
   customManagers: [
     {