Environment:

• OneDev: 16.8.6
• Renovate 44.14.10
• RenovateStep run from a central project against child projects.

Symptoms

When a repository has a pending Renovate branch for a datasource that uses minimumReleaseAge, the step stops processing that repository after the first branch. No PR is created for that branch, and the repo's other branches (for example renovate/lock-file-maintenance) are never reached. Every later run repeats this.

Job log (debug level):

DEBUG: GET https://<server>/~api/renovate/repos/apps/password-generator/commits/1824eaffc0ea14f6f1ecdbae9969a38de17fb196/statuses = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 ...)
DEBUG: Commit not found when checking statuses (branch=renovate/npm-(non-major))
DEBUG: Passing repository-changed error up
INFO: Repository has changed during renovation - aborting

Commit 1824eaf... exists: it is the head of branch renovate/npm-(non-major), pushed by the same job minutes earlier.

Why Renovate aborts (theory)

The job log shows "platform": "github" and "endpoint": "https://<server>/~api/renovate". In Renovate's GitHub platform, getBranchStatusCheck maps any 404 to a repository-changed error. The code below is from Renovate 44.147.0; the job runs 44.14.10 and logs the same message:

} catch (err) {
  if (err.statusCode === 404) {
    logger.debug("Commit not found when checking statuses");
    throw new Error(REPOSITORY_CHANGED);
  }
  throw err;
}

In 44.147.0 it is reached through setStatusCheck -> setStability (the renovate/stability-days status). In our runs the call only happened for branches that a minimumReleaseAge rule applied to.

Expected vs actual

Tested against GitHub's live API (octocat/Hello-World, unauthenticated):

• GET /repos/octocat/Hello-World/commits/<existing sha with no statuses>/statuses returns 200 []. Same for the branch name master.
• An unknown branch name returns 404. An unknown repository returns 404.
• A 40-character SHA that does not exist (all zeros) returns 200 [], not 404.
• GitHub's docs for this endpoint list only 200 and 301 and do not describe the empty case.

OneDev returns 404 for commits/<sha>/statuses where <sha> is the head commit of a branch that exists and was pushed by the same job (1824eaf..., seen on the remote branch). It returned 404 again for the same SHA in a second run about 7 minutes later.

Repro

• Central project with a RenovateStep and this in globalConfig: packageRules: [{ matchDatasources: ["npm"], minimumReleaseAge: "7 days" }]
• A child project with a package.json that has an outdated dependency whose newer release is older than 7 days.
• Run the step. Renovate pushes renovate/npm-(non-major), then logs the 404 and aborts the repository.

With minimumReleaseAge set to null for npm in that child project only, the same run made no /statuses call, created the branch and PR, and then also processed renovate/lock-file-maintenance and created its PR.

Can the GET /~api/renovate/repos/{owner}/{repo}/commits/{ref}/statuses return 200 [] for an existing commit with no statuses, and make sure the matching status-create endpoint works, so that Renovate's minimumReleaseAge status check can be used again.