Address Dan's review feedback: shorter minimumReleaseAge + precise wording (#757)

* Address Dan's review feedback on #748

Two small follow-ups:

1. minimumReleaseAge: 24 hours -> 1 hour. Dan flagged that 24h is
   overcautious for first-party Stacklok releases. Renovate itself
   only runs every 4h so 1h is effectively close to 0 while still
   protecting against same-day yanks/reverts.

2. prBodyNotes: drop "regenerates" where we're actually just syncing.
   Now precisely: "syncs reference assets (CLI help, Swagger) and
   regenerates the CRD MDX pages" for toolhive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Filter reviewers to repo collaborators only

Previous behavior pulled every non-bot commit author from the upstream
release range and passed them to `gh pr edit --add-reviewer` as a
single comma-separated list. GitHub rejects reviewer requests for
non-collaborators with 422, and because the API treats the list
atomically, one community contributor in the range would fail the
entire call and drop all valid reviewers with it.

Fix:
  - Probe each candidate with `gh api repos/<repo>/collaborators/<user>`
    before adding. 204 -> keep; 404 -> skip.
  - Emit a separate `skipped` output listing non-collaborator
    contributors so the PR body can acknowledge them by name
    ("Other release contributors ... Thanks for the contribution!")
    without actually requesting review from them.

Pre-existing bot-regex filter runs first so we don't waste API calls
on [bot] users.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Drop non-collaborator acknowledgment from PR body

Filtering out non-collaborator reviewers stays (prevents the 422
whole-call-failure). But mentioning them by name in the augmented PR
body adds notification surface we don't want. Silently skip.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rdimitrov

.github/workflows/upstream-release-docs.yml

@@ -367,19 +367,38 @@ jobs:
           REPO: ${{ steps.detect.outputs.repo }}
           PREV: ${{ steps.detect.outputs.prev_tag }}
           NEW: ${{ steps.detect.outputs.new_tag }}
+          REVIEW_REPO: ${{ github.repository }}
         run: |
-          # Capture stderr separately so we can surface a missing-compare
-          # situation in the PR body rather than silently dropping reviewers.
+          # Get non-bot commit authors in the release range.
           if COMPARE=$(gh api "repos/$REPO/compare/$PREV...$NEW" \
               --jq '[.commits[].author.login? // empty] | unique | .[]' 2>/dev/null); then
-            REVIEWERS=$(echo "$COMPARE" |
-              grep -Ev '(\[bot\]$|^github-actions|^stacklokbot$|^dependabot|^renovate|^copilot)' |
-              head -5 | paste -sd, -)
             echo "compare_ok=true" >> "$GITHUB_OUTPUT"
           else
-            REVIEWERS=""
+            COMPARE=""
             echo "compare_ok=false" >> "$GITHUB_OUTPUT"
           fi
+
+          # Filter out bot accounts, then further filter to only this
+          # repo's collaborators. GitHub rejects reviewer requests for
+          # non-collaborators with 422, which would fail the whole
+          # `gh pr edit --add-reviewer` call and drop the valid
+          # reviewers along with the invalid ones. Community
+          # contributors from the upstream repo often aren't
+          # collaborators here; silently skip them.
+          CANDIDATES=$(echo "$COMPARE" |
+            grep -Ev '(\[bot\]$|^github-actions|^stacklokbot$|^dependabot|^renovate|^copilot)' || true)
+
+          REVIEWERS=""
+          while IFS= read -r login; do
+            [ -z "$login" ] && continue
+            if gh api "repos/$REVIEW_REPO/collaborators/$login" --silent 2>/dev/null; then
+              REVIEWERS="${REVIEWERS:+$REVIEWERS,}$login"
+            fi
+          done <<< "$CANDIDATES"
+
+          # Cap at 5 to avoid review fatigue.
+          REVIEWERS=$(echo "$REVIEWERS" | tr ',' '\n' | head -5 | paste -sd, -)
+
           echo "list=$REVIEWERS" >> "$GITHUB_OUTPUT"
           echo "Reviewers: ${REVIEWERS:-<none>}"
 
@@ -603,7 +622,7 @@ jobs:
               echo "$GAPS_BLOCK"
               echo ""
             fi
-            echo "Reviewers below are non-bot commit authors in the release range."
+            echo "Reviewers below are non-bot commit authors in the release range who are also collaborators on this repo."
             echo ""
             echo "$END"
           } > /tmp/section.md

renovate.json

@@ -88,14 +88,14 @@
       "matchManagers": ["custom.regex"],
       "matchFileNames": ["**/.github/upstream-projects.yaml"],
       "schedule": ["at any time"],
-      "minimumReleaseAge": "24 hours",
+      "minimumReleaseAge": "1 hour",
       "minimumReleaseAgeBehaviour": "timestamp-optional",
       "ignoreUnstable": true,
       "rebaseWhen": "never",
       "recreateWhen": "never",
       "commitMessageTopic": "{{depName}}",
       "prBodyNotes": [
-        "After this PR opens, `.github/workflows/upstream-release-docs.yml` adds source-verified content edits for the new release. For `stacklok/toolhive`, the same workflow also regenerates reference docs (CLI help, Swagger, CRD schemas)."
+        "After this PR opens, `.github/workflows/upstream-release-docs.yml` adds source-verified content edits for the new release. For `stacklok/toolhive`, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages."
       ]
     }
   ]