webgrip/homelab-cluster

Fork 0

[PR #70] [CLOSED] fix(renovate): make postUpgradeTasks resilient and disable inline OCI digest pinning #290

New issue

Closed

opened 2026-06-08 08:31:14 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 08:31:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/70
Author: @Copilot
Created: 5/22/2026
Status: ❌ Closed

Base: main ← Head: copilot/fix-warnings

📝 Commits (1)

8737b0f fix(renovate): make postUpgradeTasks resilient and disable inline OCI digest pinning

📊 Changes

2 files changed (+14 additions, -3 deletions)

View changed files

📝 kubernetes/apps/renovate/renovate-operator/jobs/configmap-gitops.yaml (+8 -0)
📝 scripts/update-oci-digests.sh (+6 -3)

📄 Description

Closes #6

Summary

Two targeted fixes to eliminate the remaining ⚠️ WARN: Error updating branch: update failure in the Renovate Dashboard.

1. `scripts/update-oci-digests.sh` — resilient registry failure handling

Root cause: postUpgradeTasks runs ./scripts/update-oci-digests.sh for every Renovate branch update (including chore(): pin dependencies for Docker images in HelmRelease values). The script used exit 1 on the first registry fetch failure, which caused the entire branch update to fail — emitting WARN: Error updating branch: update failure — even when the branch had nothing to do with OCI Helm charts.

Fix: Replace the hard exit 1 with WARN + continue so individual registry failures are logged and skipped rather than aborting the run. The CI verify-oci-digests.sh step remains in place to catch any genuinely stale digests on every PR.

2. `kubernetes/apps/renovate/renovate-operator/jobs/configmap-gitops.yaml` — disable digest pinning for inline `oci://` refs

Root cause: The custom.regex "Process inline OCI dependencies" manager picks up oci://... references in all YAML files (e.g. FluxInstance.spec.distribution.artifact: oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:v0.36.0 in helmrelease.yaml). The existing pinDigests: false rules only covered ocirepository.yaml files. Renovate was therefore including ghcr.io/controlplaneio-fluxcd/flux-operator-manifests in the chore(): pin dependencies group, contributing to that branch's failures.

Fix: Add a complementary enabled: false rule for matchUpdateTypes: [pinDigest, digest] on custom.regex matches in non-ocirepository.yaml files. Version updates via this manager are unaffected; only digest-pin-only updates are suppressed.

Testing

bash scripts/verify-oci-digests.sh . — all 29 OCI repositories OK
bash scripts/update-oci-digests.sh . — all 29 files verified/refreshed, exit 0

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/70 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 5/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `copilot/fix-warnings` --- ### 📝 Commits (1) - [`8737b0f`](https://github.com/webgrip/homelab-cluster/commit/8737b0f783dfaf5b6a0b7a5cf45b5b9efb6ab273) fix(renovate): make postUpgradeTasks resilient and disable inline OCI digest pinning ### 📊 Changes **2 files changed** (+14 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `kubernetes/apps/renovate/renovate-operator/jobs/configmap-gitops.yaml` (+8 -0) 📝 `scripts/update-oci-digests.sh` (+6 -3) </details> ### 📄 Description Closes #6 ## Summary Two targeted fixes to eliminate the remaining `⚠️ WARN: Error updating branch: update failure` in the Renovate Dashboard. ### 1. `scripts/update-oci-digests.sh` — resilient registry failure handling **Root cause:** `postUpgradeTasks` runs `./scripts/update-oci-digests.sh` for *every* Renovate branch update (including `chore(): pin dependencies` for Docker images in HelmRelease values). The script used `exit 1` on the first registry fetch failure, which caused the entire branch update to fail — emitting `WARN: Error updating branch: update failure` — even when the branch had nothing to do with OCI Helm charts. **Fix:** Replace the hard `exit 1` with `WARN + continue` so individual registry failures are logged and skipped rather than aborting the run. The CI `verify-oci-digests.sh` step remains in place to catch any genuinely stale digests on every PR. ### 2. `kubernetes/apps/renovate/renovate-operator/jobs/configmap-gitops.yaml` — disable digest pinning for inline `oci://` refs **Root cause:** The custom.regex "Process inline OCI dependencies" manager picks up `oci://...` references in all YAML files (e.g. `FluxInstance.spec.distribution.artifact: oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:v0.36.0` in `helmrelease.yaml`). The existing `pinDigests: false` rules only covered `ocirepository.yaml` files. Renovate was therefore including `ghcr.io/controlplaneio-fluxcd/flux-operator-manifests` in the `chore(): pin dependencies` group, contributing to that branch's failures. **Fix:** Add a complementary `enabled: false` rule for `matchUpdateTypes: [pinDigest, digest]` on `custom.regex` matches in non-ocirepository.yaml files. Version updates via this manager are unaffected; only digest-pin-only updates are suppressed. ## Testing - `bash scripts/verify-oci-digests.sh .` — all 29 OCI repositories OK - `bash scripts/update-oci-digests.sh .` — all 29 files verified/refreshed, exit 0 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 08:31:14 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/homelab-cluster#290

No description provided.

Rows
Columns