fix(renovate): the annotated-ARG manager could not see a digest or a quote #106

Merged

ryangr0 merged 1 commit from fix/renovate-digest-aware-args into main

2026-08-08 12:26:52 +00:00

ryangr0 commented

2026-08-08 06:25:59 +00:00

Owner

Two silent extraction failures in the annotated-ARG custom manager, found while deciding what shape today's digest pins should take so they don't rot:

ARG X=0.3.2@sha256:… captured the whole value as currentValue. No versioning scheme parses that, so every digest-pinned annotated ARG in the repo — cve-gate's three DHI bases, ci-runner's CVE_GATE_VERSION and RUNNER_VERSION — was silently unmanaged. The PR history confirms it: Renovate has bumped bare-version ARGs (#56, Node 22→24) and never a digest-carrying one.
ARG YQ_VERSION="4.47.1" captured the quotes. This is almost certainly the open mystery of why helm-deploy's yq sat stale behind a visually-correct annotation.

Split into two patterns:

<tag>@<digest> shapes — captures currentValue and currentDigest separately; works for both full refs (${REGISTRY_DHI}/golang:1.26.5-alpine3.23-dev@sha256:…) and bare pins (0.3.2@sha256:…)
bare versions — digest-carrying values excluded, so no ARG ever matches both patterns

Both tolerate quoted values.

Verification: all seven ARG shapes that exist in ops/docker today, tested against the patterns loaded from this file — each matches exactly one pattern and extracts a parseable version + digest where present.

No builds triggered (repo-root file only). This unblocks the Phase 1 digest-pinning PRs: without it, every new pin would be invisible to Renovate on day one.

Generated with Claude Code

Two silent extraction failures in the annotated-ARG custom manager, found while deciding what shape today's digest pins should take so they don't rot: - **`ARG X=0.3.2@sha256:…` captured the whole value as `currentValue`.** No versioning scheme parses that, so every digest-pinned annotated ARG in the repo — cve-gate's three DHI bases, ci-runner's `CVE_GATE_VERSION` and `RUNNER_VERSION` — was **silently unmanaged**. The PR history confirms it: Renovate has bumped bare-version ARGs (#56, Node 22→24) and never a digest-carrying one. - **`ARG YQ_VERSION="4.47.1"` captured the quotes.** This is almost certainly the open mystery of why helm-deploy's yq sat stale behind a visually-correct annotation. Split into two patterns: 1. `<tag>@<digest>` shapes — captures `currentValue` and `currentDigest` separately; works for both full refs (`${REGISTRY_DHI}/golang:1.26.5-alpine3.23-dev@sha256:…`) and bare pins (`0.3.2@sha256:…`) 2. bare versions — digest-carrying values excluded, so no ARG ever matches both patterns Both tolerate quoted values. **Verification:** all seven ARG shapes that exist in `ops/docker` today, tested against the patterns loaded from this file — each matches exactly one pattern and extracts a parseable version + digest where present. No builds triggered (repo-root file only). This unblocks the Phase 1 digest-pinning PRs: without it, every new pin would be invisible to Renovate on day one. Generated with [Claude Code](https://claude.com/claude-code)

ryangr0 added 1 commit

2026-08-08 06:25:59 +00:00

fix(renovate): the annotated-ARG manager could not see a digest or a quote d5391572d7

Two silent extraction failures in one matchString:

- 'ARG X=0.3.2@sha256:...' captured the WHOLE value as currentValue. No
  versioning scheme parses that, so every digest-pinned annotated ARG in the
  repo — cve-gate's three bases, ci-runner's CVE_GATE_VERSION and
  RUNNER_VERSION — was silently unmanaged. Renovate has never bumped one;
  the PR history confirms only bare-version ARGs (NODE_VERSION, #56) moved.
- 'ARG YQ_VERSION="4.47.1"' captured the quotes into currentValue, which is
  why helm-deploy's yq sat stale behind a visually-correct annotation.

Split into two patterns: one that captures currentValue and currentDigest
separately for '<tag>@<digest>' shapes (full refs and bare versions alike),
one for bare versions with digest-carrying values excluded so no ARG ever
matches both. Both tolerate quoted values.

Verified against the seven ARG shapes that exist in ops/docker today; each
matches exactly one pattern and extracts a parseable version.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ryangr0 referenced this pull request from a commit

2026-08-08 06:26:37 +00:00

fix(node-ci-runner): pin the base to a digest

ryangr0 referenced this pull request from a commit

2026-08-08 06:30:50 +00:00

fix(techdocs-builder): annotate every stage base so Renovate can see them

ryangr0 referenced this pull request

2026-08-08 06:32:12 +00:00

fix(node-ci-runner): pin the base to a digest #107

ryangr0 referenced this pull request

2026-08-08 06:32:13 +00:00

fix(semantic-release): pin the node base to a digest #110