chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.108.0

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/kimdre/doco-cd	minor	0.106.0 → 0.108.0

---

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

v0.108.0

Compare Source

What's Changed

This release adds support for including Git repos and OCI artifacts in Docker Compose's include top-level section as described in their documentation:

include allows you to reference Compose files from remote sources, such as OCI artifacts or Git repositories.
Here serviceB is defined in a Compose file stored on Docker Hub.

include:
  - oci://docker.io/username/my-compose-app:latest # use a Compose file stored as an OCI artifact
services:
  serviceA:
    build: .
    depends_on:
      - serviceB 

Use the new OCI_INSECURE_REGISTRIES environment variable to set a comma-seperated allowlist of OCI registries to treat as insecure (HTTP or self-signed certs). Entries are deduplicated and normalized to lowercase. Each entry must be a hostname with optional port (no URL schemes allowed).

Example: registry.example:5000,localhost:5000

To use includes:

1. Add include: section to a Compose file:

   include:
     - path: https://github.com/user/repo.git#main:docker-compose.yml  # use a relative path if the compose file is in a subdirectory: docker/compose.yml
     - path: oci://docker.io/namespace/config:latest

2. If using private Git repos, ensure GIT_ACCESS_TOKEN or domain-scoped credentials are configured (see wiki).
3. If pulling from self-signed OCI registries, set OCI_INSECURE_REGISTRIES.

🌟 Improvements

• fix(compose): support remote git and OCI artifact includes by @​kimdre in #​1655

Full Changelog: kimdre/doco-cd@v0.107.0...v0.108.0

v0.107.0

Compare Source

What's Changed

New configuration options:

• DATA_HOST_PATH: Optional source path of the deployment data mount as seen by the target Docker daemon (See Remote Docker daemons). Automatically detected by default.
• Added configurable retention for rotated Docker Swarm configs and secrets, including an option to disable automatic pruning. See Docker Settings and Deploy Settings in the wiki.

Improvements, fixes and changes

• (Swarm) Rollbacks are detected and reported correctly now.
• (Swarm) Fixed a bug that caused all tasks/services of a stack to be recreated on every deployment. This fix required some bigger changes under the hood, that requires users to take action (see the boxes below).

[!IMPORTANT]
The default value of the auto_discovery.delete option changed to false. Users, that want to auto-remove obsolete projects/stacks, need to explicitly set auto_discovery.delete: true in their deployment config now.

[!NOTE]

• The first deployment after upgrading doco-cd will trigger a recreation of all tasks/containers in the stack to set the correct doco-cd metadata.
• The REST API response shape for the Stack endpoints changed

• Compose secrets and configs and external secrets are now supported in scheduled jobs.
• A message gets send when a deployment starts and APPRISE_NOTIFY_LEVEL is set to info.
• Diagnostics and troubleshooting for registry authentication has been improved. See Private Container Registries in the wiki.
• doco-cd is now able to recover from missing deployed commits (e.g. after a force push)
• Added more granular labeling for Prometheus metrics by allowing deployment metric labels (e.g. errors and durations) to be tracked per repository and deployment.

✨ Features

• feat: support explicit data host path by @​nosovk in #​1639
• feat(swarm): add configuration options for config and secret revisions retention by @​kimdre in #​1652

🌟 Improvements

• feat(notification): notify on started deployment by @​kimdre in #​1633
• fix(notification): log Apprise response body on notification request failures by @​kimdre in #​1634
• fix(autodiscovery): change default value of delete option to false by @​kimdre in #​1637
• fix(scheduler): support Compose secrets and configs in scheduled jobs by @​kimdre in #​1640
• fix(metrics): include deployment names in repository metrics labels by @​kimdre in #​1643
• fix(docker): detect Swarm rollbacks as deployment failures by @​kimdre in #​1644
• fix(docker): improve registry auth diagnostics by @​kimdre in #​1647
• feat(git): recover gracefuly from missing deployed commits after force push by @​kimdre in #​1650
• refactor(git): replace ZeroSHA with plumbing.ZeroHash in payload handling by @​kimdre in #​1651

🐛 Bug Fixes

• fix(log): decode localized server error messages by @​kimdre in #​1632

📦 Dependencies

• chore(deps): update docker/github-builder digest to a492c6d by @​renovate[bot] in #​1630
• chore(deps): update golang:1.26.5 docker digest to 2005724 by @​renovate[bot] in #​1631
• fix(deps): update module github.com/google/go-containerregistry to v0.21.9 by @​renovate[bot] in #​1642
• fix(deps): update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​1641
• fix(deps): update module github.com/compose-spec/compose-go/v2 to v2.14.0 by @​renovate[bot] in #​1646
• fix(deps): update module github.com/sigstore/cosign/v3 to v3.1.3 by @​renovate[bot] in #​1645

📚 Miscellaneous

• fix: do not require a C compiler for the test-nobitwarden target by @​nosovk in #​1627
• docs: document the Docker API permissions required for each feature by @​nosovk in #​1626
• fix(swarm): stop recreating all tasks of a stack on every deployment by @​nosovk in #​1629
• test(swarm): update container name retrieval to use stack name prefix by @​kimdre in #​1648
• test(docker): improve log retrieval timing in Compose signal tests by @​kimdre in #​1649

New Contributors

• @​nosovk made their first contribution in #​1627

Full Changelog: kimdre/doco-cd@v0.106.0...v0.107.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anitrend]

OpenCode Dependabot Risk Review

Schema: local-stack.dependabot-risk.v1

Decision: CHANGES_REQUESTED
Risk: HIGH
Automerge allowed: false
Update type: semver-minor
Ecosystem: docker

Summary

Renovate bot proposes a minor update of the Doco-CD deployment controller from 0.106.0 to 0.108.0, touching only doco-cd/docker-compose.yml. The v0.107.0 release notes document a known breaking runtime migration: the first deployment after upgrade recreates all tasks/containers in every managed stack to set new metadata, the auto_discovery.delete default changed to false (relevant because .doco-cd.yml sets remove_orphans: true), and the REST API response shape for Stack endpoints changed. Because Doco-CD is the deployment orchestrator for the whole environment, this update carries high operational risk and requires explicit verification before merge.

Changed runtime artifacts

Image / dependency	From	To	Risk note
ghcr.io/kimdre/doco-cd	0.106.0	0.108.0	Deployment controller update with a known breaking runtime migration: first deployment after upgrade recreates all tasks/containers in every stack; auto_discovery.delete default flipped to false (repo relies on remove_orphans: true in .doco-cd.yml); REST API Stack endpoint response shape changed

Runtime impact

Not a routine rolling update: the first deployment after this upgrade will recreate all tasks/containers in every managed stack, and orphan/auto-discovery cleanup behavior may change given the auto_discovery.delete default flip and the repo's remove_orphans: true setting.

Breaking change assessment

Breaking changes found in release notes: (1) first deployment after upgrade triggers recreation of all tasks/containers across all stacks; (2) auto_discovery.delete default changed to false, requiring explicit opt-in for auto-removal of obsolete projects/stacks; (3) REST API response shape for Stack endpoints changed; (4) fix for per-deployment task recreation requires user action.

Required checks

• ./stackctl.sh sync
• ./stackctl.sh up --dry-run --no-logs

Manual follow-up

• Confirm auto_discovery.delete / remove_orphans behavior against the new default (false) and set it explicitly if auto-removal of obsolete stacks is still desired
• Plan and schedule the first post-upgrade deployment, which recreates all tasks/containers in every stack to set doco-cd metadata
• Verify any consumers of the Doco-CD REST API Stack endpoints against the changed response shape
• Validate the doco-cd bootstrap stack deploys cleanly (docker stack deploy -c doco-cd/docker-compose.yml doco-cd) before relying on automated deploys

Sources checked

• Renovate PR metadata and release notes
• PR diff (doco-cd/docker-compose.yml)
• doco-cd/.env.example, doco-cd/swarm.fragment.yml, doco-cd/README.md
• .doco-cd.yml deployment config

[anitrend]

OpenCode risk gate: neutral. Manual review required. Risk: medium. Reason: Renovate PR updates ghcr.io/kimdre/doco-cd from 0.106.0 to 0.108.0 (two minor bumps). The changed file is limited to doco-cd/docker-compose.yml. Release notes for v0.107.0 include breaking changes: auto_discovery.delete default changed to false, first deployment after upgrade recreates all stack tasks, and REST API response shape changed. v0.108.0 adds remote Git/OCI include support. Because doco-cd is the deployment/CD orchestrator for this infrastructure and the release notes document breaking runtime migration concerns, the update carries medium risk and should not be auto-merged.

[anitrend]

OpenCode risk gate: changes requested. Risk: medium. Reason: Renovate PR bumps doco-cd from 0.106.0 to 0.108.0 (two minor releases). The v0.107.0 release includes several breaking changes: the auto_discovery.delete default changed from true to false (requires explicit config to auto-remove obsolete stacks), the first deployment after upgrade recreates all tasks/containers to set correct metadata, and the REST API response shape for Stack endpoints changed. The v0.108.0 release adds support for remote Git and OCI artifact includes in Compose files. Because doco-cd is the deployment/CD tool that manages all stacks, these runtime-breaking changes require manual review and config validation before merging.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[anitrend]

OpenCode risk gate: changes requested. Risk: medium. Reason: Renovate bumps ghcr.io/kimdre/doco-cd from 0.106.0 to 0.108.0 (minor) in doco-cd/docker-compose.yml. Doco-CD is the deployment controller for the entire environment (it polls the dev branch and deploys all stacks), so this is a runtime-sensitive component. The v0.107.0 release notes explicitly state the fix for per-deployment task recreation 'requires users to take action': the auto_discovery.delete default changed to false (obsolete stacks are no longer auto-removed unless explicitly enabled), the first deployment after upgrade will recreate all tasks/containers in every stack to set new doco-cd metadata, and the Stack REST API response shape changed. The repo's .doco-cd.yml does not set auto_discovery.delete, so cleanup behavior may silently change. The PR itself only touches the expected image pin and no workflow, secret, stack-rendering, or deployment-script files, but the documented breaking runtime behavior of the deployment engine warrants manual review before merge.

[anitrend]

OpenCode risk gate: changes requested. Risk: high. Reason: Renovate bot proposes a minor update of the Doco-CD deployment controller from 0.106.0 to 0.108.0, touching only doco-cd/docker-compose.yml. The v0.107.0 release notes document a known breaking runtime migration: the first deployment after upgrade recreates all tasks/containers in every managed stack to set new metadata, the auto_discovery.delete default changed to false (relevant because .doco-cd.yml sets remove_orphans: true), and the REST API response shape for Stack endpoints changed. Because Doco-CD is the deployment orchestrator for the whole environment, this update carries high operational risk and requires explicit verification before merge.

Owner-authorized manual promotion after reviewing the current head, deployment-controller upgrade risks, and passing required checks.

[wax911]

Reviewed the current Renovate head, Doco-CD deployment-controller migration risks, configuration impact, and passing required CI checks. Owner-authorized manual promotion.