Make Renovate update Dockerfile base image digests - #2761
Merged
rajathagasthya merged 1 commit intoAug 21, 2026
Conversation
The custom regex manager for docker/Dockerfile only matched the golang version and resolved it via the golang-version datasource, which has no notion of image digests. Renovate PRs bumped the tag but left the pinned @sha256 digest unchanged (e.g. NVIDIA#2759); since the digest takes precedence over the tag at pull time, builds silently kept using the old image. The other digest-pinned base images (ubi9, debian, distroless/cc) were not managed at all. Replace the golang-specific manager with a generic one that captures the image name, tag, and digest from every pinned FROM line and resolves updates via the docker datasource, so tag and digest are updated together. Images with non-version tags (ubi9:latest, debian:trixie-slim) get digest-only updates. Extend the Go toolchain group rule so golang image bumps still land in the same PR as the versions.mk GOLANG_VERSION bump. Signed-off-by: Rajath Agasthya <ragasthya@nvidia.com>
rajathagasthya
requested review from
cdesiniotis,
karthikvetrivel,
rahulait,
shivamerla and
tariq1890
as code owners
August 19, 2026 21:53
cdesiniotis
reviewed
Aug 19, 2026
cdesiniotis
approved these changes
Aug 20, 2026
tariq1890
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Renovate's custom manager for
docker/Dockerfilematched only the golang version and resolved it via thegolang-versiondatasource, which has no notion of image digests — PRs like #2759 bumped the tag but left the pinned@sha256digest unchanged. Since the digest takes precedence over the tag at pull time, docker pull silently uses the old image. The other digest-pinned base images (ubi9, debian, distroless/cc) were not managed at all.Replace the golang-specific manager with a generic one that captures the image name, tag, and digest from every pinned
FROMline and resolves updates via thedockerdatasource, so tag and digest are updated together. Non-version tags (ubi9:latest,debian:trixie-slim) get digest-only updates. The Go toolchain group rule is extended so golang image bumps still land in the same PR as theversions.mkGOLANG_VERSIONbump.Checklist
make lint)make validate-generated-assets)make validate-modules)Testing
Verified the new
matchStringsregex captures image name, tag, and digest for all five pinnedFROMlines acrossdocker/Dockerfileanddocker/Dockerfile.devel.