From 68545305f77c709f514a529f705042d54188685a Mon Sep 17 00:00:00 2001 From: Rajath Agasthya Date: Wed, 19 Aug 2026 16:52:08 -0500 Subject: [PATCH] Make Renovate update Dockerfile base image digests The custom regex manager for docker/Dockerfile only matched the golang version and resolved it via the golang-version datasource, which has no notion of image digests. Renovate PRs bumped the tag but left the pinned @sha256 digest unchanged (e.g. #2759); since the digest takes precedence over the tag at pull time, builds silently kept using the old image. The other digest-pinned base images (ubi9, debian, distroless/cc) were not managed at all. Replace the golang-specific manager with a generic one that captures the image name, tag, and digest from every pinned FROM line and resolves updates via the docker datasource, so tag and digest are updated together. Images with non-version tags (ubi9:latest, debian:trixie-slim) get digest-only updates. Extend the Go toolchain group rule so golang image bumps still land in the same PR as the versions.mk GOLANG_VERSION bump. Signed-off-by: Rajath Agasthya --- .github/renovate.json | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/renovate.json b/.github/renovate.json index 1f12c11c5..70362e54a 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -72,11 +72,9 @@ "docker/Dockerfile.devel" ], "matchStrings": [ - "FROM golang:(?\\d+\\.\\d+\\.\\d+)" + "FROM (?\\S+):(?[^\\s@]+)@(?sha256:[a-f0-9]{64})" ], - "depNameTemplate": "go", - "datasourceTemplate": "golang-version", - "versioningTemplate": "semver" + "datasourceTemplate": "docker" } ], "labels": [ @@ -170,8 +168,8 @@ { "description": "Group all Go toolchain version bumps", "matchManagers": ["custom.regex"], - "matchPackageNames": ["go"], - "matchDatasources": ["golang-version"], + "matchPackageNames": ["go", "golang"], + "matchDatasources": ["golang-version", "docker"], "groupName": "Go toolchain", "groupSlug": "go-toolchain", "separateMajorMinor": false,