feat: recompute Dockerfile sha256 pins in the version-bump commit - #126
Merged
Conversation
Replaces seven manual-sha-bump packageRules with one postUpgradeTasks rule covering twelve deps, so a version bump and its recomputed digest land together and the PR automerges with no human step. The premise those rules were built on was false. Their descriptions said the org runs the hosted Renovate app and therefore has no postUpgradeTasks; this fleet runs the self-hosted CLI, so the hook was available the whole time. Four pins were worse off than manual: cplieger/tool-catalog, stephane/libmodbus, net-snmp/net-snmp and networkupstools/nut had NO rule at all, so a release bumped the version, left the digest stale, and failed the build with no label and no PR note. They are covered now. Three rules survive because a human still does something a script cannot: rsync verifies an upstream gpg signature against a named fingerprint before hashing, fclones pins an arm64 COMMIT alongside its amd64 sha, and rmlint demands a re-audit of its dangerous-flag list. The fclones rule is reduced to just its commit half. Mechanics verified against Renovate's own docs and source rather than assumed: postUpgradeTasks is valid in packageRules while allowedCommands is globalOnly (it lives in the homelab container env, fail-closed at []); executionMode stays the default `update` so depName/newVersion are one dep's values rather than a grouped branch's joined list; fileFilters must be explicit or it defaults to committing everything. A failing command does not abort the branch -- it records an artifactError, forces a PR and skips branch-automerge, and the stale digest still fails the Dockerfile's own sha256sum -c gate, so the worst case is the old behaviour of a red PR waiting for a human.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces seven
manual-sha-bumppackageRules with onepostUpgradeTasksrule covering twelve deps. A version bump and its recomputed digest now land in the same commit, so the PR is born green and automerges.Deps covered:
typescript,ryanoasis/nerd-fonts,cplieger/tool-catalog,emikulic/darkhttpd,stephane/libmodbus,net-snmp/net-snmp,networkupstools/nut,acassen/keepalived,radvd-project/radvd,vdukhovni/postfix,pkolaczk/fclones,krallin/tini.Why this was possible all along
Those rules justified themselves with "the org runs the hosted Renovate app (no
postUpgradeTasks)". That is false — this fleet runs the self-hosted CLI (homelab/apps/renovate). Ten rules were built on the error.Four pins were in worse shape than manual:
cplieger/tool-catalog,stephane/libmodbus,net-snmp/net-snmpandnetworkupstools/nuthad no rule at all, so a release bumped the version, left the digest stale, and failed the build with no label and no PR note. web-terminal-kiro's Dockerfile even claimed Renovate moved the tool-catalog pair; it never did.What stays manual, and why
RsyncProject/rsync— its recompute verifies an upstream gpg signature against a named fingerprint before hashing. A script that only hashes would silently drop real verification. Deliberately excluded from the rule; its marker is in place so re-enabling is a one-line edit oncegpgvmoves into the build.pkolaczk/fclones— rule reduced to its arm64 COMMIT half.sahib/rmlint— unchanged; its bump needs a human re-audit of the dangerous-flag list.Verified against the docs and source, not assumed
postUpgradeTasksis valid inpackageRules;allowedCommandsisglobalOnlyand lives in the container env, fail-closed at[].executionModestays defaultupdate, so{{{depName}}}/{{{newVersion}}}are one dep's values.fileFiltersset explicitly — it defaults to**/*.artifactErrorforces a PR and skips branch-automerge, and the stale digest still failssha256sum -c. Worst case is the old behaviour.renovate-config-validatorpasses, with a negative control (fileFiltersTYPOerrors onpackageRules[13].postUpgradeTasks.fileFilters) proving the check is not vacuous.Blocked features
Inert until
RENOVATE_ALLOWED_COMMANDSlands in homelab (deliberately last) andcplieger/ci's sync distributesscripts/repin-sha.sh(merged, PR #411).