From 2d03ba8a7ce68a92a4760b2d32ff7b7f95a6da65 Mon Sep 17 00:00:00 2001 From: jklein Date: Mon, 24 Aug 2026 12:15:01 +0200 Subject: [PATCH] renovate: let the nginx constraint survive a variant tag The anchored form rejected any tag with a suffix. Docker versioning only offers candidates carrying the current tag's suffix, so the day the delegation sidecar moves to a slimmer base image (#84, still open) every candidate would fail the filter and nginx would stop receiving updates - without an error, a warning, or a red dashboard. Verified against currentValue 1.28.0-alpine: anchored form returns "updates": [] and "warnings": [], the suffix-tolerant form proposes 1.30.4-alpine and still refuses the newer 1.31.x mainline. --- README.md | 2 +- renovate.json5 | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 0f1b308..97ce19a 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ What Renovate keeps current: Each chart renders its main image as `:{{ .Chart.AppVersion }}` — repository in the template, version in `Chart.yaml`. Renovate cannot join two files, so the mapping lives in `renovate.json5`, one block per chart. It is deliberately *not* a `# renovate:` comment inside each `Chart.yaml`: that would touch all chart directories and force a version bump plus a publish per chart for a pure comment change. Charts whose tags carry a flavour or date suffix (`apache-tika`, `minecraft-server`, `rss-bridge`, `teamspeak-server`) override `versioning` in their block; the reasoning sits next to each one. -One dependency is constrained beyond its versioning: **nginx** (the Synapse delegation sidecar) is limited to **even minors** via `allowedVersions`. nginx numbers its release branches by minor — even is stable, odd is mainline — and the chart belongs on stable. Patch updates inside the stable branch still flow through normally. +One dependency is constrained beyond its versioning: **nginx** (the Synapse delegation sidecar) is limited to **even minors** via `allowedVersions`. nginx numbers its release branches by minor — even is stable, odd is mainline — and the chart belongs on stable. Patch updates inside the stable branch still flow through normally. The constraint tolerates a variant suffix (`1.30.4-alpine`) on purpose: docker versioning only ever offers candidates carrying the current tag's suffix, so a suffix-blind constraint would silently freeze nginx the day the sidecar moves to a slimmer base image (#84) — no error, no warning. Not managed: `ci/**` (install-test fixtures pin throwaway infrastructure to major lines on purpose) and `template-chart/**` (placeholder image). A consequence worth knowing: `ci/matrix-synapse/fixtures.yaml` pins a Synapse image that Renovate will not follow — bump it by hand when the chart moves a major. diff --git a/renovate.json5 b/renovate.json5 index 5ad07ba..6fa0c53 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -108,8 +108,15 @@ matchDatasources: ["docker"], matchPackageNames: ["nginx", "library/nginx", "docker.io/library/nginx"], // Even minor: any minor whose last digit is even, so 1.30.x passes and - // 1.31.x does not. - allowedVersions: "/^\\d+\\.\\d*[02468]\\.\\d+$/", + // 1.31.x does not. The trailing (-.+)? is load-bearing: #84 proposes + // moving this sidecar to a slimmer base image, and with a variant tag + // like 1.30.4-alpine docker versioning only ever offers candidates + // carrying the same suffix. Without the optional suffix, every one of + // them would fail this filter and nginx would silently stop receiving + // updates - no error, no warning, green dashboard. Verified: with the + // anchored form and currentValue 1.28.0-alpine, the lookup returns + // "updates": [] and "warnings": []. + allowedVersions: "/^\\d+\\.\\d*[02468]\\.\\d+(-.+)?$/", }, ],