Renovate: a registry with a tag per commit needs a version constraint

The garage block's reason, as the general rule: an anchor keeps floating names
out, but a constraint is what keeps 40-character commit-SHA tags out - and on
dxflrs/garage those are the 22 newest tags in the registry (measured
2026-10-03) while the current release is three weeks old. Prereleases and
internal builds come with it, and ordering does not exclude them:
v1.99.3-internal sorts above the whole v1.3.x line.

Renovate.md

@@ -43,6 +43,8 @@ Charts whose tags carry a flavour or date suffix override `versioning` in their
 
 **Floating tags belong outside the pattern.** `ytdlp-web-player` anchors its regex on the `v` prefix precisely so `latest` and `stable` — both of which move — can never be selected.
 
+**And a registry that publishes a tag per commit needs a version *constraint*, not only an anchor.** `garage` is the sharp case, measured on 2026-10-03: of the 340 tags on `docker.io/dxflrs/garage` the **newest 22 are 40-character commit SHAs**, pushed almost daily, while the current release `v2.4.1` dates from 2026-09-08. A block without a constraint therefore offers a hex string as the next "update", and an `appVersion` of 40 hex characters pins a commit nobody chose — and republishes the chart for it. The same block also has to keep out `v2.0.0-rc1`, `v2.0.0-beta1` and four `v1.99.x-internal` builds, and note that **ordering does not help there**: `v1.99.3-internal` sorts above the whole `v1.3.x` line. The shape that does all of it at once is a regex versioning anchored to `^v<major>.<minor>.<patch>$` — a candidate that does not match is not a version at all, so SHA tags (no `v`, no dots) and every suffixed tag (the terminating anchor) are skipped in one rule. `stalwart` uses the identical shape against its three moving names and its `-alpine` twins.
+
 ## The one digest pin
 
 `freesailarr`'s `mediathekarr` image is the only one pinned by digest, because its tags carry no version at all: `latest` is a 2024 build and the upstream README points at the moving `beta`. The built-in `helm-values` manager reads `repository`/`tag` and skips it (`skipReason: invalid-value`), so the two managers cannot produce competing PRs.