diff --git a/Renovate.md b/Renovate.md index 4889b5f..638d4a1 100644 --- a/Renovate.md +++ b/Renovate.md @@ -43,6 +43,8 @@ Charts whose tags carry a flavour or date suffix override `versioning` in their **Floating tags belong outside the pattern.** `ytdlp-web-player` anchors its regex on the `v` prefix precisely so `latest` and `stable` — both of which move — can never be selected. +**And a registry that publishes a tag per commit needs a version *constraint*, not only an anchor.** `garage` is the sharp case, measured on 2026-10-03: of the 340 tags on `docker.io/dxflrs/garage` the **newest 22 are 40-character commit SHAs**, pushed almost daily, while the current release `v2.4.1` dates from 2026-09-08. A block without a constraint therefore offers a hex string as the next "update", and an `appVersion` of 40 hex characters pins a commit nobody chose — and republishes the chart for it. The same block also has to keep out `v2.0.0-rc1`, `v2.0.0-beta1` and four `v1.99.x-internal` builds, and note that **ordering does not help there**: `v1.99.3-internal` sorts above the whole `v1.3.x` line. The shape that does all of it at once is a regex versioning anchored to `^v..$` — a candidate that does not match is not a version at all, so SHA tags (no `v`, no dots) and every suffixed tag (the terminating anchor) are skipped in one rule. `stalwart` uses the identical shape against its three moving names and its `-alpine` twins. + ## The one digest pin `freesailarr`'s `mediathekarr` image is the only one pinned by digest, because its tags carry no version at all: `latest` is a 2024 build and the upstream README points at the moving `beta`. The built-in `helm-values` manager reads `repository`/`tag` and skips it (`skipReason: invalid-value`), so the two managers cannot produce competing PRs.