konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests Packages Projects Releases 1 Wiki Activity

chore(deps): pin dependencies #1343

Merged
k.renner merged 1 commits from renovate/pin-image-digests into master 2026-10-19 05:19:20 +00:00
Conversation 1 Commits 1 Files Changed 3
+3 -3
renovate-bot commented 2026-10-19 02:01:51 +00:00
Member
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
docker.gitea.com/gitea-mcp-server pinDigest → 20701c3
docker.gitea.com/gitea-mcp-server pinDigest → 20701c3
docker.io/nicolaka/netshoot pinDigest → a20c253

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | docker.gitea.com/gitea-mcp-server | pinDigest | → `20701c3` | | [docker.gitea.com/gitea-mcp-server](https://gitea.com/gitea/gitea-mcp) | pinDigest | → `20701c3` | | docker.io/nicolaka/netshoot | pinDigest | → `a20c253` | --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - Between 12:00 AM and 08:59 AM, only on Monday (`* 0-8 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
renovate-bot added 1 commit 2026-10-19 02:01:52 +00:00
chore(deps): pin dependencies
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
review-bot reviewed: request changes
Details
d7d99365e8
renovate-bot force-pushed renovate/pin-image-digests from 2ac2344383 to d7d99365e8 2026-10-19 02:01:52 +00:00 Compare
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model claude-haiku-5-5, commit d7d99365e862fac09aa8188e3a11e7c6325da3c9.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

This Renovate PR pins three images by digest: the gitea-mcp Deployment and its Flux ImageRepository, and the netshoot egress-check pod. The base is still master at 5ebf7a04, the PR is mergeable, and it links no issues. The pin scheme fits the repo's Renovate policy, but the netshoot line conflicts with open PR #1344, and the digest on the Flux-marked gitea-mcp line may not survive image automation.

🔴 Blocking

  • kubernetes/restore-test/egress-check.yaml:14: this PR sets the netshoot image to v0.13@sha256:a20c2531…. Open PR #1344 ("update all non-major dependencies") changes the same line to v0.16@sha256:b09d9b21…. Master is unaffected today, but whichever of the two merges second will conflict. Once #1344 lands, this PR's v0.13 digest is a stale pin on the wrong tag. Merge #1344 first and let Renovate rebase this PR, or drop this hunk.

⚪ Unverified

  • Digest survival under Flux. kubernetes/apps/gitea-mcp/deployment.yaml:26 carries the $imagepolicy marker. infrastructure/image-automation/update-automation.yaml:38-39 runs the Setters strategy on ./kubernetes, and the ImagePolicy in gitea-mcp.yaml:10-20 has no digestReflectionPolicy. In the pinned Flux v2.9.5 (clusters/homelab/flux-system/gotk-components.yaml), that field defaults to Never. I could not read the image-automation-controller source, so I cannot tell whether the setter rewrites the marked value to name:tag on every run, which would drop @sha256:… in a bot commit to master. After merge, check the next ImageUpdateAutomation commits. If the digest is wanted, the supported mechanism is digestReflectionPolicy: Always on the ImagePolicy.
  • Digest-qualified spec.image. I could not verify how image-reflector handles docker.gitea.com/gitea-mcp-server@sha256:… at gitea-mcp.yaml:7. The CRD in gotk-components types it as a plain string.
  • Digest values. I did not check sha256:20701c3… or sha256:a20c2531… against the registry; I have no registry access here. The gitea-mcp digest matches in both files. Before merge, confirm both with crane digest or docker buildx imagetools inspect.

🟡 Suggestions

  • kubernetes/infrastructure/image-automation/gitea-mcp.yaml:7: revert the ImageRepository hunk. infrastructure/image-automation/README.md:21 says the ImageRepository takes "the upstream URL", and a digest does not change which tags are listed. The change looks like a side effect of Renovate matching the image: key, not a deliberate pin. Keep the digest on the Deployment only.
  • renovate.json, the Flux-managed packageRules entry: the disable list does not include docker.gitea.com/gitea-mcp-server, although gitea-mcp.yaml is an ImageRepository. Commit 7be8ebab states that this list must match the ImageRepository set. Renovate can therefore open its own version bump for the same Deployment line. This predates the PR; add the image to the list here or in a follow-up.

Tests

  • The only gate for these manifests is .woodpecker/ci-manifests-test.yml (kustomize-build, woodpecker-lint, shellcheck, promtool, yaml-citations). It has not passed on this head: ci/woodpecker/pr/ci-manifests-test is failure ("Pipeline was canceled", pipeline 14350), so kustomize-build has not validated these files. Re-run it. ci-scripts-test passed.
  • The no-digest-pins step covers only openbao/rotation/ and only registry-local images. These are upstream images, so the digest pins match the repo convention.

Recommendation

Request changes — 1 blocking issue(s)

🤖 **Automated review** — model `claude-haiku-5-5`, commit `d7d99365e862fac09aa8188e3a11e7c6325da3c9`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary This Renovate PR pins three images by digest: the gitea-mcp Deployment and its Flux ImageRepository, and the netshoot egress-check pod. The base is still master at 5ebf7a04, the PR is mergeable, and it links no issues. The pin scheme fits the repo's Renovate policy, but the netshoot line conflicts with open PR #1344, and the digest on the Flux-marked gitea-mcp line may not survive image automation. ## 🔴 Blocking - `kubernetes/restore-test/egress-check.yaml:14`: this PR sets the netshoot image to `v0.13@sha256:a20c2531…`. Open PR #1344 ("update all non-major dependencies") changes the same line to `v0.16@sha256:b09d9b21…`. Master is unaffected today, but whichever of the two merges second will conflict. Once #1344 lands, this PR's v0.13 digest is a stale pin on the wrong tag. Merge #1344 first and let Renovate rebase this PR, or drop this hunk. ## ⚪ Unverified - **Digest survival under Flux.** `kubernetes/apps/gitea-mcp/deployment.yaml:26` carries the `$imagepolicy` marker. `infrastructure/image-automation/update-automation.yaml:38-39` runs the Setters strategy on `./kubernetes`, and the ImagePolicy in `gitea-mcp.yaml:10-20` has no `digestReflectionPolicy`. In the pinned Flux v2.9.5 (`clusters/homelab/flux-system/gotk-components.yaml`), that field defaults to `Never`. I could not read the image-automation-controller source, so I cannot tell whether the setter rewrites the marked value to `name:tag` on every run, which would drop `@sha256:…` in a bot commit to master. After merge, check the next ImageUpdateAutomation commits. If the digest is wanted, the supported mechanism is `digestReflectionPolicy: Always` on the ImagePolicy. - **Digest-qualified `spec.image`.** I could not verify how image-reflector handles `docker.gitea.com/gitea-mcp-server@sha256:…` at `gitea-mcp.yaml:7`. The CRD in gotk-components types it as a plain string. - **Digest values.** I did not check `sha256:20701c3…` or `sha256:a20c2531…` against the registry; I have no registry access here. The gitea-mcp digest matches in both files. Before merge, confirm both with `crane digest` or `docker buildx imagetools inspect`. ## 🟡 Suggestions - `kubernetes/infrastructure/image-automation/gitea-mcp.yaml:7`: revert the ImageRepository hunk. `infrastructure/image-automation/README.md:21` says the ImageRepository takes "the upstream URL", and a digest does not change which tags are listed. The change looks like a side effect of Renovate matching the `image:` key, not a deliberate pin. Keep the digest on the Deployment only. - `renovate.json`, the Flux-managed `packageRules` entry: the disable list does not include `docker.gitea.com/gitea-mcp-server`, although `gitea-mcp.yaml` is an ImageRepository. Commit 7be8ebab states that this list must match the ImageRepository set. Renovate can therefore open its own version bump for the same Deployment line. This predates the PR; add the image to the list here or in a follow-up. ## Tests - The only gate for these manifests is `.woodpecker/ci-manifests-test.yml` (kustomize-build, woodpecker-lint, shellcheck, promtool, yaml-citations). It has not passed on this head: `ci/woodpecker/pr/ci-manifests-test` is `failure` ("Pipeline was canceled", pipeline 14350), so kustomize-build has not validated these files. Re-run it. `ci-scripts-test` passed. - The `no-digest-pins` step covers only `openbao/rotation/` and only registry-local images. These are upstream images, so the digest pins match the repo convention. ## Recommendation Request changes — 1 blocking issue(s) <!-- pr-review:sha=d7d99365e862fac09aa8188e3a11e7c6325da3c9 -->
k.renner merged commit c8d2d073a5 into master 2026-10-19 05:19:20 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1343