-
Notifications
You must be signed in to change notification settings - Fork 979
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
No pull request is created if a digest SHA is used to identify a docker-image #4419
Comments
I am experiencing the same issue. My code to reproduce the issue can be found here: https://github.com/alexrashed/dependabot-sha-digest-update. My Dockerfile pins an an outdated sha digest of the manifest-list for
At the time of writing the digest is as follows:
My config disables minor and major updates, but it should still update patch versions: DependaBot config
Unfortunately, no PR (to update the sha digest to the newest version while keeping the python version untouched) is created: DependaBot logs
|
Another datapoint is it was working up to at least Sep 30 2021, For example distroless java images have |
Dependabot logs contain
|
I seems that the issue has been resolved now |
How do you come to that conclusion? |
started receiving dependabot updates for a moving tag image. There was tag change (moved to other image), first update to that PR causing dependabot update might have been just luck (being the first dependabot PR for that tag), but then more updates for that tag followed. Maybe it got resolved only for newly added image-tag settings? |
@dmivankov Thanks for the info. I will check on our side as well if it is working (again). :) |
Hi team, Do you have any update about this? |
@ingogriebsch are you still seeing problems here or can this be closed? |
still seeing similar behavior here with a tag which was updated upstream 3 month ago. |
I see same behaviour as well |
I just tried this and it seems to be working as expected. For example, I created a Dockerfile using
And it properly upgraded it to
Maybe I'm misunderstanding the issue reported here? |
Does it work if you don't include the tag at all?
|
No, that hangs actually, so that must be the issue! |
Good to know there's a workaround to include a tag alongside the sha - will have to try that out... |
I saw missing update with |
Just tried that and I got a proper update, maybe it was some transient issue. I'll keep this issue for the sha256 without tag case, but if you can reproduce the other issue reliably, please reach out! |
I still see this issue as well for Current Digest SHA:
|
I tried that and I got an update to Are you using any ignore conditions to not bump the minor and patch versions? If that's the case, you're looking for #6115. |
Yes, I have this ignore rule:
I've tried also with semver ignore rule for major and minor, same result |
Right, I will also verify ignoring specific version ranges too when I wrap up the fix at #6115. |
@deivid-rodriguez , not sure if we are talking about the same issue. The problem here is that if an image with the same tag is republished to the Docker registry, Dependabot should open a PR updating the |
I think my PR should tackle that particular problem, yes. But I will double check when I'm able to get back to it. |
I tried including the tag in my
I'm using variables as they're reused for multiple stages. I suspect that it may be that indirection confusing dependabot but it would be good to have confirmation, and if so, it can perhaps serve as a test case to support for any future fix. |
@deivid-rodriguez ; did the PR resolve this issue please? |
The PR is not yet merged, but it does resolve the issue. There's still some feedback to be addressed in there, and I also found some new spec failures after rebasing it. So it still needs some work. |
Package ecosystem
docker
Package manager version
n/a
Language version
n/a
Manifest location and content prior to update
Dockerfile.txt
dependabot.yml content
dependabot.yml.txt
Updated dependency
Based on the information on hub.docker-com from Nov 16, 2021
What you expected to see, versus what you actually saw
I would expect that a pull request is created which is changing the SHA digest to the version that is available through hub.docker.com.
Native package manager behavior
n/a
Images of the diff or a link to the PR, issue or logs
🕹 Bonus points: Smallest manifest that reproduces the issue
https://github.com/gbtec-ag/dependabot-docker-sha-digest-issue
The text was updated successfully, but these errors were encountered: