From c0089d69f1ea02127c948812b18a051a6ae6e243 Mon Sep 17 00:00:00 2001
From: ssegato81 <43784477+ssegato81@users.noreply.github.com>
Date: Wed, 22 May 2024 13:15:17 -0300
Subject: [PATCH] fix: Correct digest resolution when the replacementName and
 replacementVersion options are defined (#29164)

Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---
 .../repository/process/lookup/index.spec.ts   | 89 +++++++++++++++++++
 .../repository/process/lookup/index.ts        | 15 ++++
 2 files changed, 104 insertions(+)

diff --git a/lib/workers/repository/process/lookup/index.spec.ts b/lib/workers/repository/process/lookup/index.spec.ts
index 88636faa6c2e05..9886a0eb0d7619 100644
--- a/lib/workers/repository/process/lookup/index.spec.ts
+++ b/lib/workers/repository/process/lookup/index.spec.ts
@@ -4253,6 +4253,95 @@ describe('workers/repository/process/lookup/index', () => {
       ]);
     });
 
+    it('handles replacements - Digest configured and validating getDigest funtion call', async () => {
+      config.packageName = 'openjdk';
+      config.currentDigest = 'sha256:fedcba0987654321';
+      config.currentValue = '17.0.0';
+      //config.pinDigests = true;
+      config.datasource = DockerDatasource.id;
+      config.versioning = dockerVersioningId;
+      // This config is normally set when packageRules are applied
+      config.replacementName = 'eclipse-temurin';
+      config.replacementVersion = '19.0.0';
+      getDockerReleases.mockResolvedValueOnce({
+        releases: [
+          {
+            version: '17.0.0',
+          },
+          {
+            version: '17.0.1',
+          },
+        ],
+        lookupName: 'openjdk',
+      });
+      getDockerDigest.mockResolvedValueOnce('sha256:abcdef1234567890');
+      getDockerDigest.mockResolvedValueOnce('sha256:fedcba0987654321');
+      getDockerDigest.mockResolvedValueOnce('sha256:pin0987654321');
+
+      const { updates } = await Result.wrap(
+        lookup.lookupUpdates(config),
+      ).unwrapOrThrow();
+
+      expect(updates).toEqual([
+        {
+          bucket: 'non-major',
+          newDigest: 'sha256:abcdef1234567890',
+          newMajor: 17,
+          newMinor: 0,
+          newValue: '17.0.1',
+          newVersion: '17.0.1',
+          updateType: 'patch',
+        },
+        {
+          newDigest: 'sha256:fedcba0987654321',
+          newName: 'eclipse-temurin',
+          newValue: '19.0.0',
+          newVersion: undefined,
+          updateType: 'replacement',
+        },
+        {
+          newDigest: 'sha256:pin0987654321',
+          newValue: '17.0.0',
+          newVersion: undefined,
+          updateType: 'digest',
+        },
+      ]);
+
+      expect(getDockerDigest).toHaveBeenNthCalledWith(
+        1,
+        {
+          currentDigest: 'sha256:fedcba0987654321',
+          currentValue: '17.0.0',
+          lookupName: 'openjdk',
+          packageName: 'openjdk',
+          registryUrl: 'https://index.docker.io',
+        },
+        '17.0.1',
+      );
+      expect(getDockerDigest).toHaveBeenNthCalledWith(
+        2,
+        {
+          currentDigest: undefined,
+          currentValue: '17.0.0',
+          lookupName: undefined,
+          packageName: 'eclipse-temurin',
+          registryUrl: 'https://index.docker.io',
+        },
+        '19.0.0',
+      );
+      expect(getDockerDigest).toHaveBeenNthCalledWith(
+        3,
+        {
+          currentDigest: 'sha256:fedcba0987654321',
+          currentValue: '17.0.0',
+          lookupName: 'openjdk',
+          packageName: 'openjdk',
+          registryUrl: 'https://index.docker.io',
+        },
+        '17.0.0',
+      );
+    });
+
     it('handles replacements - skips if package and replacement names match', async () => {
       config.packageName = 'openjdk';
       config.currentValue = undefined;
diff --git a/lib/workers/repository/process/lookup/index.ts b/lib/workers/repository/process/lookup/index.ts
index 15c5835ff6d27b..953e21df73146e 100644
--- a/lib/workers/repository/process/lookup/index.ts
+++ b/lib/workers/repository/process/lookup/index.ts
@@ -539,6 +539,21 @@ export async function lookupUpdates(
             registryUrl: update.registryUrl ?? res.registryUrl,
             lookupName: res.lookupName,
           };
+
+          // #20304 only pass it for replacement updates, otherwise we get wrong or invalid digest
+          if (update.updateType !== 'replacement') {
+            delete getDigestConfig.replacementName;
+          }
+
+          // #20304 don't use lookupName and currentDigest when we replace image name
+          if (
+            update.updateType === 'replacement' &&
+            update.newName !== config.packageName
+          ) {
+            delete getDigestConfig.lookupName;
+            delete getDigestConfig.currentDigest;
+          }
+
           // TODO #22198
           update.newDigest ??=
             dependency?.releases.find((r) => r.version === update.newValue)