Repository navigation
Allow digest pinning for Renovate image #1038
Description
Currently we have renovate-image and renovate-version and they are combined with a : in https://github.com/renovatebot/github-action/blob/main/src/docker.ts
I think this makes it impossible to pin to an image digest.
My end-goal is to have Renovate manage the versioning and use pinDigests to ensure we are running a version of Renovate that:
- Meets
minimumReleaseAge - Is pinned to a digest to remove the risk that a version tag is re-published with a malicious image, after the
minimumReleaseAge
One idea might be to make renovate-image accept a fully specified image+tag. The logic for this might simply look for the presence of a : which would cater for both image:tag and image@SHA256:digest.
Activity
viceice commentedon Jun 13, 2026
can't you use
tag@sha256...as version?viceice commentedon Jun 13, 2026
docker datasource doesn't support minimum release age by default, only docker hub supports it
goosmurf commentedon Jun 13, 2026
I tried using:
But it produces this error:
As you can see, the issue is that the action has appended
:latestto the image+tag.If I try to say:
Then the action will try to run
renovate/renovate:@sha256:..which is also invalid.Thanks, I am aware. I am using Docker Hub
renovate/renovateas my source to work around this issue.viceice commentedon Jun 13, 2026
I mean something like this
goosmurf commentedon Jun 14, 2026
Thank you!
Somehow I missed that option but can confirm it does work :)