zwave-js / zwave-js-ui / 33847452683

13%

push

github

ci(renovate): give each docker base image its own full-ref ARG (#4817)

## Problem

`docker/Dockerfile` drove two images from two version *fragments*:

```dockerfile
ARG NODE_VERSION=22.20.0
ARG ALPINE_VERSION=3.22

FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS node
FROM alpine:${ALPINE_VERSION} AS base
```

Renovate's dockerfile manager
(`lib/modules/manager/dockerfile/extract.ts`) resolves the
ARGs inside a `FROM`, then in `processDepForAutoReplace` keeps only the
lines that contain
the **resolved value verbatim**. That gives two distinct failures:

- **`node` was never updatable.** The resolved value
`22.20.0-alpine3.22` appears on no
single line, so no line qualifies, `replaceString` is never set, and
Renovate silently
skipped the dep. That is why `NODE_VERSION` has never been bumped or
pinned.
- **`alpine` was updated destructively.** `3.22` does appear on the
`ALPINE_VERSION` line,
so `pinDigests` rewrote it to `3.22@sha256:14358309a3…` —
`alpine:3.22`'s digest, landing
  in an ARG the *node* ref also reads:

  ```
  ERROR: failed to solve:
docker.io/library/node:22.20.0-alpine3.22@sha256:14358309a3…: not found
  ```

That broke the Docker Test build on every platform in #4807 (arm/v7
failed, fail-fast
cancelled amd64 and arm64 — those `CANCELLED` checks are not passes).
#4808 hit the same
thing with `3.24`.

## Fix

Each ARG now holds a complete image ref, so each is an ordinary,
independently pinnable dep:

```dockerfile
ARG NODE_IMAGE=node:22.20.0-alpine3.22
ARG ALPINE_IMAGE=alpine:3.22

FROM ${NODE_IMAGE} AS node
FROM ${ALPINE_IMAGE} AS base
```

Renovate now writes `node:22.23.2-alpine3.22@sha256:<node digest>` and
`alpine:3.24@sha256:<alpine digest>` — each digest on its own image.
Nothing else in the
Dockerfile changes, and neither ARG is passed as a `build-arg` anywhere
(`docker-release.yml` only passes `image=zwavejs2mqtt`).

Verified locally: the current form and the digest-pinned form both build
the `base` target
and produce th... (continued)

537 of 4566 branches covered (11.76%)

Branch coverage included in aggregate %.

991 of 7044 relevant lines covered (14.07%)

2.2 hits per line