digests for oci_pull docker images not being updated

[aschleifer]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

gitlab; latest version of renovate (39.114.0 at the point of writing this)

Please tell us more about your question or problem

When having an oci_pull dependency in a MODULE.bazel for a docker image that has a tag and a digest configured then renovate is not updating this digest even so there is a newer one and it is found according to the logs (see below).

The minimal reproducible case is a repository with two files:

MODULE.bazel:

module(name = "test")

# rules_oci
oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

oci.pull(
    name = "debian",
    tag = "bookworm-slim",
    digest = "sha256:36e591f228bb9b99348f584e83f16e012c33ba5cad44ef5981a1d7c0a93eca22",
    image = "docker.io/library/debian",
    platforms = ["linux/amd64"],
)
use_repo(
    oci,
    "debian",
    "debian_linux_amd64",
)

renovate.json:

{
  "extends": [
    "config:recommended"
  ],
  "pinDigests": true
}

I would expect renovate to update the digest in the MODULE.bazel as it is not the latest version of this debian docker image.

Minimal reproduction repo

https://github.com/ExB-Group/renovate-reproduction-33670

Logs (if relevant)

Logs

DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in config.js
DEBUG: No config file found on disk - skipping
DEBUG: Converting GITHUB_COM_TOKEN into a global host rule
DEBUG: File config
       "config": {}
DEBUG: CLI config
       "config": {"forkProcessing": "enabled", "updateNotScheduled": false}
DEBUG: Env config
       "config": {
         "hostRules": [
           {
             "matchHost": "https://xxxxx.dkr.ecr.eu-central-1.amazonaws.com",
             "hostType": "docker",
             "username": "xxxxx",
             "password": "***********"
           },
           {"hostType": "github", "matchHost": "github.com", "token": "***********"}
         ],
         "configMigration": true,
         "repositoryCache": "enabled",
         "binarySource": "install",
         "baseDir": "/builds/xxx/renovate-bot/renovate",
         "onboarding": false,
         "onboardingConfig": {
           "$schema": "https://docs.renovatebot.com/renovate-schema.json",
           "extends": ["config:recommended"]
         },
         "optimizeForDisabled": true,
         "platform": "gitlab",
         "endpoint": "https://gitlab.com/api/v4",
         "token": "***********"
       }
DEBUG: Combined config
       "config": {
         "hostRules": [
           {
             "matchHost": "https://xxxxx.dkr.ecr.eu-central-1.amazonaws.com",
             "hostType": "docker",
             "username": "xxxxx",
             "password": "***********"
           },
           {"hostType": "github", "matchHost": "github.com", "token": "***********"}
         ],
         "configMigration": true,
         "repositoryCache": "enabled",
         "binarySource": "install",
         "baseDir": "/builds/xxx/renovate-bot/renovate",
         "onboarding": false,
         "onboardingConfig": {
           "$schema": "https://docs.renovatebot.com/renovate-schema.json",
           "extends": ["config:recommended"]
         },
         "optimizeForDisabled": true,
         "platform": "gitlab",
         "endpoint": "https://gitlab.com/api/v4",
         "token": "***********",
         "forkProcessing": "enabled",
         "updateNotScheduled": false
       }
DEBUG: Adding trailing slash to endpoint
DEBUG: Enabling forkProcessing while in non-autodiscover mode
DEBUG: Enabling onboardingNoDeps while in non-autodiscover mode
DEBUG: Found valid git version: 2.48.1
DEBUG: Setting global hostRules
DEBUG: Adding password authentication for https://xxxxx.dkr.ecr.eu-central-1.amazonaws.com (hostType=docker) to hostRules
DEBUG: Adding token authentication for github.com (hostType=github) to hostRules
DEBUG: hostRules: authentication already set for gitlab.com
DEBUG: Using queue: host=gitlab.com, concurrency=16
DEBUG: GitLab version is: 17.9.0-pre
DEBUG: Using platform gitAuthor: renovate_bot <[email protected]>
DEBUG: Adding token authentication for gitlab.com (hostType=gitlab) to hostRules
DEBUG: Using configured baseDir: /builds/xxx/renovate-bot/renovate
DEBUG: Using cacheDir: /builds/xxx/renovate-bot/renovate/cache
DEBUG: Using containerbaseDir: /builds/xxx/renovate-bot/renovate/cache/containerbase
DEBUG: Initializing Renovate internal cache into /builds/xxx/renovate-bot/renovate/cache/renovate/renovate-cache-v1
DEBUG: Commits limit = null
DEBUG: Setting global hostRules
DEBUG: Adding password authentication for https://xxxxx.dkr.ecr.eu-central-1.amazonaws.com (hostType=docker) to hostRules
DEBUG: Adding token authentication for github.com (hostType=github) to hostRules
DEBUG: Adding token authentication for gitlab.com (hostType=gitlab) to hostRules
DEBUG: validatePresets()
DEBUG: Reinitializing hostRules for repo
DEBUG: Clearing hostRules
DEBUG: Adding password authentication for https://xxxxx.dkr.ecr.eu-central-1.amazonaws.com (hostType=docker) to hostRules
DEBUG: Adding token authentication for github.com (hostType=github) to hostRules
DEBUG: Adding token authentication for gitlab.com (hostType=gitlab) to hostRules
 INFO: Repository started (repository=renovate-test-repro)
       "renovateVersion": "39.114.0"
DEBUG: Using localDir: /builds/xxx/renovate-bot/renovate/repos/gitlab/renovate-test-repro (repository=renovate-test-repro)
DEBUG: PackageFiles.clear() - Package files deleted (repository=renovate-test-repro)
DEBUG: hostRules: applying Bearer authentication for gitlab.com (repository=renovate-test-repro)
DEBUG: Using queue: host=gitlab.com, concurrency=16 (repository=renovate-test-repro)
DEBUG: exb/operations/renovate-test-aschleifer-repro default branch = main (repository=renovate-test-repro)
DEBUG: Enabling Git FS (repository=renovate-test-repro)
DEBUG: Using http URL: https://host/renovate-test-repro.git (repository=renovate-test-repro)
DEBUG: Repository cache is restored from revision 13 (repository=renovate-test-repro)
DEBUG: Resetting npmrc (repository=renovate-test-repro)
DEBUG: Resetting npmrc (repository=renovate-test-repro)
DEBUG: checkOnboarding() (repository=renovate-test-repro)
DEBUG: isOnboarded() (repository=renovate-test-repro)
DEBUG: findPr(renovate/configure, Configure Renovate, !open) (repository=renovate-test-repro)
DEBUG: findPr(renovate/configure, chore: Configure Renovate, !open) (repository=renovate-test-repro)
DEBUG: Checking cached config file name (repository=renovate-test-repro)
DEBUG: Existing config file confirmed (repository=renovate-test-repro)
DEBUG: Repository config (repository=renovate-test-repro)
       "fileName": "renovate.json",
       "config": {"extends": ["config:recommended"], "pinDigests": true}
DEBUG: Repo is onboarded (repository=renovate-test-repro)
DEBUG: migrateAndValidate() (repository=renovate-test-repro)
DEBUG: No config migration necessary (repository=renovate-test-repro)
DEBUG: Found repo ignorePaths (repository=renovate-test-repro)
       "ignorePaths": [
         "**/node_modules/**",
         "**/bower_components/**",
         "**/vendor/**",
         "**/examples/**",
         "**/__tests__/**",
         "**/test/**",
         "**/tests/**",
         "**/__fixtures__/**"
       ]
DEBUG: No vulnerability alerts found (repository=renovate-test-repro)
DEBUG: findIssue(Dependency Dashboard) (repository=renovate-test-repro)
DEBUG: No baseBranches (repository=renovate-test-repro)
DEBUG: extract() (repository=renovate-test-repro)
DEBUG: Cached extract for sha=fea1628e7f86fb043aef90414ee874fde02c3886 is valid and can be used (repository=renovate-test-repro)
DEBUG: Deleted cached dep updates (repository=renovate-test-repro)
 INFO: Dependency extraction complete (repository=renovate-test-repro, baseBranch=main)
       "stats": {
         "managers": {"bazel-module": {"fileCount": 1, "depCount": 1}},
         "total": {"fileCount": 1, "depCount": 1}
       }
DEBUG: Dependency docker.io/library/debian has unsupported/unversioned value bookworm-slim (versioning=docker) (repository=renovate-test-repro)
DEBUG: getDigest(https://index.docker.io, library/debian, bookworm-slim) (repository=renovate-test-repro)
DEBUG: getManifestResponse(https://index.docker.io, library/debian, sha256:36e591f228bb9b99348f584e83f16e012c33ba5cad44ef5981a1d7c0a93eca22, head) (repository=renovate-test-repro)
DEBUG: Using queue: host=index.docker.io, concurrency=16 (repository=renovate-test-repro)
DEBUG: Using queue: host=auth.docker.io, concurrency=16 (repository=renovate-test-repro)
DEBUG: getManifestResponse(https://index.docker.io, library/debian, bookworm-slim, head) (repository=renovate-test-repro)
DEBUG: Got docker digest sha256:f70dc8d6a8b6a06824c92471a1a258030836b26b043881358b967bf73de7c5ab (repository=renovate-test-repro)
DEBUG: PackageFiles.add() - Package file saved for base branch (repository=renovate-test-repro, baseBranch=main)
DEBUG: Package releases lookups complete (repository=renovate-test-repro, baseBranch=main)
DEBUG: No releaseTimestamp for debian update to undefined (repository=renovate-test-repro)
DEBUG: Repository libYears (repository=renovate-test-repro)
       "managerLibYears": {"bazel-module": 0},
       "totalLibYears": 0
DEBUG: branchifyUpgrades (repository=renovate-test-repro)
DEBUG: detectSemanticCommits() (repository=renovate-test-repro)
DEBUG: semanticCommits: returning "enabled" from cache (repository=renovate-test-repro)
DEBUG: 1 flattened updates found: debian (repository=renovate-test-repro)
DEBUG: Returning 1 branch(es) (repository=renovate-test-repro)
DEBUG: config.repoIsOnboarded=true (repository=renovate-test-repro)
DEBUG: packageFiles with updates (repository=renovate-test-repro, baseBranch=main)
       "config": {
         "bazel-module": [
           {
             "deps": [
               {
                 "currentDigest": "sha256:36e591f228bb9b99348f584e83f16e012c33ba5cad44ef5981a1d7c0a93eca22",
                 "currentValue": "bookworm-slim",
                 "datasource": "docker",
                 "depName": "debian",
                 "depType": "oci_pull",
                 "packageName": "docker.io/library/debian",
                 "versioning": "docker",
                 "warnings": [],
                 "updates": [
                   {
                     "updateType": "digest",
                     "newValue": "bookworm-slim",
                     "newDigest": "sha256:f70dc8d6a8b6a06824c92471a1a258030836b26b043881358b967bf73de7c5ab",
                     "branchName": "renovate/debian-bookworm-slim"
                   }
                 ]
               }
             ],
             "packageFile": "MODULE.bazel"
           }
         ]
       }
DEBUG: detectSemanticCommits() (repository=renovate-test-repro)
DEBUG: semanticCommits: returning "enabled" from cache (repository=renovate-test-repro)
DEBUG: processRepo() (repository=renovate-test-repro)
DEBUG: Processing 1 branch: renovate/debian-bookworm-slim (repository=renovate-test-repro)
DEBUG: Calculating hourly PRs remaining (repository=renovate-test-repro)
DEBUG: currentHourStart=2025-01-17T12:00:00.000+00:00 (repository=renovate-test-repro)
DEBUG: PR hourly limit remaining: 2 (repository=renovate-test-repro)
DEBUG: Calculating prConcurrentLimit (10) (repository=renovate-test-repro)
DEBUG: getBranchPr(renovate/debian-bookworm-slim) (repository=renovate-test-repro)
DEBUG: findPr(renovate/debian-bookworm-slim, undefined, open) (repository=renovate-test-repro)
DEBUG: 0 PRs are currently open (repository=renovate-test-repro)
DEBUG: PR concurrent limit remaining: 10 (repository=renovate-test-repro)
DEBUG: Calculated maximum PRs remaining this run: 2 (repository=renovate-test-repro)
DEBUG: PullRequests limit = 2 (repository=renovate-test-repro)
DEBUG: Calculating hourly PRs remaining (repository=renovate-test-repro)
DEBUG: currentHourStart=2025-01-17T12:00:00.000+00:00 (repository=renovate-test-repro)
DEBUG: PR hourly limit remaining: 2 (repository=renovate-test-repro)
DEBUG: Calculating branchConcurrentLimit (10) (repository=renovate-test-repro)
DEBUG: 0 already existing branches found:  (repository=renovate-test-repro)
DEBUG: Branch concurrent limit remaining: 10 (repository=renovate-test-repro)
DEBUG: Calculated maximum branches remaining this run: 2 (repository=renovate-test-repro)
DEBUG: Branches limit = 2 (repository=renovate-test-repro)
DEBUG: syncBranchState() (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: getBranchPr(renovate/debian-bookworm-slim) (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: findPr(renovate/debian-bookworm-slim, undefined, open) (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: branchExists=false (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: dependencyDashboardCheck=undefined (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Check for closed PR because recreating closed PRs is disabled. (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: findPr(renovate/debian-bookworm-slim, chore(deps): update debian:bookworm-slim docker digest to f70dc8d, !open) (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: prAlreadyExisted=false (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Checking schedule(schedule=at any time, tz=null, now=2025-01-17T12:24:42.817Z) (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: No schedule defined (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Converting rebaseWhen=auto to rebaseWhen=conflicted because no rule for behind-base-branch applies (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Branch needs creating (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Using reuseExistingBranch: false (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Setting current branch to main (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Initializing git repository into /builds/xxx/renovate-bot/renovate/repos/renovate-test-repro (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Performing blobless clone (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: git clone completed (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
       "durationMs": 1941
DEBUG: latest repository commit (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
       "latestCommit": {
         "hash": "xxx",
         "date": "2025-01-17T13:02:00+01:00",
         "message": "feat(renovate): pin digests",
         "refs": "HEAD -> main, origin/main, origin/HEAD",
         "body": "",
         "author_name": "xxx",
         "author_email": "xxx"
       }
DEBUG: latest commit (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
       "branchName": "main",
       "latestCommitDate": "2025-01-17T13:02:00+01:00"
DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Starting search at index 139 (repository=renovate-test-repro, packageFile=MODULE.bazel, branch=renovate/debian-bookworm-slim)
       "depName": "debian"
DEBUG: Found match at index 139 (repository=renovate-test-repro, packageFile=MODULE.bazel, branch=renovate/debian-bookworm-slim)
       "depName": "debian"
DEBUG: Digest is not updated (repository=renovate-test-repro, packageFile=MODULE.bazel, branch=renovate/debian-bookworm-slim)
       "depName": "debian",
       "manager": "bazel-module",
       "expectedValue": "sha256:f70dc8d6a8b6a06824c92471a1a258030836b26b043881358b967bf73de7c5ab",
       "foundValue": "sha256:36e591f228bb9b99348f584e83f16e012c33ba5cad44ef5981a1d7c0a93eca22"
 WARN: Error updating branch: update failure (repository=renovate-test-repro, branch=renovate/debian-bookworm-slim)
DEBUG: Config does not need migration (repository=renovate-test-repro)
DEBUG: ensureDependencyDashboard() (repository=renovate-test-repro)
DEBUG: Ensuring Dependency Dashboard (repository=renovate-test-repro)
DEBUG: Checking packageFiles for deprecated packages (repository=renovate-test-repro)
DEBUG: ensureIssue() (repository=renovate-test-repro)
DEBUG: Updating issue (repository=renovate-test-repro)
DEBUG: checkReconfigureBranch() (repository=renovate-test-repro)
DEBUG: No reconfigure branch found (repository=renovate-test-repro)
DEBUG: Removing any stale branches (repository=renovate-test-repro)
DEBUG: config.repoIsOnboarded=true (repository=renovate-test-repro)
DEBUG: No renovate branches found (repository=renovate-test-repro)
DEBUG: ensureIssueClosing() (repository=renovate-test-repro)
DEBUG: ensureIssueClosing() (repository=renovate-test-repro)
DEBUG: PackageFiles.clear() - Package files deleted (repository=renovate-test-repro)
DEBUG: Branch summary (repository=renovate-test-repro)
       "cacheModified": true,
       "baseBranches": [{"branchName": "main", "sha": "fea1628e7f86fb043aef90414ee874fde02c3886"}],
       "branches": [],
       "defaultBranch": "main",
       "inactiveBranches": ["renovate/debian-bookworm-slim"]
DEBUG: branches info extended (repository=renovate-test-repro)
       "branchesInformation": [
         {
           "branchName": "renovate/debian-bookworm-slim",
           "prNo": null,
           "prTitle": "chore(deps): update debian:bookworm-slim docker digest to f70dc8d",
           "result": "error",
           "upgrades": [
             {
               "datasource": "docker",
               "depName": "debian",
               "displayPending": "",
               "currentValue": "bookworm-slim",
               "currentDigest": "sha256:36e591f228bb9b99348f584e83f16e012c33ba5cad44ef5981a1d7c0a93eca22",
               "newValue": "bookworm-slim",
               "newDigest": "sha256:f70dc8d6a8b6a06824c92471a1a258030836b26b043881358b967bf73de7c5ab",
               "packageFile": "MODULE.bazel",
               "updateType": "digest",
               "packageName": "docker.io/library/debian"
             }
           ]
         }
       ]
DEBUG: Renovate repository PR statistics (repository=renovate-test-repro)
       "stats": {"total": 1, "open": 0, "closed": 1, "merged": 0}
DEBUG: Repository result: done, status: onboarded, enabled: true, onboarded: true (repository=renovate-test-repro)
DEBUG: repository problems (repository=renovate-test-repro)
       "repoProblems": ["WARN: Error updating branch: update failure"]
DEBUG: Repository timing splits (milliseconds) (repository=renovate-test-repro)
       "splits": {"init": 2473, "extract": 784, "lookup": 929, "onboarding": 1, "update": 2003},
       "total": 6995
DEBUG: Package cache statistics (repository=renovate-test-repro)
       "get": {"count": 2, "avgMs": 1, "medianMs": 1, "maxMs": 1, "totalMs": 1},
       "set": {"count": 2, "avgMs": 4, "medianMs": 6, "maxMs": 6, "totalMs": 8}
DEBUG: HTTP statistics (repository=renovate-test-repro)
       "hosts": {
         "auth.docker.io": {
           "count": 1,
           "reqAvgMs": 292,
           "reqMedianMs": 292,
           "reqMaxMs": 292,
           "queueAvgMs": 1,
           "queueMedianMs": 1,
           "queueMaxMs": 1
         },
         "gitlab.com": {
           "count": 7,
           "reqAvgMs": 360,
           "reqMedianMs": 370,
           "reqMaxMs": 407,
           "queueAvgMs": 0,
           "queueMedianMs": 0,
           "queueMaxMs": 0
         },
         "index.docker.io": {
           "count": 3,
           "reqAvgMs": 189,
           "reqMedianMs": 142,
           "reqMaxMs": 293,
           "queueAvgMs": 0,
           "queueMedianMs": 0,
           "queueMaxMs": 1
         }
       },
       "requests": 11
DEBUG: HTTP cache statistics (repository=renovate-test-repro)
DEBUG: Lookup statistics (repository=renovate-test-repro)
       "docker": {"count": 1, "avgMs": 884, "medianMs": 884, "maxMs": 884, "totalMs": 884}
 INFO: Repository finished (repository=renovate-test-repro)
       "cloned": true,
       "durationMs": 6995
DEBUG: Checking file package cache for expired items
DEBUG: Deleted 0 of 2 file cached entries in 9ms

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team