renovate is unable to determine new hash

[zeitlinger]

See grafana/docker-otel-lgtm#644

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package grafana/shared-workflows).
Files affected: .github/workflows/release.yml, .github/workflows/renovate.yml

https://github.com/grafana/docker-otel-lgtm/blob/3b5a038c562786637d8b25be9bd2198acf223803/.github/workflows/renovate.yml#L21-L23 and https://github.com/grafana/docker-otel-lgtm/blob/3b5a038c562786637d8b25be9bd2198acf223803/.github/workflows/release.yml#L23-L24

[zeitlinger]

OK we have avoided the error message from renovate with grafana/docker-otel-lgtm#646 - but it's still not considered for updating

DEBUG: Dependency grafana/shared-workflows has unsupported/unversioned value build-push-to-dockerhub-v0.1.1 (versioning=docker) (repository=grafana/docker-otel-lgtm)
DEBUG: Skipping grafana/shared-workflows because no currentDigest or pinDigests (repository=grafana/docker-otel-lgtm)
DEBUG: Dependency grafana/shared-workflows has unsupported/unversioned value get-vault-secrets-v1.0.0 (versioning=docker) (repository=grafana/docker-otel-lgtm)
DEBUG: Skipping grafana/shared-workflows because no currentDigest or pinDigests (repository=grafana/docker-otel-lgtm)

[zeitlinger]

The fix was to add https://github.com/grafana/docker-otel-lgtm/blob/main/.github/renovate.json5#L37-L40 - should this be documented in the readme?

[iainlane]

Apologies, which shared workflow are you using?

[zeitlinger]

Apologies, which shared workflow are you using?

• get-vault-secrets
• build-push-to-dockerhub

(see links in description)

[iainlane]

(see links in description)

I did see the links. I'm finding it a bit hard to understand because the bug report is very short on information.

Having looked at this for a while, I believe your report is:

---

I have included some actions from shared-workflows in my project. They're included like this:

      - name: retrieve secrets
        id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets/v1.0.0

and

      - id: push-to-dockerhub
        uses: grafana/shared-workflows/actions/build-push-to-dockerhub/v0.1.1

I have configured Renovate for the project. Its configuration is:

Renovate config

```json { $schema: "https://docs.renovatebot.com/renovate-schema.json", extends: ["config:recommended", "customManagers:dockerfileVersions", "customManagers:githubActionsVersions"], branchPrefix: "grafanarenovatebot/", platformCommit: "enabled", automerge: true, ignorePaths: [], ignoreUnstable: true, packageRules: [ { matchPackageNames: ["open-telemetry/opentelemetry-collector-releases"], allowedVersions: "!/cmd/", }, { matchPackageNames: ["grafana/loki"], allowedVersions: "!/operator/", }, { matchPackageNames: ["ghcr.io/renovatebot/renovate", "renovatebot/github-action"], groupName: "renovatebot", schedule: ["before 4am on monday"], }, { matchPackageNames: ["jdx/mise"], groupName: "mise", schedule: ["before 4am on monday"], }, { matchDatasources: ["pypi"], matchDepNames: ["opentelemetry-distro"], ignoreUnstable: false, }, { matchPackageNames: ["grafana/grafana", "prometheus/prometheus", "grafana/loki", "grafana/tempo", "open-telemetry/opentelemetry-collector-releases"], labels: ["docker-dependency"], }, ], vulnerabilityAlerts: { enabled: true, labels: ["automerge-security-update"], }, osvVulnerabilityAlerts: true, customManagers: [ { customType: "regex", depNameTemplate: "ghcr.io/renovatebot/renovate", datasourceTemplate: "docker", managerFilePatterns: ["/^\\.github/workflows/renovate.yml$/"], matchStrings: ["renovate-version: (?[^@\\s]+)(?:@(?\\S+))?", "RENOVATE_IMAGE=ghcr.io/renovatebot/renovate:(?[^@\\s]+)(?:@(?\\S+))?"], }, { customType: "regex", description: "Update _version variables in run.sh", managerFilePatterns: ["/run.sh$/"], matchStrings: ["# renovate: datasource=(?[a-z-]+?)(?: depName=(?.+?))?(?: packageName=(?.+?))?(?: versioning=(?[a-z-]+?))?\\s.+?_version=(?.+?)\\s"], }, { customType: "regex", description: "update mise", managerFilePatterns: ["/(^|/)(workflow-templates|\\.(?:github|gitea|forgejo)/(?:workflows|actions))/.+\\.ya?ml$/", "/(^|/)action\\.ya?ml$/"], datasourceTemplate: "github-release-attachments", packageNameTemplate: "jdx/mise", depNameTemplate: "mise", matchStrings: ["jdx/mise-action.*\\n\\s*with:\\s*\\n\\s*version: [\"']?(?v[.\\d]+)[\"']?\\s*\\n\\s*sha256: [\"']?(?\\w+)[\"']?"], }, ], } ```

With this Renovate configuration, on the dependency dashboard I see the message

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package grafana/shared-workflows).

Files affected: .github/workflows/release.yml, .github/workflows/renovate.yml

Can you please help me identify and fix the issue?

---

Would that be fair?

This issue has made me look into how Renovate works with our stuff. We recently set up a new versioning schema with / as a separator, and we primarily tested it with Dependabot, where it works with no additional configuration needed.

We're not so lucky with Renovate. But it's actually not too bad. Because it's so configurable, it's possible to get it to work right with a bit of config.

Can you take a look at #1164 for me? If the suggested config in there works for you we can merge it into the README here and future people will hopefully be able to set things up right from the start.

[zeitlinger]

Yes, that's exactly it - thanks!