Flux: Renovate incorrectly pins OCIRepository

[antonincms]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

v43.59.0

Please tell us more about your question or problem

When best-practices preset is used, Renovate tries to pin docker dependencies, including in FluxCD OCIRepositories resources.

The issue is that it tries to do the following:

apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
  name: my-ocirepository
  namespace: flux-system
spec:
  interval: 5m
  url: oci://my-artifact
  ref:
-    tag: 1.1.0
+    tag: 1.1.0@sha256:aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f
  secretRef:
    name: my-secret

But that is not supported and cause errors in FluxCD:

failed to determine artifact digest: GET https://my-artifact/manifests/1.1.0@sha256:aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f: NAME_INVALID: "1.1.0@sha256:aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f" is not a valid reference

I think it should either don't pin OCIRepositories, or it should do the following:

apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
  name: my-ocirepository
  namespace: flux-system
spec:
  interval: 5m
  url: oci://my-artifact
  ref:
    tag: 1.1.0
+   digest: sha256:aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f
  secretRef:
    name: my-secret

The tag field would be ignored (as digest takes precedence), but it is maybe more readable to do that than putting the version in a comment like it is done for github actions.

Logs (if relevant)

No response

[jamietanna]

If the digest is a field we can specify, we definitely should do that, yes!

[jamietanna]

I've raised #42082 to cover this