chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.108.0

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/kimdre/doco-cd	minor	0.106.0 → 0.108.0

---

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

v0.108.0

Compare Source

What's Changed

This release adds support for including Git repos and OCI artifacts in Docker Compose's include top-level section as described in their documentation:

include allows you to reference Compose files from remote sources, such as OCI artifacts or Git repositories.
Here serviceB is defined in a Compose file stored on Docker Hub.

include:
  - oci://docker.io/username/my-compose-app:latest # use a Compose file stored as an OCI artifact
services:
  serviceA:
    build: .
    depends_on:
      - serviceB 

Use the new OCI_INSECURE_REGISTRIES environment variable to set a comma-seperated allowlist of OCI registries to treat as insecure (HTTP or self-signed certs). Entries are deduplicated and normalized to lowercase. Each entry must be a hostname with optional port (no URL schemes allowed).

Example: registry.example:5000,localhost:5000

To use includes:

1. Add include: section to a Compose file:

   include:
     - path: https://github.com/user/repo.git#main:docker-compose.yml  # use a relative path if the compose file is in a subdirectory: docker/compose.yml
     - path: oci://docker.io/namespace/config:latest

2. If using private Git repos, ensure GIT_ACCESS_TOKEN or domain-scoped credentials are configured (see wiki).
3. If pulling from self-signed OCI registries, set OCI_INSECURE_REGISTRIES.

🌟 Improvements

• fix(compose): support remote git and OCI artifact includes by @​kimdre in #​1655

Full Changelog: kimdre/doco-cd@v0.107.0...v0.108.0

v0.107.0

Compare Source

What's Changed

New configuration options:

• DATA_HOST_PATH: Optional source path of the deployment data mount as seen by the target Docker daemon (See Remote Docker daemons). Automatically detected by default.
• Added configurable retention for rotated Docker Swarm configs and secrets, including an option to disable automatic pruning. See Docker Settings and Deploy Settings in the wiki.

Improvements, fixes and changes

• (Swarm) Rollbacks are detected and reported correctly now.
• (Swarm) Fixed a bug that caused all tasks/services of a stack to be recreated on every deployment. This fix required some bigger changes under the hood, that requires users to take action (see the boxes below).

[!IMPORTANT]
The default value of the auto_discovery.delete option changed to false. Users, that want to auto-remove obsolete projects/stacks, need to explicitly set auto_discovery.delete: true in their deployment config now.

[!NOTE]

• The first deployment after upgrading doco-cd will trigger a recreation of all tasks/containers in the stack to set the correct doco-cd metadata.
• The REST API response shape for the Stack endpoints changed

• Compose secrets and configs and external secrets are now supported in scheduled jobs.
• A message gets send when a deployment starts and APPRISE_NOTIFY_LEVEL is set to info.
• Diagnostics and troubleshooting for registry authentication has been improved. See Private Container Registries in the wiki.
• doco-cd is now able to recover from missing deployed commits (e.g. after a force push)
• Added more granular labeling for Prometheus metrics by allowing deployment metric labels (e.g. errors and durations) to be tracked per repository and deployment.

✨ Features

• feat: support explicit data host path by @​nosovk in #​1639
• feat(swarm): add configuration options for config and secret revisions retention by @​kimdre in #​1652

🌟 Improvements

• feat(notification): notify on started deployment by @​kimdre in #​1633
• fix(notification): log Apprise response body on notification request failures by @​kimdre in #​1634
• fix(autodiscovery): change default value of delete option to false by @​kimdre in #​1637
• fix(scheduler): support Compose secrets and configs in scheduled jobs by @​kimdre in #​1640
• fix(metrics): include deployment names in repository metrics labels by @​kimdre in #​1643
• fix(docker): detect Swarm rollbacks as deployment failures by @​kimdre in #​1644
• fix(docker): improve registry auth diagnostics by @​kimdre in #​1647
• feat(git): recover gracefuly from missing deployed commits after force push by @​kimdre in #​1650
• refactor(git): replace ZeroSHA with plumbing.ZeroHash in payload handling by @​kimdre in #​1651

🐛 Bug Fixes

• fix(log): decode localized server error messages by @​kimdre in #​1632

📦 Dependencies

• chore(deps): update docker/github-builder digest to a492c6d by @​renovate[bot] in #​1630
• chore(deps): update golang:1.26.5 docker digest to 2005724 by @​renovate[bot] in #​1631
• fix(deps): update module github.com/google/go-containerregistry to v0.21.9 by @​renovate[bot] in #​1642
• fix(deps): update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​1641
• fix(deps): update module github.com/compose-spec/compose-go/v2 to v2.14.0 by @​renovate[bot] in #​1646
• fix(deps): update module github.com/sigstore/cosign/v3 to v3.1.3 by @​renovate[bot] in #​1645

📚 Miscellaneous

• fix: do not require a C compiler for the test-nobitwarden target by @​nosovk in #​1627
• docs: document the Docker API permissions required for each feature by @​nosovk in #​1626
• fix(swarm): stop recreating all tasks of a stack on every deployment by @​nosovk in #​1629
• test(swarm): update container name retrieval to use stack name prefix by @​kimdre in #​1648
• test(docker): improve log retrieval timing in Compose signal tests by @​kimdre in #​1649

New Contributors

• @​nosovk made their first contribution in #​1627

Full Changelog: kimdre/doco-cd@v0.106.0...v0.107.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anitrend]

OpenCode Dependabot Risk Review

Schema: local-stack.dependabot-risk.v1

Decision: CHANGES_REQUESTED
Risk: MEDIUM
Automerge allowed: false
Update type: semver-minor
Ecosystem: docker

Summary

Renovate PR bumps doco-cd from 0.106.0 to 0.108.0 (two minor releases). The v0.107.0 release includes several breaking changes: the auto_discovery.delete default changed from true to false (requires explicit config to auto-remove obsolete stacks), the first deployment after upgrade recreates all tasks/containers to set correct metadata, and the REST API response shape for Stack endpoints changed. The v0.108.0 release adds support for remote Git and OCI artifact includes in Compose files. Because doco-cd is the deployment/CD tool that manages all stacks, these runtime-breaking changes require manual review and config validation before merging.

Changed runtime artifacts

Image / dependency	From	To	Risk note
ghcr.io/kimdre/doco-cd	0.106.0	0.108.0	minor update spanning two releases (v0.107.0 and v0.108.0); v0.107.0 contains breaking runtime changes: auto_discovery.delete default flipped to false, first deploy recreates all tasks/containers, and REST API response shape changed for Stack endpoints

Runtime impact

First deployment after upgrade will recreate all tasks/containers across all stacks to set correct doco-cd metadata. The auto_discovery.delete default change may cause stale stacks to persist if not explicitly configured. No stateful service data migration is expected, but the deployment orchestration itself has breaking behavioral changes.

Breaking change assessment

Breaking changes detected in v0.107.0: (1) auto_discovery.delete default changed to false — stacks will no longer be auto-removed unless explicitly configured; (2) first deployment after upgrade recreates all tasks/containers in every stack; (3) REST API Stack endpoint response shape changed. These affect the deployment runtime behavior of the entire infrastructure.

Required checks

• ./stackctl.sh sync
• ./stackctl.sh up --dry-run --no-logs

Manual follow-up

• Verify current auto_discovery.delete setting in deployment config and update if auto-removal of obsolete stacks is desired
• Review doco-cd configuration for any needed adjustments due to the auto_discovery.delete default change
• Check if the REST API Stack endpoint response shape change affects any monitoring or automation that consumes doco-cd's API
• Plan for the first deployment after upgrade to be done during a maintenance window due to full task recreation

Sources checked

• Renovate PR metadata
• PR diff and changed file list
• Release notes for v0.107.0 and v0.108.0 from github.com/kimdre/doco-cd

[anitrend]

OpenCode risk gate: neutral. Manual review required. Risk: medium. Reason: Renovate PR updates ghcr.io/kimdre/doco-cd from 0.106.0 to 0.108.0 (two minor bumps). The changed file is limited to doco-cd/docker-compose.yml. Release notes for v0.107.0 include breaking changes: auto_discovery.delete default changed to false, first deployment after upgrade recreates all stack tasks, and REST API response shape changed. v0.108.0 adds remote Git/OCI include support. Because doco-cd is the deployment/CD orchestrator for this infrastructure and the release notes document breaking runtime migration concerns, the update carries medium risk and should not be auto-merged.

[anitrend]

OpenCode risk gate: changes requested. Risk: medium. Reason: Renovate PR bumps doco-cd from 0.106.0 to 0.108.0 (two minor releases). The v0.107.0 release includes several breaking changes: the auto_discovery.delete default changed from true to false (requires explicit config to auto-remove obsolete stacks), the first deployment after upgrade recreates all tasks/containers to set correct metadata, and the REST API response shape for Stack endpoints changed. The v0.108.0 release adds support for remote Git and OCI artifact includes in Compose files. Because doco-cd is the deployment/CD tool that manages all stacks, these runtime-breaking changes require manual review and config validation before merging.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.