chore: enable renovate updates for ORAS

[djsly]

What this PR does / why we need it:

ORAS was pinned behind <DO_NOT_UPDATE>, so Renovate could not track upstream GitHub releases. This PR enables ORAS updates through the existing generic github-releases Renovate manager for oras-project/oras, keeping the configuration simple and letting the VHD/CSE build validation catch any unexpected upstream asset issues.

The default Linux and Windows ORAS versions are aligned at 1.3.3, and the Windows ORAS test fixtures now reference the same archive version. The Azure Linux OS Guard ORAS entry remains disabled with <DO_NOT_UPDATE> / <SKIP> as requested, and this path does not write previousLatestVersion.

Validation performed:

• Parsed .github/renovate.json and parts/common/components.json with jq.
• Ran git diff --check.
• Ran make generate; Go testdata and manifest generation completed, then the existing shell validation step failed on unrelated baseline SC3014 warnings in files not touched by this PR.

Note: The current latest renovate-config-validator rejects existing repo config fields such as managerFilePatterns and commitHourlyLimit, so it is not a useful signal for this focused change without a broader Renovate config migration.

Which issue(s) this PR fixes:

N/A

🤖 Generated by GitHub Copilot

[Copilot]

Pull request overview

Enables Renovate tracking for the ORAS CLI component by replacing the <DO_NOT_UPDATE> pin with an ORAS-specific custom datasource + regex manager that only accepts GitHub releases containing the exact cached artifacts AgentBaker expects.

Changes:

• Updated parts/common/components.json to use a github-releases-with-assets=oras-project/oras renovateTag and aligned Linux + Windows ORAS versions to 1.3.3 (Azure Linux OSGUARD entry remains <DO_NOT_UPDATE> / <SKIP>).
• Added Renovate configuration to (a) allow minor/patch updates for ORAS and (b) implement an ORAS GitHub releases datasource that filters out releases missing required assets.
• Updated Windows CSE test fixtures to reference oras_1.3.3_* archives.

Package Update Analysis: oras

Version change:

• Linux (default/current): 1.2.2 → 1.3.3 (minor)
• Windows (default): 1.3.0 → 1.3.3 (patch)

OS variants affected: Linux (amd64/arm64), Windows (amd64)
OS variants NOT updated: Azure Linux OSGUARD/v3.0 (still <SKIP> by design)

Changes between 1.3.2 and 1.3.3 (from ORAS v1.3.3 release notes)

Change	Description	Risk
Security	Updates oras-go to address a tar-extraction path traversal advisory (GHSA-fxhp-mv3v-67qp)	🟢 Low
Bug fix	Copy/mount behavior fixes for differing credentials / cross-repo mounts	🟢 Low
Feature	oras attach improvements (e.g., --config)	🟡 Medium

Overall Risk: 🟢 Low

Justification: The move to v1.3.3 is primarily a maintenance/security update, and the Renovate-side “required assets” gating reduces the chance of selecting an incompatible release artifact set.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
staging/cse/windows/networkisolatedclusterfunc.tests.ps1	Updates ORAS archive fixture names used by Windows CSE tests to 1.3.3.
parts/common/components.json	Switches ORAS from <DO_NOT_UPDATE> to an asset-gated GitHub releases renovateTag and aligns Linux/Windows versions.
.github/renovate.json	Adds ORAS-specific package rule, regex manager, and custom datasource that validates required release assets.

[github-actions]

Changes cached containers or packages on windows VHDs

Please get a Windows SIG member to approve.

The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.

• Additions are new things cached.
• Deletions are things no longer cached.

diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index e187816..0ffcbef 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -1 +1 @@
-c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.3/oras_1.3.3_windows_amd64.zip
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index 760db3c..8e43598 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -1 +1 @@
-c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.3/oras_1.3.3_windows_amd64.zip
diff --git a/vhd_files/2025-gen2-tl.txt b/vhd_files/2025-gen2-tl.txt
index 5fc7b9e..c6a05b9 100644
--- a/vhd_files/2025-gen2-tl.txt
+++ b/vhd_files/2025-gen2-tl.txt
@@ -1 +1 @@
-c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.3/oras_1.3.3_windows_amd64.zip
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index 5c054c3..cd9c8f6 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -1 +1 @@
-c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.3/oras_1.3.3_windows_amd64.zip
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index 1fe4b78..0f3dbfb 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -1 +1 @@
-c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.3/oras_1.3.3_windows_amd64.zip

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.