From 41ceff4b616d9cad070fe85b2854fa2680587dcd Mon Sep 17 00:00:00 2001 From: Rajath Agasthya Date: Tue, 25 Aug 2026 12:40:23 -0500 Subject: [PATCH] Disable Renovate digest updates for builder-stage base images MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit golang, ubi9, and debian are only builder stages in docker/Dockerfile — no layers from them ship in the final image, so digest-only rebuilds of the same tag don't change what ships. Disable digest-type updates for them; digests remain pinned and are still updated when the tag changes. Digest updates stay enabled for the distroless runtime base. Signed-off-by: Rajath Agasthya --- .github/renovate.json | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/renovate.json b/.github/renovate.json index 70362e54a..7fbe40781 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -174,6 +174,13 @@ "groupSlug": "go-toolchain", "separateMajorMinor": false, "separateMinorPatch": false + }, + { + "description": "No digest-only updates for builder-stage images; digests are still re-pinned on tag changes", + "matchFileNames": ["docker/Dockerfile", "docker/Dockerfile.devel"], + "matchPackageNames": ["golang", "registry.access.redhat.com/ubi9/ubi", "debian"], + "matchUpdateTypes": ["digest"], + "enabled": false } ] }