UNCLASSIFIED - NO CUI

Update Renovate.json

Summary

Renovate is not correctly updating the postgres image used in its database, but claims that it is in the SBOM (Software bill of materials) in Chart.yaml annotations

Steps to reproduce

Renovate.json will fail to identify .values.database.readiness.image tag and therefore leave it un-updated.

What is the current behavior?

Renovate tickets are generated using the new version of postgres in the helm.sh/images annotations for the SBOM. When this is updated correctly but the image pulled in values does not match, image_annotation_validation fails

There are also a few missing renovate signatures for registry1.dso.mil/ironbank/opensource/minio/minio and registry1.dso.mil/ironbank/opensource/minio/mc

What is the expected behavior?

Renovate should update both the SBOM (helm.sh/images) and the actual image in values.yaml simultaneously.

Relevant logs and/or screenshots

https://repo1.dso.mil/big-bang/product/packages/mattermost/-/jobs/22287240

Within this job, there is an images.txt artifact that shows the application only pulls 12.14, but helm.sh/images claims that we should be on 12.15

Possible fixes

https://repo1.dso.mil/big-bang/product/packages/mattermost/-/blob/main/renovate.json#L27

We just have to add a regex manager that uniquely identifies this tag and allows it to upgrade.

/cc {put CODEOWNERs @githandles here}

Edited by Cody Williams