use patch release tag

Dockerfile

-ARG BASE_REGISTRY=registry1.dsop.io
+ARG BASE_REGISTRY=registry1.dso.mil
 ARG BASE_IMAGE=ironbank/redhat/openjdk/openjdk11
 ARG BASE_TAG=1.11
 
-FROM sonarqube:8.7-enterprise AS build
+FROM sonarqube:8.7.1-enterprise AS build
 
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 

hardening_manifest.yaml

@@ -8,7 +8,7 @@ name: "sonarsource/sonarqube/sonarqube8-enterprise"
 # The most specific version should be the first tag and will be shown
 # on ironbank.dsop.io
 tags:
-- "8.7-enterprise"
+- "8.7.1-enterprise"
 - "latest"
 
 # Build args passed to Dockerfile ARGs
@@ -27,7 +27,7 @@ labels:
   org.opencontainers.image.url: "https://docs.sonarqube.org/latest/"
   ## Name of the distributing entity, organization or individual
   org.opencontainers.image.vendor: "SonarSource SA"
-  org.opencontainers.image.version: "8.7-enterprise"
+  org.opencontainers.image.version: "8.7.1-enterprise"
   ## Keywords to help with search (ex. "cicd,gitops,golang")
   mil.dso.ironbank.image.keywords: "cicd,devops,sast,review"
   ## This value can be "opensource" or "commercial"
@@ -38,7 +38,7 @@ labels:
 # List of resources to make available to the offline build context
 resources:
 - url: "docker://docker.io/library/sonarqube@sha256:68ebed67cc82a71e69b8a76c88c6311b598221484fa16bc7b5ef5875a6e7c27c"
-  tag: "sonarqube:8.7-enterprise"
+  tag: "sonarqube:8.7.1-enterprise"
 
 # List of project maintainers
 maintainers:

renovate.json

@@ -14,17 +14,6 @@
     ]
   },
   "regexManagers": [
-    {
-      "fileMatch": [
-        "^Dockerfile$"
-      ],
-      "matchStrings": [
-        "version=\"(?<currentValue>.*?)\""
-      ],
-      "depNameTemplate": "sonarqube",
-      "datasourceTemplate": "docker",
-      "versioningTemplate": "docker"
-    },
     {
       "fileMatch": [
         "^Dockerfile$"
@@ -70,4 +59,4 @@
       "versioningTemplate": "docker"
     }
   ]
-}
+}
\ No newline at end of file