[mortyops]

This PR contains the following updates:

Package	Update	Change
docker.io/library/python (source)	digest	bc62fbc → eb2c626

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a pure digest bump of docker.io/library/python:3.14-alpine from bc62fbc to eb2c626. The diff changes exactly one line — the image digest — and nothing else in the repository is touched.

Change-by-Change Findings

kubernetes/apps/base/system/xe-gpu-exporter/app/helmrelease.yaml

• Only the digest changed. The repository (docker.io/library/python) and tag (3.14-alpine) are unchanged. The tag prefix 3.14-alpine is a fixed version string; the digest is the only mutable component. This is a standard Renovate digest-only bump.
• No other manifest fields were touched. No values, env, command, securityContext, or tolerations lines were modified. The exporter's runtime contract (Python 3.14-alpine, exporter.py, port 9105) is preserved.
• No secrets, no postRenderer, no allowGitHubActions workflow. The diff is clean of any of the hard-rule blockers.
• No Flux substitution risk. The changed line is a literal digest; no ${...} tokens are introduced.
• No networking, storage, or GPU device-node changes. The exporter is a DaemonSet reading DRM fdinfo; the digest bump does not affect its host-pid or SYS_PTRACE requirements.

Required Checks Disposition

Check	Status	Rationale
verify only image digests changed; repository and tag unchanged	satisfied	The diff is a single-line change to tag: with the same 3.14-alpine prefix and a different sha256: suffix. No other lines in the file were modified.

Standards Compliance

• No plaintext secrets — the diff contains no tokens, passwords, or keys.
• No postRenderer — not applicable to this file.
• No allowGitHubActions workflow — not applicable.
• Flux layout — the file lives at kubernetes/apps/base/system/xe-gpu-exporter/app/helmrelease.yaml, which is the correct base manifest path. The overlay at kubernetes/apps/main/system/xe-gpu-exporter.yaml is unchanged.
• Naming — helmrelease.yaml is kebab-case, correct.
• Schema comment — the file retains its # yaml-language-server: $schema=... header.

Unknowns / Needs Verification

• OCI provenance is unavailable. The image-repo-heuristic could not resolve revision labels or created timestamps for either digest. The upstream docker-library/python GitHub releases page was not fetchable (non-allowlisted host). This means we cannot confirm whether the new digest corresponds to a code change or a rebuild. For a 3.14-alpine tag, this is expected (Alpine-based images are rebuilt frequently). The risk is low: a digest-only bump of a base language image is a routine maintenance operation.
• No CI test evidence for the exporter itself is present in the corpus (the contract test scripts/ci/xe-gpu-exporter-test.py is referenced in comments but not run as part of this PR). This is acceptable for a digest-only bump.

Tool Harness Findings

None.

Summary

A clean, low-risk digest bump. No changes to behavior, configuration, or cluster state. Approved.

[mortyops]

--- DaemonSet system/xe-gpu-exporter
+++ DaemonSet system/xe-gpu-exporter
@@ -38,7 +38,7 @@
           value: "9105"
         - name: XE_VRAM_TOTALS_MIB
           value: 0000:03:00.0=32656
-        image: docker.io/library/python:3.14-alpine@sha256:bc62fbcb684904b1bb81a6240041bb60e9c1ee19ddeaf17a6b4297e1cc9c95d2
+        image: docker.io/library/python:3.14-alpine@sha256:eb2c62658b8d51bff0acc408504b76521d02030de56a8a3c1e830083e89b89d2
         livenessProbe:
           httpGet:
             path: /healthz

[mortyops]

--- HelmRelease system/xe-gpu-exporter
+++ HelmRelease system/xe-gpu-exporter
@@ -49,7 +49,7 @@
               XE_VRAM_TOTALS_MIB: 0000:03:00.0=32656
             image:
               repository: docker.io/library/python
-              tag: 3.14-alpine@sha256:bc62fbcb684904b1bb81a6240041bb60e9c1ee19ddeaf17a6b4297e1cc9c95d2
+              tag: 3.14-alpine@sha256:eb2c62658b8d51bff0acc408504b76521d02030de56a8a3c1e830083e89b89d2
             probes:
               liveness:
                 custom: true