Allow digest pinning for Renovate image

[goosmurf]

Currently we have renovate-image and renovate-version and they are combined with a : in https://github.com/renovatebot/github-action/blob/main/src/docker.ts

I think this makes it impossible to pin to an image digest.

My end-goal is to have Renovate manage the versioning and use pinDigests to ensure we are running a version of Renovate that:

1. Meets minimumReleaseAge
2. Is pinned to a digest to remove the risk that a version tag is re-published with a malicious image, after the minimumReleaseAge

One idea might be to make renovate-image accept a fully specified image+tag. The logic for this might simply look for the presence of a : which would cater for both image:tag and image@SHA256:digest.

[viceice]

can't you use tag@sha256... as version?

[viceice]

docker datasource doesn't support minimum release age by default, only docker hub supports it

[goosmurf]

can't you use tag@sha256... as version?

I tried using:

renovate-image: renovate/renovate@sha256:72d184865d505d5badc5c3b32a48410096e0d9d7e0d875dae28ee97832178f47

But it produces this error:

/usr/bin/docker run [snipped]  --rm renovate/renovate@sha256:72d184865d505d5badc5c3b32a48410096e0d9d7e0d875dae28ee97832178f47:latest
docker: invalid reference format

As you can see, the issue is that the action has appended :latest to the image+tag.

If I try to say:

renovate-image: renovate/renovate
renovate-version: @sha256:...

Then the action will try to run renovate/renovate:@sha256:.. which is also invalid.

docker datasource doesn't support minimum release age by default, only docker hub supports it

Thanks, I am aware. I am using Docker Hub renovate/renovate as my source to work around this issue.

[viceice]

renovate-image: renovate/renovate
renovate-version: 1.2.4@sha256:...

I mean something like this

[goosmurf]

Thank you!

Somehow I missed that option but can confirm it does work :)