Treat exact same-reference SHA-256 digest replacements as image-only updates that do not require an app-version marker. Reconcile all whitelisted Renovate PRs through the final automerge gate so labels and marker prefilters cannot strand eligible updates.
Map the NetBox and Zipline application services so Renovate can select their target versions, and rename the current NetBox directory to match its updated image tag.
Map the Flagsmith and Kaneo application services so Renovate can select their target versions, and rename the current Flagsmith directory to match its updated image tag.
Wire container bootstrap settings to the install form, use isolated default persistence, preserve historical initialization markers during upgrades, add fixed and floating V2 variants, and constrain Renovate so V1 LTS and V2 releases remain separate.
Validate the configured Docker Hub credentials against the token service and a public manifest before starting a full Renovate scan. Provide a small manual workflow so maintainers can diagnose authentication without consuming a full scan.
Strip image digests before deriving app directory versions, while continuing to reject digest-only images. Document the cache privacy boundary, restrict the workflow token to read-only, and bound full scans to 90 minutes.
Restore and save Renovate's public lookup and repository extraction cache with a SHA-pinned GitHub action. Keep private package caching disabled and report cache growth for quota monitoring.
Give the Mend App and the self-hosted Docker scanner disjoint manager scopes, branch namespaces, and dependency dashboards so they cannot close each other's PRs. Preserve the existing Compose policy in a dedicated config and document the scaling boundary.
okxlin