Treat exact same-reference SHA-256 digest replacements as image-only updates that do not require an app-version marker. Reconcile all whitelisted Renovate PRs through the final automerge gate so labels and marker prefilters cannot strand eligible updates.
Validate the configured Docker Hub credentials against the token service and a public manifest before starting a full Renovate scan. Provide a small manual workflow so maintainers can diagnose authentication without consuming a full scan.
Strip image digests before deriving app directory versions, while continuing to reject digest-only images. Document the cache privacy boundary, restrict the workflow token to read-only, and bound full scans to 90 minutes.
Restore and save Renovate's public lookup and repository extraction cache with a SHA-pinned GitHub action. Keep private package caching disabled and report cache growth for quota monitoring.
Give the Mend App and the self-hosted Docker scanner disjoint manager scopes, branch namespaces, and dependency dashboards so they cannot close each other's PRs. Preserve the existing Compose policy in a dedicated config and document the scaling boundary.
- run the update-app-version workflow only for Renovate pushes or manual dispatch
- skip already-renamed version directories and rolling aliases in the rename helper
- keep follow-up maintainer patches on Renovate branches from tripping the version rename workflow
Use PR file metadata for the single-service gate so stale but otherwise clean Renovate branches are classified from their actual patch set.
Also whitelist additional single-service apps that match the direct-merge policy and passed the image-only gate.
Use the built-in GitHub token for internal workflow dispatches so reconcile can trigger downstream runs without PAT scope mismatches.
Also make the automerge gate inspect the actual base/head git diff, tolerate version-directory renames, and treat ineligible PRs as a skipped gate instead of a failed workflow run.
okxlin
renovate[bot]
