[lmilbaum]

Summary

• Extends the "kindest/node image pins in management cluster manifests" Renovate custom manager to capture @sha256:... alongside the tag, so bumps update both atomically.
• Removes autoReplaceStringTemplate so the default replacement applies.
• Adds both mgmt/local-host/clusters/*/cluster-class.yaml files to test-renovate-coverage.py EXPECTED with a currentDigest assertion.

Root cause

The existing matchStrings pattern stopped at the tag, leaving the trailing @sha256:... untouched. PR #591 (Renovate kubernetes-version bump) updated the kindest/node tag to v1.37.0 but kept the v1.36.4 digest, causing the air-gap artifact build and the kubeadm image gate to fail. This fix makes the manager capture and replace the digest so regenerated/future bump PRs come out correct.

How to test

After merge, trigger or wait for Renovate to rebase PR #591. The cluster-class customImage lines should show v1.37.0@sha256:a1ed56c... and the CI "Air-gap image digest pins" gate should pass.

🤖 Generated with Claude Code

[github-actions]

Note

No rendered changes.

_{konflate 0.6.4 · rendered 8da4970 · full diff →}

[shrinedogg]

APPROVE: the kindest/node custom manager now captures and rewrites the digest together with the tag. Verified against the registry and Renovate's real update path; the sweep shows no other image ref with the same tag-only gap.

Verified (commands + results):

• gh pr view 605 --json headRefOid -> 8da4970; local checkout of pull/605/head matches; merge base is origin/main c48201a. The diff is renovate.json5 plus tests/test-renovate-coverage.py only.
• Docker Hub registry API for kindest/node: v1.36.4 -> sha256:099e049362... (the digest currently on file in both cluster classes), v1.37.0 -> sha256:a1ed56cfb0..., v1.37.1 -> 404 (not yet published). The manager's next real bump (v1.37.0, #591) therefore resolves against a published digest.
• Renovate 44.149.0 source (dist/workers/repository/update/branch/auto-replace.js): with no autoReplaceStringTemplate, doAutoReplace uses the full matched span as replaceString and rewrites currentValue->newValue and currentDigest->newDigest inside it, and confirmIfDepUpdated re-extracts the result and fails if the new digest is not re-extracted. The old config matched only the tag span and templated "kindest/node:v{{newValue}}", which is exactly the stale-digest result observed in #591 (kindest/node:v1.37.0@sha256:099e0493... on the four customImage lines).
• Local runs under node 24.21.0 + renovate 44.149.0 (the exact CI pin, validate.yml renovate-digest-pinning job):
  • python3 tests/test-renovate-auto-replace.py -> pass, "autoReplace: 175 regex-manager updates rewrite only their version/digest". Targeted probe over the two cluster-class files: all four kindest deps have replaceString "kindest/node:v1.36.4@sha256:099e..." and ok=true, i.e. the real doAutoReplace output matches the pure tag+digest swap.
  • python3 tests/test-renovate-coverage.py -> pass (exit 0). The new assert_kindest_node_digests_extracted confirms currentDigest is extracted for the kindest deps in both cluster-class files; per-file expectations (including the two newly listed files) are met; the repo-level dry run reports no duplicate-registry warnings.
  • python3 tests/test-renovate-replace-templates.py -> pass.
  • python3 airgap/tests/test-renovate-digest-pinning.py -> pass (exit 0).
• Incomplete sweep: every ":tag@sha256:" image ref in the repo is covered by a digest-consuming manager: airgap/images.txt:45-46 (images.txt manager, renovate.json5:414-421), airgap/scripts/build-config-artifact.sh:195, airgap/scripts/build-package.sh:101-102, airgap/scripts/stage-and-create-cluster.sh:26 (airgap scripts manager, renovate.json5:424-431), and the two mgmt cluster classes (this fix). No other regex manager matches an image ref that can carry a digest: the KCC operator image (mgmt/gcp/infrastructure/kcc-operator/configconnector-operator.yaml:3530) is tag-only in file, and the zarf release-asset managers' currentDigest is a shasum their match string already includes. The fix also aligns this manager with the no-template, digest-in-match pattern the virtualized-e2e and airgap managers already use (renovate.json5:407, 417, 427, 445).
• CI at head 8da4970: run 38925125739 completed/success, all checks green, mergeStateStatus CLEAN.

Looks good: title matches the diff. The regression test pins the extraction behavior (the extracted dep must carry a currentDigest), so a future matchStrings edit that drops the digest group fails the "Renovate airgap digest pinning" job instead of silently re-breaking the #591 scenario.

Cross-reference: #591 (kubernetes-version bump) is still held on its red digest-pin check and the four stale-digest customImage lines; this PR is the unblock for the digest side of that hold.