dependabot / dependabot/dependabot-core
Dependabot doesn't create a PR for docker updates where a multi-version image tag is used
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
self-host/runner/Dockerfile
```Dockerfile
FROM ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner:v2.296.1-ubuntu-20.04
```
### dependabot.yml content
```yaml
version: 2
updates:
- package-ecosystem: 'docker'
directory: /self-host/runner
schedule:
interval: 'daily'
time: '10:00'
open-pull-requests-limit: 10
```
### Updated dependency
ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner
```json
{
"name": "actions-runner-controller/actions-runner-controller/actions-runner",
"tags": [
"v2.285.1-ubuntu-20.04",
"v2.285.1-ubuntu-20.04-2bd6d63",
"v2.286.0-ubuntu-20.04-8a7720d",
"v2.286.0-ubuntu-20.04",
"v2.286.0-ubuntu-20.04-ad48851",
"v2.286.1-ubuntu-20.04",
"v2.286.1-ubuntu-20.04-5e86881",
"v2.287.0-ubuntu-20.04",
"v2.287.0-ubuntu-20.04-81b2c5a",
"v2.287.1-ubuntu-20.04-715e6a4",
"v2.287.1-ubuntu-20.04-f09a974",
"v2.287.1-ubuntu-20.04-cc25dd7",
"v2.287.1-ubuntu-20.04",
"v2.287.1-ubuntu-20.04-6f591ee",
"v2.288.0-ubuntu-20.04",
"v2.288.0-ubuntu-20.04-f0fa99f",
"v2.288.1-ubuntu-20.04-e42db00",
"v2.288.1-ubuntu-20.04-c221b6e",
"v2.288.1-ubuntu-20.04",
"v2.288.1-ubuntu-20.04-b25a0fd",
"v2.289.1-ubuntu-20.04-4cbbcd6",
"v2.289.1-ubuntu-20.04-2cb04dd",
"v2.289.1-ubuntu-20.04",
"v2.289.1-ubuntu-20.04-debf53c",
"v2.289.2-ubuntu-20.04",
"v2.289.2-ubuntu-20.04-971c54b",
"v2.290.0-ubuntu-20.04-7b8057e",
"v2.290.0-ubuntu-20.04-4a3b7bc",
"v2.290.0-ubuntu-20.04",
"v2.290.0-ubuntu-20.04-352e206",
"v2.290.1-ubuntu-20.04-8195178",
"v2.290.1-ubuntu-20.04",
"v2.290.1-ubuntu-20.04-059481b",
"v2.291.1-ubuntu-20.04-800d6bd",
"v2.291.1-ubuntu-20.04-c1e5829",
"v2.291.1-ubuntu-20.04-d01595c",
"latest",
"v2.291.1-ubuntu-20.04",
"v2.291.1-ubuntu-20.04-3ca1152",
"v2.291.1-ubuntu-20.04-2120981",
"v2.292.0-ubuntu-20.04",
"v2.292.0-ubuntu-20.04-ac27df8",
"v2.292.0-ubuntu-20.04-0cd13fe",
"v2.293.0-ubuntu-20.04",
"v2.293.0-ubuntu-20.04-933b0c7",
"v2.293.0-ubuntu-20.04-23f091d",
"v2.293.0-ubuntu-20.04-3c7d3d6",
"v2.294.0-ubuntu-20.04",
"v2.294.0-ubuntu-20.04-f24e2fa",
"v2.294.0-ubuntu-20.04-071898c",
"v2.294.0-ubuntu-20.04-84d16c1",
"v2.294.0-ubuntu-20.04-e2c8163",
"v2.294.0-ubuntu-20.04-bc7a3ca",
"v2.294.0-ubuntu-20.04-abb8615",
"v2.294.0-ubuntu-20.04-af96de6",
"v2.294.0-ubuntu-20.04-0386c07",
"v2.294.0-ubuntu-20.04-ddd417f",
"v2.294.0-ubuntu-20.04-d86bd2b",
"v2.294.0-ubuntu-20.04-067ed2e",
"v2.294.0-ubuntu-20.04-5ea0841",
"v2.294.0-ubuntu-20.04-fc63d6d",
"v2.294.0-ubuntu-20.04-63935d2",
"v2.294.0-ubuntu-20.04-1ce0a18",
"v2.294.0-ubuntu-20.04-858ef89",
"v2.294.0-ubuntu-20.04-73e430c",
"v2.294.0-ubuntu-20.04-f661249",
"v2.294.0-ubuntu-20.04-d4f35cf",
"v2.294.0-ubuntu-20.04-9b28e63",
"v2.294.0-ubuntu-20.04-2fe6adf",
"v2.294.0-ubuntu-20.04-82641e5",
"v2.294.0-ubuntu-20.04-e3deb0d",
"v2.294.0-ubuntu-20.04-11cb9b7",
"v2.294.0-ubuntu-20.04-c658dcf",
"v2.294.0-ubuntu-20.04-98b17dc",
"v2.294.0-ubuntu-20.04-37aa1a0",
"v2.294.0-ubuntu-20.04-3f78f71",
"v2.294.0-ubuntu-20.04-fc55477",
"v2.295.0-ubuntu-20.04",
"v2.295.0-ubuntu-20.04-784019f",
"v2.295.0-ubuntu-20.04-3724b46",
"v2.296.0-ubuntu-20.04",
"v2.296.0-ubuntu-20.04-55ca7bf",
"v2.296.1-ubuntu-20.04",
"v2.296.1-ubuntu-20.04-e233f7a",
"v2.296.2-ubuntu-20.04",
"v2.296.2-ubuntu-20.04-0615c2a"
]
}
```
### What you expected to see, versus what you actually saw
I expect the depeandabot to create a PR with version v2.296.2-ubuntu-20.04
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
```
updater | time="2022-09-13T14:00:32Z" level=info msg="task complete" container_id=job-458053644-file-fetcher exit_code=0 job_id=458053644 step=fetcher
updater | I, [2022-09-13T14:00:34.057756 #7] INFO -- sentry: ** [Raven] Raven 3.1.2 ready to catch errors
updater | To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
updater | INFO Starting job processing
updater | INFO Starting update job for foo-bar/gha-setup
updater | INFO Checking if actions-runner-controller/actions-runner-controller/actions-runner v2.296.1-ubuntu-20.04 needs updating
proxy | 2022/09/13 14:00:36 [014] GET https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [014] 401 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [016] GET https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [016] 200 https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [018] GET https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [018] 200 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [020] HEAD https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
proxy | 2022/09/13 14:00:36 [020] 401 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
proxy | 2022/09/13 14:00:36 [022] GET https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [022] 200 https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [024] HEAD https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
proxy | 2022/09/13 14:00:37 [024] 200 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
updater | INFO Latest version is v2.296.1-ubuntu-20.04
updater | INFO No update needed for actions-runner-controller/actions-runner-controller/actions-runner v2.296.1-ubuntu-20.04
updater | INFO Finished job processing
updater | time="2022-09-13T14:00:37Z" level=info msg="task complete" container_id=job-458053644-updater exit_code=0 job_id=458053644 step=updater
```
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Reproduce the update check using self-host/runner/Dockerfile and the shown dependabot.yml, then follow the Docker updater entry point while comparing the logged tag selection with the registry tag list. Done means Dependabot recognizes v2.296.2-ubuntu-20.04 as newer than v2.296.1-ubuntu-20.04 and creates the expected pull request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100