dependabot / dependabot/dependabot-core

Dependabot doesn't create a PR for docker updates where a multi-version image tag is used

Open
#5,708 7 comments 0 reactions 0 assignees View on GitHub
L: docker T: bug 🐞 versioning
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Docker

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

self-host/runner/Dockerfile

```Dockerfile
FROM ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner:v2.296.1-ubuntu-20.04
```

### dependabot.yml content

```yaml
version: 2
updates:
- package-ecosystem: 'docker'
directory: /self-host/runner
schedule:
interval: 'daily'
time: '10:00'
open-pull-requests-limit: 10
```

### Updated dependency

ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner

```json
{
"name": "actions-runner-controller/actions-runner-controller/actions-runner",
"tags": [
"v2.285.1-ubuntu-20.04",
"v2.285.1-ubuntu-20.04-2bd6d63",
"v2.286.0-ubuntu-20.04-8a7720d",
"v2.286.0-ubuntu-20.04",
"v2.286.0-ubuntu-20.04-ad48851",
"v2.286.1-ubuntu-20.04",
"v2.286.1-ubuntu-20.04-5e86881",
"v2.287.0-ubuntu-20.04",
"v2.287.0-ubuntu-20.04-81b2c5a",
"v2.287.1-ubuntu-20.04-715e6a4",
"v2.287.1-ubuntu-20.04-f09a974",
"v2.287.1-ubuntu-20.04-cc25dd7",
"v2.287.1-ubuntu-20.04",
"v2.287.1-ubuntu-20.04-6f591ee",
"v2.288.0-ubuntu-20.04",
"v2.288.0-ubuntu-20.04-f0fa99f",
"v2.288.1-ubuntu-20.04-e42db00",
"v2.288.1-ubuntu-20.04-c221b6e",
"v2.288.1-ubuntu-20.04",
"v2.288.1-ubuntu-20.04-b25a0fd",
"v2.289.1-ubuntu-20.04-4cbbcd6",
"v2.289.1-ubuntu-20.04-2cb04dd",
"v2.289.1-ubuntu-20.04",
"v2.289.1-ubuntu-20.04-debf53c",
"v2.289.2-ubuntu-20.04",
"v2.289.2-ubuntu-20.04-971c54b",
"v2.290.0-ubuntu-20.04-7b8057e",
"v2.290.0-ubuntu-20.04-4a3b7bc",
"v2.290.0-ubuntu-20.04",
"v2.290.0-ubuntu-20.04-352e206",
"v2.290.1-ubuntu-20.04-8195178",
"v2.290.1-ubuntu-20.04",
"v2.290.1-ubuntu-20.04-059481b",
"v2.291.1-ubuntu-20.04-800d6bd",
"v2.291.1-ubuntu-20.04-c1e5829",
"v2.291.1-ubuntu-20.04-d01595c",
"latest",
"v2.291.1-ubuntu-20.04",
"v2.291.1-ubuntu-20.04-3ca1152",
"v2.291.1-ubuntu-20.04-2120981",
"v2.292.0-ubuntu-20.04",
"v2.292.0-ubuntu-20.04-ac27df8",
"v2.292.0-ubuntu-20.04-0cd13fe",
"v2.293.0-ubuntu-20.04",
"v2.293.0-ubuntu-20.04-933b0c7",
"v2.293.0-ubuntu-20.04-23f091d",
"v2.293.0-ubuntu-20.04-3c7d3d6",
"v2.294.0-ubuntu-20.04",
"v2.294.0-ubuntu-20.04-f24e2fa",
"v2.294.0-ubuntu-20.04-071898c",
"v2.294.0-ubuntu-20.04-84d16c1",
"v2.294.0-ubuntu-20.04-e2c8163",
"v2.294.0-ubuntu-20.04-bc7a3ca",
"v2.294.0-ubuntu-20.04-abb8615",
"v2.294.0-ubuntu-20.04-af96de6",
"v2.294.0-ubuntu-20.04-0386c07",
"v2.294.0-ubuntu-20.04-ddd417f",
"v2.294.0-ubuntu-20.04-d86bd2b",
"v2.294.0-ubuntu-20.04-067ed2e",
"v2.294.0-ubuntu-20.04-5ea0841",
"v2.294.0-ubuntu-20.04-fc63d6d",
"v2.294.0-ubuntu-20.04-63935d2",
"v2.294.0-ubuntu-20.04-1ce0a18",
"v2.294.0-ubuntu-20.04-858ef89",
"v2.294.0-ubuntu-20.04-73e430c",
"v2.294.0-ubuntu-20.04-f661249",
"v2.294.0-ubuntu-20.04-d4f35cf",
"v2.294.0-ubuntu-20.04-9b28e63",
"v2.294.0-ubuntu-20.04-2fe6adf",
"v2.294.0-ubuntu-20.04-82641e5",
"v2.294.0-ubuntu-20.04-e3deb0d",
"v2.294.0-ubuntu-20.04-11cb9b7",
"v2.294.0-ubuntu-20.04-c658dcf",
"v2.294.0-ubuntu-20.04-98b17dc",
"v2.294.0-ubuntu-20.04-37aa1a0",
"v2.294.0-ubuntu-20.04-3f78f71",
"v2.294.0-ubuntu-20.04-fc55477",
"v2.295.0-ubuntu-20.04",
"v2.295.0-ubuntu-20.04-784019f",
"v2.295.0-ubuntu-20.04-3724b46",
"v2.296.0-ubuntu-20.04",
"v2.296.0-ubuntu-20.04-55ca7bf",
"v2.296.1-ubuntu-20.04",
"v2.296.1-ubuntu-20.04-e233f7a",
"v2.296.2-ubuntu-20.04",
"v2.296.2-ubuntu-20.04-0615c2a"
]
}
```

### What you expected to see, versus what you actually saw

I expect the depeandabot to create a PR with version v2.296.2-ubuntu-20.04

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

```
updater | time="2022-09-13T14:00:32Z" level=info msg="task complete" container_id=job-458053644-file-fetcher exit_code=0 job_id=458053644 step=fetcher
updater | I, [2022-09-13T14:00:34.057756 #7] INFO -- sentry: ** [Raven] Raven 3.1.2 ready to catch errors
updater | To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
updater | INFO Starting job processing
updater | INFO Starting update job for foo-bar/gha-setup
updater | INFO Checking if actions-runner-controller/actions-runner-controller/actions-runner v2.296.1-ubuntu-20.04 needs updating
proxy | 2022/09/13 14:00:36 [014] GET https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [014] 401 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [016] GET https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [016] 200 https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [018] GET https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [018] 200 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/tags/list
proxy | 2022/09/13 14:00:36 [020] HEAD https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
proxy | 2022/09/13 14:00:36 [020] 401 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
proxy | 2022/09/13 14:00:36 [022] GET https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [022] 200 https://ghcr.io:443/token?service=ghcr.io&scope=repository%3Aactions-runner-controller%2Factions-runner-controller%2Factions-runner%3Apull
proxy | 2022/09/13 14:00:36 [024] HEAD https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
proxy | 2022/09/13 14:00:37 [024] 200 https://ghcr.io:443/v2/actions-runner-controller/actions-runner-controller/actions-runner/manifests/latest
updater | INFO Latest version is v2.296.1-ubuntu-20.04
updater | INFO No update needed for actions-runner-controller/actions-runner-controller/actions-runner v2.296.1-ubuntu-20.04
updater | INFO Finished job processing
updater | time="2022-09-13T14:00:37Z" level=info msg="task complete" container_id=job-458053644-updater exit_code=0 job_id=458053644 step=updater
```

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the update check using self-host/runner/Dockerfile and the shown dependabot.yml, then follow the Docker updater entry point while comparing the logged tag selection with the registry tag list. Done means Dependabot recognizes v2.296.2-ubuntu-20.04 as newer than v2.296.1-ubuntu-20.04 and creates the expected pull request.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.