dependabot / dependabot/dependabot-core
If a digest SHA is used in a Dockerfile, PRs are not superseded when newer SHAs are created
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
n/a
### Language version
n/a
### Manifest location and content before the Dependabot update
```Dockerfile
FROM steamcmd/steamcmd:ubuntu-22@sha256:091eb51de70e22deacb316671f90d526e253721d391138df82c5541ced75c2f9
```
### dependabot.yml content
```yaml
version: 2
updates:
# Keep Docker dependencies up to date
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "daily"
```
### Updated dependency
```Dockerfile
FROM steamcmd/steamcmd:ubuntu-22@sha256:04e690a1c1b15e808967a0a7f243f0ce3833df872a2cbb45efb2b980edf4aaaa
```
### What you expected to see, versus what you actually saw
I would expect that the previous pr gets updated with the new SHA-digest of the newest available docker image.
The pr doesn't get an update. If the pr gets created, it works (fixed with this issue: #6150)
**Note:** the steamcmd/steamcmd image gets an update every 6 hours.
### Native package manager behavior
n/a
### Images of the diff or a link to the PR, issue, or logs
**Dependabot Output:**
```
proxy | 2023/06/02 18:51:12 proxy starting, commit: d719b9b9871e853c5fd63bf3552f3f857d979f3c
proxy | 2023/06/02 18:51:12 Listening (:1080)
updater | 2023-06-02T18:51:13.089443171 [672606741:main:WARN:src/devices/src/legacy/serial.rs:222] Detached the serial input due to peer close/error.
updater | time="2023-06-02T18:51:15Z" level=info msg="guest starting" commit=8ab4a20db815b67034070152643b9878c12b051d
updater | time="2023-06-02T18:51:15Z" level=info msg="starting job..." fetcher_timeout=10m0s job_id=672606741 updater_timeout=45m0s updater_version=49704c16cb0893c0ab8c5f884471c324baf39b83-docker
updater | 2023/06/02 18:51:17 INFO Raven 3.1.2 ready to catch errors
updater | 2023/06/02 18:51:19 INFO Starting job processing
proxy | 2023/06/02 18:51:19 [002] GET https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue
proxy | 2023/06/02 18:51:19 [002] * authenticating github api request with token for api.github.com
proxy | 2023/06/02 18:51:20 [002] 200 https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue
proxy | 2023/06/02 18:51:20 [004] GET https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue/git/refs/heads/main
proxy | 2023/06/02 18:51:20 [004] * authenticating github api request with token for api.github.com
proxy | 2023/06/02 18:51:20 [004] 200 https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue/git/refs/heads/main
proxy | 2023/06/02 18:51:20 [006] GET https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue/contents/?ref=babfbeddaa2bb039cef523b825544e050da59885
proxy | 2023/06/02 18:51:20 [006] * authenticating github api request with token for api.github.com
proxy | 2023/06/02 18:51:20 [006] 200 https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue/contents/?ref=babfbeddaa2bb039cef523b825544e050da59885
proxy | 2023/06/02 18:51:20 [008] GET https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue/contents/Dockerfile?ref=babfbeddaa2bb039cef523b825544e050da59885
proxy | 2023/06/02 18:51:20 [008] * authenticating github api request with token for api.github.com
proxy | 2023/06/02 18:51:20 [008] 200 https://api.github.com:443/repos/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue/contents/Dockerfile?ref=babfbeddaa2bb039cef523b825544e050da59885
updater | 2023/06/02 18:51:20 INFO Finished job processing
updater | time="2023-06-02T18:51:20Z" level=info msg="task complete" container_id=job-672606741-file-fetcher exit_code=0 job_id=672606741 step=fetcher
updater | 2023/06/02 18:51:22 INFO Raven 3.1.2 ready to catch errors
updater | 2023/06/02 18:51:24 INFO Starting job processing
updater | 2023/06/02 18:51:24 INFO Starting update job for cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue
updater | 2023/06/02 18:51:24 INFO Checking all dependencies for version updates...
updater | 2023/06/02 18:51:24 INFO Checking if steamcmd/steamcmd ubuntu-22 needs updating
proxy | 2023/06/02 18:51:24 [014] GET https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/tags/list
proxy | 2023/06/02 18:51:24 [014] 401 https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/tags/list
proxy | 2023/06/02 18:51:24 [016] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Asteamcmd%2Fsteamcmd%3Apull&account
proxy | 2023/06/02 18:51:25 [016] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Asteamcmd%2Fsteamcmd%3Apull&account
proxy | 2023/06/02 18:51:25 [018] GET https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/tags/list
proxy | 2023/06/02 18:51:25 [018] 200 https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/tags/list
proxy | 2023/06/02 18:51:25 [020] HEAD https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/latest
proxy | 2023/06/02 18:51:25 [020] 401 https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/latest
proxy | 2023/06/02 18:51:25 [022] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Asteamcmd%2Fsteamcmd%3Apull&account
proxy | 2023/06/02 18:51:25 [022] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Asteamcmd%2Fsteamcmd%3Apull&account
proxy | 2023/06/02 18:51:25 [024] HEAD https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/latest
proxy | 2023/06/02 18:51:25 [024] 200 https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/latest
updater | 2023/06/02 18:51:25 INFO Latest version is ubuntu-22
proxy | 2023/06/02 18:51:25 [026] HEAD https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/ubuntu-22
proxy | 2023/06/02 18:51:25 [026] 401 https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/ubuntu-22
proxy | 2023/06/02 18:51:25 [028] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Asteamcmd%2Fsteamcmd%3Apull&account
proxy | 2023/06/02 18:51:25 [028] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Asteamcmd%2Fsteamcmd%3Apull&account
proxy | 2023/06/02 18:51:25 [030] HEAD https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/ubuntu-22
proxy | 2023/06/02 18:51:25 [030] 200 https://registry.hub.docker.com:443/v2/steamcmd/steamcmd/manifests/ubuntu-22
updater | 2023/06/02 18:51:25 INFO Pull request already exists for steamcmd/steamcmd with latest version ubuntu-22
updater | 2023/06/02 18:51:25 INFO Finished job processing
updater | time="2023-06-02T18:51:25Z" level=info msg="task complete" container_id=job-672606741-updater exit_code=0 job_id=672606741 step=updater
```
### Smallest manifest that reproduces the issue
https://github.com/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue
Contributor guide
Research direction
Start with the smallest manifest linked in the issue, then inspect the Dockerfile, dependabot.yml, and the reproduced Dependabot output. Trace how the existing pull request is detected when the Docker image tag stays ubuntu-22 but its digest changes. Done means a newer digest causes the existing update PR to be superseded or updated, with coverage for this reproduction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, ruby
- Domain
- devops, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100