Renovate reads wrong OCI attributes

[larsskj]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Github app

Please tell us more about your question or problem

I have create an OCI container image build using Podman and pushed it to a private JFrog Artifactory instance. The code is hosted in a private Github Enterprise repository.

After a long session with trial and errors, I've managed to make this work with Renovate running as an app on the private Github Enterprise account.

However, it doesn't work properly: Whilst Renovate generates a new PR for each update of the container image, it points to the wrong repository URL for the code and it doesn't find release notes.

In Artifactory, all relevant metadata is displayed correct.

But the image is built inheriting from another image as usual with container builds; and Renovate's PR points to the source of this parent image instead of the source and release information of the image we've built.

Upon inspection of the image in question, it reveals that both URLs are included in the image: Our custom data is included as labels, but the information from the parent image is included as annotations.

According to Renovate documentation,

This datasource looks for the metadata of the latest stable image found on the Docker registry and uses the value of the label org.opencontainers.image.source and org.label-schema.vcs-url as the sourceUrl. Additionally, it uses the value of the label org.opencontainers.image.revision as the gitRef.

however, this seems not to be the case: The image labels contains the proper values, but Renovate seems to use the metadata from the annotations - which point to metadata for the parent image - instead of using the metadata from the labels.

"Labels": {
   "io.buildah.version": "1.33.7",
   "org.opencontainers.image.description": "A maintained fork of the Akawork jenkins-exporter project found on Github.",
   "org.opencontainers.image.documentation": "https://github.com/<org>/akawork-jenkins-exporter",
   "org.opencontainers.image.licenses": "Apache 2.0",
   "org.opencontainers.image.source": "https://github.com/<org>/akawork-jenkins-exporter",
   "org.opencontainers.image.title": "Akawork Jenkins Exporter",
   "org.opencontainers.image.vendor": "The Team",
   "org.opencontainers.image.version": "1.0.54"
},
"Annotations": {
   "com.docker.official-images.bashbrew.arch": "amd64",
   "org.opencontainers.image.base.digest": "sha256:eeae217fac0c60ede81070cdd32e499960742b8d5e75e5fd971f846fda5a070f",
   "org.opencontainers.image.base.name": "docker.io/library/python:3.8-slim",
   "org.opencontainers.image.created": "2024-09-07T11:22:36Z",
   "org.opencontainers.image.revision": "36e52f14df57eeab9efd1d4716c06810a3b968a5",
   "org.opencontainers.image.source": "https://github.com/docker-library/python.git#36e52f14df57eeab9efd1d4716c06810a3b968a5:3.8/slim-bookworm",
   "org.opencontainers.image.url": "https://hub.docker.com/_/python",
   "org.opencontainers.image.version": "3.8.20-slim-bookworm"
},

Could this be right?

[larsskj]

I have now tried overriding the annotations in an image build: Renovate then works as expected.

So I would suggest that you either fix Renovate to read OCI labels as documented, or change documentation to include the fact the annotations apparently override labels.

[joebowbeer]

@larsskj these docs are probably in need of an update:

https://github.com/renovatebot/renovate/blob/main/lib/modules/datasource/docker/readme.md

According to OCI guidelines, I think it is expected that annotations would override labels for supply chain and provenance metadata.