Add external support for dependency management of oci_pull

[malt3]

This is not a feature request regarding implementation in this repo but rather a way to coordinate efforts.

Many projects use third party tools for dependency management like dependabot or renovate. It would be amazing to have support for upgrading oci_pull rules in Bazel repos using those tools. Those tools often already have support for the upgrading logic required for container images and only need to understand the rule format used by oci_pull.

The following tools would be good candidates for implementations:

• renovate (WORSPACE rules) PR
• renovate (bzlmod)(https://github.com/renovatebot/renovate/pull/21893)[PR]

I will likely start work on the renovate support soon.
Feel free to add ideas 💡

[alexeagle]

ah, you should coordinate with @cgrindel who just proposed some work on renovate to support bzlmod generally. Since oci_pull versions will appear in MODULE.bazel, it's very related.

[malt3]

I spoke to @cgrindel and I'm following the proposal in the SIG. Since my team is blocked by missing renovate support and needs this before adopting rules_oci, I created a PR to add support for the legacy workspace rules. Happy to extend this with bzlmod support once the proposal is ready but I had to unblock my team first. Hope you understand.

[alexeagle]

Hmm one other possible solution here is to change rules_oci to understand a file that Renovate already manages, rather than change Renovate to understand oci_pull in WORKSPACE/MODULE.bazel

https://docs.renovatebot.com/docker/ suggests we could do sth like oci_pull(dockerfile = "//:Dockerfile") and then the pinning information lives over there. The oci_pull implementation would have to grow a little parser for that file format.

[malt3]

I know that from the renovate side, this would work and effectively upgrade FROM statements inside of the referenced Dockerfile.

[thesayyn]

@malt3 can we close this now that renovate supports it?