fix(deps): resolve OpenShell digest lookup

.github/scripts/openshell-version.sh

@@ -5,10 +5,15 @@
 # current shell. In GitHub Actions it also exports them to GITHUB_ENV
 # for downstream steps.
 #
+# OPENSHELL_VERSION is tracked by Renovate via a customManager in
+# renovate.json (not this file's magic comments — a bare "# renovate:"
+# comment here would be inert since no built-in manager scans .sh files).
+# OPENSHELL_SHA is refreshed automatically after each version bump by
+# scripts/renovate/update-openshell-sha.sh (see renovate.json postUpgradeTasks).
+#
 # Usage:
 #   source .github/scripts/openshell-version.sh
 
-# renovate: datasource=github-releases depName=NVIDIA/OpenShell
 OPENSHELL_VERSION=0.0.83
 OPENSHELL_SHA=e3d26dd3ae0dee247bbc5db368545832757ac493
 

renovate.json

@@ -22,12 +22,24 @@
       "enabled": false
     },
     {
-      "description": "Group OpenShell base image and version pin into one PR",
+      "description": "Group OpenShell base image and version pin into one PR. After a version bump, fetch and update OPENSHELL_SHA from the matching release tag (the github-releases datasource can't resolve a digest here because extractVersionTemplate strips the 'v' prefix that GitHub's tag lookup needs).",
       "matchPackageNames": [
         "ghcr.io/nvidia/openshell-community/sandboxes/base",
         "NVIDIA/OpenShell"
       ],
-      "groupName": "openshell"
+      "groupName": "openshell",
+      "automerge": false,
+      "postUpgradeTasks": {
+        "commands": ["bash scripts/renovate/update-openshell-sha.sh"],
+        "fileFilters": [".github/scripts/openshell-version.sh"],
+        "executionMode": "branch"
+      }
+    },
+    {
+      "description": "Automerge digest bumps for Red Hat UBI base images once required checks pass",
+      "matchPackageNames": ["/^registry\\.access\\.redhat\\.com\\/ubi10\\//"],
+      "matchUpdateTypes": ["digest"],
+      "automerge": true
     },
     {
       "description": "Group Cloudflare Worker packages to prevent broken lockfile-only PRs from peer dependency conflicts",
@@ -67,10 +79,10 @@
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Track OpenShell version pin in openshell-version.sh",
+      "description": "Track the OpenShell version pin in openshell-version.sh. OPENSHELL_SHA is updated automatically by postUpgradeTasks (scripts/renovate/update-openshell-sha.sh) since the github-releases datasource can't resolve a digest for the version-only (no 'v' prefix) value produced by extractVersionTemplate.",
       "managerFilePatterns": ["/^\\.github/scripts/openshell-version\\.sh$/"],
       "matchStrings": [
-        "OPENSHELL_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)\\nOPENSHELL_SHA=(?<currentDigest>[0-9a-f]{40})"
+        "OPENSHELL_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
       ],
       "depNameTemplate": "NVIDIA/OpenShell",
       "datasourceTemplate": "github-releases",

scripts/renovate/update-openshell-sha.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Called by Renovate postUpgradeTasks after an OpenShell version bump.
+#
+# The github-releases datasource can't resolve a digest for OPENSHELL_SHA
+# directly: Renovate's digest lookup compares the new value against raw
+# GitHub tag names (e.g. "v0.0.103"), but extractVersionTemplate strips the
+# "v" prefix from the value tracked in this file (e.g. "0.0.103"), so the
+# comparison never matches. Instead, this script looks up the commit SHA
+# for the release tag directly and patches it in.
+set -euo pipefail
+
+FILE=".github/scripts/openshell-version.sh"
+
+OLD_VERSION=$(git show HEAD:"${FILE}" | grep -oP '^OPENSHELL_VERSION=\K\S+' || true)
+NEW_VERSION=$(grep -oP '^OPENSHELL_VERSION=\K\S+' "${FILE}" || true)
+
+if [[ -z "${NEW_VERSION}" ]]; then
+  echo "error: could not extract OPENSHELL_VERSION from working-tree ${FILE}" >&2
+  exit 1
+fi
+if [[ ! "${NEW_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "error: NEW_VERSION is not a valid semver: ${NEW_VERSION}" >&2
+  exit 1
+fi
+
+if [[ "${OLD_VERSION}" == "${NEW_VERSION}" ]]; then
+  echo "OpenShell version unchanged (${NEW_VERSION}), nothing to do"
+  exit 0
+fi
+
+echo "OpenShell: ${OLD_VERSION:-<none>} -> ${NEW_VERSION}"
+
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "${WORKDIR}"' EXIT
+
+curl -fsSL "https://api.github.com/repos/NVIDIA/OpenShell/commits/v${NEW_VERSION}" \
+  -o "${WORKDIR}/commit.json"
+SHA=$(grep -m1 -oP '"sha":\s*"\K[0-9a-f]{40}' "${WORKDIR}/commit.json" || true)
+
+if [[ ! "${SHA}" =~ ^[0-9a-f]{40}$ ]]; then
+  echo "error: resolved SHA is not a valid 40-char hex commit sha: ${SHA}" >&2
+  exit 1
+fi
+
+sed -i "s/^OPENSHELL_SHA=.*/OPENSHELL_SHA=${SHA}/" "${FILE}"
+
+echo "updated OPENSHELL_SHA to ${SHA} for v${NEW_VERSION}"