Flux OCIRepository digest pinning produces unparseable YAML for flow-style (kyaml) manifests

[notpeelz]

How are you running Renovate?

None

Which platform you running Renovate on?

Forgejo

Which version of Renovate are you using?

46.245.0

Please tell us more about your question or problem

When the flux manager has pinDigests: true, digest pinning for OCIRepository tag-only refs produces invalid YAML if the manifest uses flow-style YAML (kyaml).

Given this manifest:

---
{
  apiVersion: "source.toolkit.fluxcd.io/v1",
  kind: "OCIRepository",
  metadata: {
    name: "flux-operator",
  },
  spec: {
    interval: "30m",
    url: "oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator",
    layerSelector: {
      mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip",
      operation: "copy",
    },
    ref: {
      tag: "0.56.0",
    },
  },
}

And this Renovate config:

{
  "packageRules": [
    {
      "matchManagers": ["flux"],
      "pinDigests": true
    }
  ]
}

Logs (if relevant)

Logs

DEBUG: packageFiles with updates (repository=myorg/myrepo, baseBranch=master)
       "config": {
         "flux": [
           {
             "packageFile": "config/flux-system/operator.yaml",
             "deps": [
               {
                 "depName": "ghcr.io/controlplaneio-fluxcd/charts/flux-operator",
                 "packageName": "ghcr.io/controlplaneio-fluxcd/charts/flux-operator",
                 "currentValue": "0.56.0",
                 "datasource": "docker",
                 "replaceString": "tag: \"0.56.0\"",
                 "autoReplaceStringTemplate": "tag: \"{{newValue}}\"{{#if newDigest}}\n      digest: {{newDigest}}{{/if}}",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "0.57.0",
                     "newValue": "0.57.0",
                     "newMajor": 0,
                     "newMinor": 57,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "newDigest": "sha256:35105642acae3aceaf6a22e986653f766827c46e72179a9fec23214ec5f5317c",
                     "branchName": "renovate/ghcr.io-controlplaneio-fluxcd-charts-flux-operator-0.x"
                   },
                   {
                     "isPinDigest": true,
                     "updateType": "pinDigest",
                     "newValue": "0.56.0",
                     "newDigest": "sha256:1eb327c982827714f8849cfca5231aea7c070467b2a3550d7ac3112fab164a3e",
                     "branchName": "renovate/pin-dependencies"
                   }
                 ],
                 "versioning": "docker",
                 "warnings": [],
                 "sourceUrl": "https://github.com/controlplaneio-fluxcd/flux-operator",
                 "registryUrl": "https://ghcr.io",
                 "homepage": "https://fluxoperator.dev",
                 "lookupName": "controlplaneio-fluxcd/charts/flux-operator",
                 "currentVersion": "0.56.0",
                 "isSingleVersion": true,
                 "fixedVersion": "0.56.0"
               }
             ]
           }
         ]
       }

...

DEBUG: Failed to parse YAML file (repository=myorg/myrepo, branch=renovate/pin-dependencies)
DEBUG: Could not extract config/flux-system/operator.yaml (manager=flux) after autoreplace. Did the autoreplace make the file unparseable? (repository=myorg/myrepo, branch=renovate/pin-dependencies)
 WARN: Error updating branch: update failure (repository=myorg/myrepo, branch=renovate/pin-dependencies)

[vshulcz]

Reproduced with a flow-style manifest and pinDigests: true. The template Renovate builds for a tag-only OCIRepository is block style, no matter how the manifest is written:

"replaceString": "tag: \"0.56.0\"",
"autoReplaceStringTemplate": "tag: \"{{newValue}}\"{{#if newDigest}}\n      digest: {{newDigest}}{{/if}}"

That comes from the tag-only branch in lib/modules/manager/flux/extract.ts, which appends a newline, the detected indentation, and digest: .... In a flow mapping the result is:

    ref: {
      tag: "0.58.0"
      digest: sha256:1ccf038123198fab1923b3fc4977154bd4cc3729f4c7d957dedf09478d9d19d5,
    },

which fails to parse (while parsing a flow mapping), since the comma after tag is gone and the digest is unquoted.

The branch above it, for manifests that already carry both tag and digest, behaves differently: it derives replaceString from the actual bytes in the file and only swaps the two values. Same manifest with a placeholder digest added gives:

"replaceString": "tag: \"0.56.0\",\n      digest: \"sha256:0000...0000\"",
"autoReplaceStringTemplate": "tag: \"{{newValue}}\",\n      digest: \"{{newDigest}}\""

Comma kept, quotes kept, flow style survives.

So as a workaround you can seed the digest by hand once:

    ref: {
      tag: "0.56.0",
      digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    },

Renovate will replace both on the next run and the file stays valid. Note this needs the real digest eventually, a zero placeholder is only there to get the manifest onto the tag+digest code path.

The tag-only path building YAML by string concatenation looks like a genuine bug for flow-style manifests, so it is probably worth an issue rather than a config change.