From 4d1bd0a7a59c4dfd6a67df49a52a998c7b8b24d0 Mon Sep 17 00:00:00 2001
From: Mads Jon Nielsen <madsjon@gmail.com>
Date: Fri, 31 Jul 2026 08:41:08 +0200
Subject: [PATCH 1/2] fix: pull registry probe image before the timed readiness
 check

The readiness probe's 4s budget also covered the curlimages/curl image
pull, so a cold pull consumed it before the poll could run. Pin the three
images used by the local registry and let renovate track them.
---
 renovate.json |  8 ++++++++
 src/utils.ts  | 13 +++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/renovate.json b/renovate.json
index cf103ee57..3f5143ad1 100644
--- a/renovate.json
+++ b/renovate.json
@@ -9,5 +9,13 @@
       "matchUpdateTypes": ["minor", "patch", "lockFileMaintenance"],
       "groupName": "All non-major"
     }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^src/utils\\.ts$/"],
+      "matchStrings": ["Image: string = \"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""],
+      "datasourceTemplate": "docker"
+    }
   ]
 }
diff --git a/src/utils.ts b/src/utils.ts
index a5950e3a5..05759a0df 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -422,6 +422,9 @@ export class Utils {
     }
 
     static readonly gclRegistryPrefix: string = "registry.gcl.local";
+    static readonly gclRegistryImage: string = "registry:3.1.1";
+    static readonly gclOpensslImage: string = "alpine/openssl:3.5.7";
+    static readonly gclCurlImage: string = "curlimages/curl:8.21.0";
     static async startDockerRegistry (argv: Argv): Promise<void> {
         const gclRegistryCertVol = `${this.gclRegistryPrefix}.certs`;
         const gclRegistryDataVol = `${this.gclRegistryPrefix}.data`;
@@ -446,7 +449,7 @@ export class Utils {
                 "-addext", `subjectAltName=DNS:${this.gclRegistryPrefix}`,
             ];
             const generateCertsInPlace = [
-                argv.containerExecutable, "run", "--rm", "-v", `${gclRegistryCertVol}:/certs`, "--entrypoint", "sh", "alpine/openssl", "-c",
+                argv.containerExecutable, "run", "--rm", "-v", `${gclRegistryCertVol}:/certs`, "--entrypoint", "sh", this.gclOpensslImage, "-c",
                 [
                     "openssl", ...opensslArgs,
                     "&&", "mkdir", "-p", `/certs/${this.gclRegistryPrefix}`,
@@ -481,18 +484,20 @@ export class Utils {
             "-e", "REGISTRY_HTTP_ADDR=0.0.0.0:443",
             "-e", `REGISTRY_HTTP_TLS_CERTIFICATE=/certs/${this.gclRegistryPrefix}.crt`,
             "-e", `REGISTRY_HTTP_TLS_KEY=/certs/${this.gclRegistryPrefix}.key`,
-            "registry",
+            this.gclRegistryImage,
         ]);
 
+        await Utils.spawn([argv.containerExecutable, "pull", this.gclCurlImage]);
+
         try {
             await execa(argv.containerExecutable, [
                 "run", "--rm",
                 "--network", gclRegistryNet,
                 "--entrypoint", "sh",
-                "curlimages/curl",
+                this.gclCurlImage,
                 "-c", `until [ "$(curl -s -o /dev/null -k -w "%{http_code}" https://${this.gclRegistryPrefix}:443)" = "200" ]; do sleep 1; done;`,
             ], {
-                timeout: 4000,
+                timeout: 10000,
             });
         } catch (err) {
             await this.stopDockerRegistry(argv.containerExecutable);

From c4ac83fbac4695edc5476d4c1a649a39bc70c64c Mon Sep 17 00:00:00 2001
From: Mads Jon Nielsen <madsjon@gmail.com>
Date: Fri, 31 Jul 2026 08:51:20 +0200
Subject: [PATCH 2/2] fix: use renovate comments and pull inside the try block

---
 renovate.json | 3 +--
 src/utils.ts  | 6 ++++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/renovate.json b/renovate.json
index 3f5143ad1..b74bba163 100644
--- a/renovate.json
+++ b/renovate.json
@@ -14,8 +14,7 @@
     {
       "customType": "regex",
       "managerFilePatterns": ["/^src/utils\\.ts$/"],
-      "matchStrings": ["Image: string = \"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""],
-      "datasourceTemplate": "docker"
+      "matchStrings": ["// renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+static readonly \\w+: string = \"[^:\"]+:(?<currentValue>[^\"]+)\";"]
     }
   ]
 }
diff --git a/src/utils.ts b/src/utils.ts
index 05759a0df..9adb47ccd 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -422,8 +422,11 @@ export class Utils {
     }
 
     static readonly gclRegistryPrefix: string = "registry.gcl.local";
+    // renovate: datasource=docker depName=registry
     static readonly gclRegistryImage: string = "registry:3.1.1";
+    // renovate: datasource=docker depName=alpine/openssl
     static readonly gclOpensslImage: string = "alpine/openssl:3.5.7";
+    // renovate: datasource=docker depName=curlimages/curl
     static readonly gclCurlImage: string = "curlimages/curl:8.21.0";
     static async startDockerRegistry (argv: Argv): Promise<void> {
         const gclRegistryCertVol = `${this.gclRegistryPrefix}.certs`;
@@ -487,9 +490,8 @@ export class Utils {
             this.gclRegistryImage,
         ]);
 
-        await Utils.spawn([argv.containerExecutable, "pull", this.gclCurlImage]);
-
         try {
+            await Utils.spawn([argv.containerExecutable, "pull", this.gclCurlImage]);
             await execa(argv.containerExecutable, [
                 "run", "--rm",
                 "--network", gclRegistryNet,