Renovate tries to pin digests for OCI Helm charts - FluxCD

[mcsrobert]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

I think I'm having a similar issue in FluxCD as has been reported and fixed with ArgoCD here: #26948.

During my research I found that this has been encountered before here: #28134. The author concluded:

It appears that HelmRepository instances which are OCI images are marked to have digests attached and they can’t. Needed to turn digest pinning off for them.

I was able to find his fix: https://github.com/szinn/k8s-homelab/blob/45abefaa29b52ecac8125e9e65a15c6d8ef20464/.renovate/packageRules.json5#L23

E.g. for OCIRepository Helm charts:

• app-template
• cloudnative-pg

This also happens for HelmRepository with type: oci:

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: dragonfly-operator
  namespace: flux-system
spec:
  interval: 1h
  type: oci
  url: oci://ghcr.io/dragonflydb/dragonfly-operator/helm

Is this a bug?

Logs (if relevant)

Logs

WARN: Error updating branch: update failure

[RahulGautamSingh]

I am not familiar with the datasource but it seems like enabling digests for them is not good. @viceice wdyt?

[viceice]

makes sense to disable digests for oci charts. pay attention flux has also helm values which ca use real docker images, so the argocd fix isn't working here