fix: track shared scanner images with Renovate - #7
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
The Renovate custom manager uses managerFilePatterns with a /.../-delimited pattern, which may prevent Renovate from matching scan.yml and undermine the PR’s goal.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds Renovate configuration to the shared scanner workflow so Renovate can track (and propose updates for) scanner Docker images that are currently referenced inside docker run shell commands.
Changes:
- Added
renovate.jsonextending the org preset and introducing a regex-based custom manager for scanner images. - Updated
.github/workflows/scan.ymlto include:tag@sha256:...image references for the four scanners. - Documented the Renovate behavior and intent in
README.md.
File summaries
| File | Description |
|---|---|
| renovate.json | Introduces Renovate preset + regex custom manager for extracting scanner image tags/digests from scan.yml. |
| .github/workflows/scan.yml | Adds explicit tags alongside existing pinned digests so Renovate can extract versions for scanner images. |
| README.md | Documents Renovate tracking for scanner images in the shared scan workflow. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| docker run --rm --network none -v "$PWD:/repo:ro" \ | ||
| zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \ | ||
| detect --source /repo --redact --no-banner --log-level error # v8.30.1 | ||
| zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \ | ||
| detect --source /repo --redact --no-banner --log-level error |
| "managerFilePatterns": [ | ||
| "/^\\.github/workflows/scan\\.yml$/" | ||
| ], |
| Renovate uses the shared organization preset and tracks the four scanner image | ||
| tags and digests in `scan.yml`. Digest-only updates remain manual under that | ||
| preset. Image tags provide update metadata; execution remains pinned by digest. |
Problem
The shared scanner workflow has no Renovate configuration, and its four Docker image references inside shell commands are not extracted by the built-in GitHub Actions manager.
Solution
Use the organization preset and a narrow custom manager for scanner image tags and digests. Add each image's existing tag beside its unchanged digest, preserving the executed images and invocation flags. Digest-only updates retain the preset's manual merge policy.
Proof
All four registry tags resolve to the existing pinned digests. Renovate 44.65.5's actual extractor returns exactly the expected four image names, versions and digests, and rejects unrelated images and malformed digests. Config validation passed with its native RE2 module unavailable (RegExp fallback). The forced local actionlint/zizmor gate passed; local zizmor ran offline.