Recipe: support digest pinning at upgrade-time #916

2026-08-28T17:26:47Z

sixsmith commented

2026-08-28 17:26:47 +00:00

This change adds a --pindigests flag to abra recipe upgrade. The recipe maintainer still chooses a tagged container version that is semver-like, but abra will write the tag+multiplatform digest to compose.yml.

TODO

add unit tests

This change adds a `--pindigests` flag to `abra recipe upgrade`. The recipe maintainer still chooses a tagged container version that is semver-like, but abra will write the tag+multiplatform digest to `compose.yml`. TODO - [ ] add unit tests

🚀 1

sixsmith commented

2026-08-28 17:44:23 +00:00

Fixes #892

sixsmith added 5 commits 2026-09-10 04:14:19 +00:00

add docs and test 91fe901264

add regclient to fetch image manifest/digest 7932356746

* also run `go mod vendor`

add --pindigests flag 92bab8637d

* handle digests for the recipe subcommand
* add make parameter to pass args

run make-i18n 39050a85ef

add lint rule for images with digest 0f7d991709

sixsmith force-pushed main from 1f8b51ab40 to 0f7d991709

2026-09-10 04:14:19 +00:00

Compare

sixsmith marked the pull request as ready for review 2026-09-10 04:16:27 +00:00

decentral1se commented

2026-09-29 07:42:04 +00:00

Just to get it into the issue also:

thanks! flying by review: can you add some integration tests also? i see you covered the upgrade path, but not the standard deploy and also rollback/downgrade? those should all have a working integration test imho

Just to get it into the issue also: > thanks! flying by review: can you add some integration tests also? i see you covered the upgrade path, but not the standard deploy and also rollback/downgrade? those should all have a working integration test imho

sixsmith added 1 commit 2026-10-10 01:52:02 +00:00

update digest pinning work eaec0cc733

- formatter.RemoveSha
- make pindigests TRUE by default
- more strict matching of digests
- unit and integration tests

sixsmith added 1 commit 2026-10-10 01:56:13 +00:00

Merge remote-tracking branch 'toolshed/main' d8742e728c

sixsmith added 1 commit 2026-10-10 01:59:09 +00:00

revert Makefile change, moved to another CL 455b5fef21

sixsmith added 1 commit 2026-10-10 05:23:58 +00:00

itest: use annotated tags 4b6e42171c

p4u1 commented

2026-10-10 09:21:04 +00:00

Will this still work with renovate? Also how will abra recipe upgrade behave with digests regarding versioning?

sixsmith commented

2026-10-11 22:26:03 +00:00

@p4u1 Yes, it should work with renovate. By default it'll attempt to add pins, the user can disable if they want with --pindigests=false. abra recipe upgrade/release should use the version before @, so semver basically. There isn't a test for releasing though, I'll add one.

@p4u1 Yes, it should work with renovate. By default it'll attempt to add pins, the user can disable if they want with `--pindigests=false`. `abra recipe upgrade/release` should use the version before `@`, so semver basically. There isn't a test for releasing though, I'll add one.

sixsmith commented

2026-10-12 04:26:11 +00:00

On second thought, recipe_release.bats should cover the release path since those tests run an upgrade first - and --pindigests is true by default on those upgrades.

On second thought, `recipe_release.bats` should cover the release path since those tests run an upgrade first - and `--pindigests` is true by default on those upgrades.

sixsmith added 1 commit 2026-10-17 01:29:15 +00:00

Merge remote-tracking branch 'toolshed/main' 1855ffcecf

devydave reviewed

2026-10-18 11:01:55 +00:00

cli/recipe/release.go

						
				@@ -333,4 +336,3 @@

						var tag string

						switch img.(type) {

						case reference.NamedTagged:

devydave commented

2026-10-18 09:17:29 +00:00

remove the empty switch case

cli/recipe/upgrade.go

						
				@@ -295,2 +302,3 @@

							if upgradeTag != "skip" {

								ok, err := recipe.UpdateTag(image, upgradeTag)

								var resolvedDigest string

								if shouldPin(service.Image, internal.PinDigests) {

devydave commented

2026-10-18 09:37:06 +00:00

the logs and function calls in the file diverge, the logs use the variable image in most cases and shouldPin checks service.Image, maybe you can generalize that. If that does not work it would be nice to document why service.Image is used.

pkg/client/registry.go

						
				@@ -9,6 +9,8 @@ import (

					"github.com/containers/image/docker"

					"github.com/containers/image/types"

					"github.com/distribution/reference"

					"github.com/regclient/regclient"

devydave commented

2026-10-18 10:57:52 +00:00

Is there a way to have the same logic without a new dependency?

pkg/formatter/formatter.go

						
				@@ -40,2 +42,4 @@

				}

				// GetTagAndDigest returns the tag and any digest for comparison and display.

				func GetTagAndDigest(image reference.Named) string {

devydave commented

2026-10-18 09:40:00 +00:00

More of a nit pick, but I would rename it to GetTagWithDigest because it only returns only one variable

pkg/recipe/compose.go

						
				@@ -170,0 +190,4 @@

								// Don't confuse digests if the image isn't an exact match. E.g. if old is postgres:13, don't

								// match postgres:13-alpine

								pattern := regexp.MustCompile(`(?m)(^\s*image:\s*["']?)` + regexp.QuoteMeta(old) + `(["']?\s*(?:#.*)?$)`)