Found during the CI/CD audit (#42).
renovate.json's custom regex manager updates the version variable in a BuildStream element (for example just_version in elements/lab-runner/just.bst), but it cannot update the sibling ref: sha256 that pins the downloaded artefact. Any such bump therefore produces a PR that either fails to fetch (hash mismatch) or, worse, is merged and breaks a build lane.
Until #42 there was no PR build to catch it, and non-major bumps were set to auto-merge.
Options to evaluate:
- a Renovate
postUpgradeTasks step running just bst source track <element> and committing the refreshed ref
- a scheduled
track-bst-sources workflow like projectbluefin/dakota has
- dropping the sha256 pin for these sources (not preferred: it is the supply-chain guarantee)
Affects elements/lab-runner/{just,kubectl,argo}.bst.
Found during the CI/CD audit (#42).
renovate.json's custom regex manager updates the version variable in a BuildStream element (for examplejust_versioninelements/lab-runner/just.bst), but it cannot update the siblingref:sha256 that pins the downloaded artefact. Any such bump therefore produces a PR that either fails to fetch (hash mismatch) or, worse, is merged and breaks a build lane.Until #42 there was no PR build to catch it, and non-major bumps were set to auto-merge.
Options to evaluate:
postUpgradeTasksstep runningjust bst source track <element>and committing the refreshed reftrack-bst-sourcesworkflow likeprojectbluefin/dakotahasAffects
elements/lab-runner/{just,kubectl,argo}.bst.