fix(renovate-changesets): prevent hex digest digits from being extracted as version numbers

[Copilot]

• Understand the issue and identify root cause
• Fix VERSION_PATTERN approach — move (?!\w) out of the shared constant and apply it only to the two update ... to V patterns in TEXT_PATTERNS where the version sits at the end of the regex (avoiding false positives from digest hashes like 6a454fe)
• Fix formatVersionText in summary-helpers.ts — omit redundant (N) when newVersion is a bare major digit
• Add regression tests for digest-only PR title parsing
• Fix lint errors (regexp/no-useless-assertions — lookahead was always-true in middle-of-regex contexts)
• Build dist/ for the renovate-changesets action
• Create changeset for renovate-changesets package (patch)

[marcusrbrown]

@copilot ALWAYS run quality checks before pushing up code. Fix the linter errors.

[Copilot]

@copilot ALWAYS run quality checks before pushing up code. Fix the linter errors.

Fixed in f1e62be. The (?!\w) was baked into the shared VERSION_PATTERN constant, which caused the lint error because in middle-of-regex contexts (e.g. bump ... from V \s+to\s+ V) the lookahead is already guaranteed to pass. Moved it out of the constant and applied it only to the two update ... to V patterns where the version is at the end of the regex — the only positions where the assertion is non-trivial and actually rejects leading hex digits from digest hashes.

[fro-bot]

Verdict: PASS

Clean, well-scoped bug fix that prevents hex digest leading digits from being falsely extracted as version numbers in Docker digest-only Renovate PRs.

Blocking issues

None

Non-blocking concerns

• renovate-parser.test.ts:554 — Placeholder issue URL https://github.com/bfra-me/.github/issues/XXXX in the regression test comment. Consider linking to the actual issue or removing the reference.

Missing tests

None — the three added tests provide solid coverage:

1. Bare hex digest (6a454fe) correctly rejected as version
2. sha256: prefixed digest correctly yields no version
3. Regression guard confirming v4 major-only versions still parse correctly

Risk assessment: LOW

• The (?!\w) negative lookahead is narrowly applied only to the two update ... to VERSION patterns where the version sits at regex end, which is exactly where digest-hash false positives occur.
• The bump ... from V to V and (V → V) patterns are unaffected (correctly so — their paired structure already prevents this class of false positive).
• The formatVersionText fix for to v4 (4) → to v4 is a clean deduplication of display logic with no risk to other version formats.
• dist/index.js changes match the source edits exactly.
• Changeset correctly targets renovate-changesets with patch bump.

---

Run Summary

Field	Value
Event	pull_request
Repository	bfra-me/.github
Run ID	24325784560
Cache	hit
Session	ses_27ae21f33ffegGQMWmfOa7nD36