tagged github actions, update not detected

[ReenigneArcher]

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us what version of Renovate you run.

No response

If you're self-hosting Renovate, select which platform you are using.

None

Was this something which used to work for you, and then stopped?

I never saw this working

Wanted end result.

I'm still in the onboarding phase on renovate. This is an issue I'd like to resolve before switching from Dependabot.

I have a couple of custom github actions, which are tagged like (v2023.10.23-7bf3fc9). I have since switched the final part of the tag to be an integer. Renovate is not picking up new tags/releases. Everything is tagged in git and published as a release in GitHub.

I'm not sure if Renovate is just not updating detected dependencies on the mend dashboard since I haven't implemented yet.

This is shown in the dashboard, under detected dependencies.

LizardByte/setup-python-action v2023.10.23-7bf3fc9

I have one project where it is actually like this in the workflow file:
uses: LizardByte/setup-python-action@8851ba6849c1003134ced0581b34204f0c322cad

And another where it is like so:
uses: LizardByte/setup-python-action@v2023.10.23-7bf3fc9

These are actually pointing to different versions, but in the dashboards it only shows
LizardByte/setup-python-action v2023.10.23-7bf3fc9

What you tried so far.

I'm not sure what to try. I'd like to keep my actions tagged with actual tags, instead of commits. There are also some other actions which are pinned to a branch (due to how the action's repo is managed).

I have a custom org level renovate config. https://github.com/LizardByte/.github/blob/master/renovate-config.json5

Is there more config options I could apply to get renovate to properly detect updates on GitHub actions?

Relevant debug logs

Logs

The action in question does not appear in the logs...

[rarkins]

Please look for the packageFiles with updates log message and locate the entry for this dependency and paste it here

[ReenigneArcher]

Shows up here though:

[rarkins]

If you configure ignoreUnstable=false for this repo then it may work. In semver these tags are unstable versions so you will be telling renovate that it's ok to upgrade to new unstable versions

[ReenigneArcher]

Can I do that only for GitHub actions? And preferably only for ones that start with LizardByte/?

[rarkins]

Yes, packageRules

[ReenigneArcher]

Not sure if I missed something, but it didn't seem to make a difference.

https://github.com/LizardByte/.github/pull/290/files

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Renovate app (GitHub):

1. Go to the affected PR, and search for "View repository job log here"
2. Select the link to go to the "Mend Renovate Dashboard" and log in
3. You are now in the correct repository log overview screen
4. Copy/paste the correct log
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

If you're running self-hosted, run with LOG_LEVEL=debug in your environment variables and search for whatever dependency/branch/PR that is causing the problem.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

Good luck,

The Renovate team

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this.

To get started, please read our guide on creating a minimal reproduction.

We may close the discussion if you, or someone else, haven't created a minimal reproduction within two weeks. If you need more time, or are stuck, please ask for help or more time in a comment.

Good luck,

The Renovate team

[rarkins]

Needs a public reproduction repo in order to assist any further

[ReenigneArcher]

Here's a minimal repo.

https://github.com/ReenigneArcher/renovate-github-action-issue

[ReenigneArcher]

I'm happy to provide or adjust anything else.

This issue is actually the main reason I was trying to use renovate to begin with. dependabot/dependabot-core#7232

I notice that the datasource is github-tags for github-actions. If this could use github-releases as a datasource, I think it would probably solve my problem, as these are always published to GitHub releases, and tagged as the latest release.

Either way, I appreciate you taking the time to look at this.

[rarkins]

Please see LizardByte/.github#291 - I think this should work and that ignoreUnstable=false is not needed

I had assumed before that semver versioning was used, but it turns out it's using docker versioning (long story but in short it allows for the common "short" patterns of 3, 3.1, etc. The thing about docker versioning is that it enforces the suffix part for compatibility, e.g. to make sure you upgrade from ..-alpine to ..-alpine and never ..-debian or with no suffix at all. In your case that means it was enforcing that no update is allowed unless the sha matches, and it never would.

Using loose versioning simply means it's going to sort the tags from left to right including numbers when it finds numbers. As you're no doubt aware, SHA's are not sortable, but the reality is that Renovate doesn't know how to sort your SHAs anyway even if it knew they are SHAs and not random characters. If you publish two tags in the same day then Renovate has a 50/50 chance of sorting them correctly, but I don't think there's realistically anything better we can do

[ReenigneArcher]

I have since updated the short sha to an integer of hhmmss so they will be sortable going forward. I will give your changes a try. Thank you!

[ReenigneArcher]

It works in the reproduction repo! https://github.com/ReenigneArcher/renovate-github-action-issue/pull/2

Can't get it to update in the currently onboarding repos, but I suppose that's a different issue.

I really appreciate the support, I think I can safely enable renovate now, disabling dependabot!