docker:pinDigests fails when Dockerfile starts with a comment (Parser directive)

[cykl]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab 37.256.2

Please tell us more about your question or problem

Given following source Dockerfile and docker:pinDigests is enabled.

#syntax=docker/dockerfile:1.2
FROM registry/my-image:my-tag

Renovate will open a merge request with the following change

#syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc
FROM registry/my-image:my-tag

The pinned digest should have been applied to the FROM statement, not the first line.

Logs (if relevant)

No response

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

To get started, please read our guide on creating a minimal reproduction.

Good luck,

The Renovate team

[devurandom]

I also have a Dockerfile that starts with:

# syntax=docker/dockerfile:1

Renovate (the GitHub App) tries to add a @sha256:... content address to it.

Dockerfile parser directives are described in:

• https://docs.docker.com/reference/dockerfile/#syntax

With more documentation relating to the syntax parser directive in:

• https://docs.docker.com/build/concepts/dockerfile/#dockerfile-syntax
• https://docs.docker.com/build/buildkit/frontend/#dockerfile-frontend

This is the relevant part of our renovate.json:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "docker:pinDigests"
  ]
}

See-also: #22804