minimumReleaseAge for ghcr.io not working

[jlssmt]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitea, Renovate 41.122.0

Please tell us more about your question or problem

Hello,

I don't think the minimumReleaseAge is working for ghcr.io Docker images.
It seems like the API is not providing it: No currentVersionTimestamp for ghcr.io
However, as I could find no discussion on this topic, I have created this one here.

Edit:
I checked it and the API provides the 'created_at' date.

At least on this endpoint:
https://api.github.com/orgs/pocket-id/packages/container/pocket-id/versions

Logs (if relevant)

No response

[RahulGautamSingh]

We only add it if it's provided from the API response. I don't think parsing it from changelogs is a reliable way

[jlssmt]

I checked it and the API provides the 'created_at' date.

At least on this endpoint:
https://api.github.com/orgs/pocket-id/packages/container/pocket-id/versions

[jamietanna]

I've captured #39064 for adding support for release timestamp collection with ghcr.io

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the reproduction in your own repository. Ensure it's actually minimal (no unnecesary dependencies or config), or it will be rejected by maintainers.
5. Install the Renovate app to verify that what you say happens (or doesn't happen) reproduces.
6. Fill out the information in your repository's README.md. What you describe there should reflect what you see in this repo, with the hosted app, and not what you saw in your original repo/environment.
7. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.
8. Add a Discussion comment mentioning that the reproduction repo is now available and linked.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[BacLuc]

I also have the feeling that minimumReleaseAge is ignored.

See the merged PR here:
https://github.com/vshn/kaniko-builder/tree/a39578eb20e2190c7bd86e4519c7fd2fb05e11c7

PR:

• Update ghcr.io/vshn/kaniko:nightly-debug Docker digest to e7c25d6 vshn/kaniko-builder#8
• Update ghcr.io/vshn/kaniko:nightly-debug Docker digest to 33a99a1 vshn/kaniko-builder#7

[BlueIce]

There is now a warning in the logs which supports your feeling. For example when updating renovate itself:

 WARN: 1 release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding (repository=XXXXX/renovate-runner)
       "depName": "ghcr.io/renovatebot/renovate",
       "versions": ["41.152.2"],
       "check": "minimumReleaseAge"
 WARN: 1 upgrade(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding (repository=XXXXX/renovate-runner, branch=renovate/ghcr.io-renovatebot-renovate-41.x)
       "depNames": ["ghcr.io/renovatebot/renovate"]

[jamietanna]

Yes, that's correct - this is understandably surprising behaviour, so we recently added that to make it clearer to folks

In v42 (#38841), the minimumReleaseAgeBehaviour=timestamp-required setting will be enforced, but you can set that now in your configuration

[jamietanna]

Closing this as we've captured the Issue (still to be implemented)