Make it possible to provide changelog URLs using Docker image metadata

[jamietanna]

Tell us more.

For instance, when using a Docker image (with no tag) but that uses org.opencontainers.image.revision, it would be useful to be able to generate a changelog such as

renovatebot/renovate-approve-bot@1fe9bce...74da5cf

From a Docker image such as:

% docker inspect ghcr.io/renovatebot/renovate-approve-bot:main@sha256:67d6ddbc0f0cef9315d437d5a8b5990fe6fa8a2bdd92919d80b09f2dac0846b7
[
    {
        "Id": "sha256:67d6ddbc0f0cef9315d437d5a8b5990fe6fa8a2bdd92919d80b09f2dac0846b7",
        "RepoTags": [
            "ghcr.io/renovatebot/renovate-approve-bot@sha256:67d6ddbc0f0cef9315d437d5a8b5990fe6fa8a2bdd92919d80b09f2dac0846b7"
        ],
        "RepoDigests": [
            "ghcr.io/renovatebot/renovate-approve-bot@sha256:67d6ddbc0f0cef9315d437d5a8b5990fe6fa8a2bdd92919d80b09f2dac0846b7"
        ],
        "Parent": "",
        "Comment": "buildkit.dockerfile.v0",
        "Created": "2026-03-03T03:33:41.447026264Z",
        "DockerVersion": "",
        "Author": "",
        "Architecture": "arm64",
        "Os": "linux",
        "Size": 84330451,
        "GraphDriver": {
            "Data": null,
            "Name": "overlayfs"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:45f3ea5848e8a25ca27718b640a21ffd8c8745d342a24e1d4ddfc8c449b0a724",
                "sha256:d1f0f94caddc73ee3f4ec71f66bbd38883accf50eb17f8048cb1b76cec70ac88",
                "sha256:227d4d4410e6287774ee28119fc54b182e8901bbf89d4e96b16832bee6c6bc3e",
                "sha256:a1ed66ff2ba014b6b3b9cdf0e6c15d88ba542309cdcad0ce22fba75f7956ef3d",
                "sha256:08e145951f1ca495efe7fab36fefdcf89e9e0290b8952c5d45ac16dd88b0c3c8",
                "sha256:4aaafb0ef910dba83ca7df52e5dd06d73991118e2bccc01afa87f51ce152a2f6",
                "sha256:57c89df9e89ec01e999c8404377f03b7183c534e9b6e088e3141602e7d57d326",
                "sha256:5ebfd435f13092cf9ca8cf9596d756e88e030c6e73581f462bb65df7ba588cb1",
                "sha256:f1d72b4af026b5597cb38ba3de488a519871e7366550cea6858409c6b69b84d4"
            ]
        },
        "Metadata": {
            "LastTagTime": "2026-03-03T11:14:00.268961011Z"
        },
        "Descriptor": {
            "mediaType": "application/vnd.oci.image.index.v1+json",
            "digest": "sha256:67d6ddbc0f0cef9315d437d5a8b5990fe6fa8a2bdd92919d80b09f2dac0846b7",
            "size": 1609
        },
        "Config": {
            "Cmd": null,
            "Entrypoint": [
                "npm",
                "run",
                "start"
            ],
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "NODE_VERSION=20.20.0",
                "YARN_VERSION=1.22.22"
            ],
            "ExposedPorts": {
                "3000/tcp": {}
            },
            "Labels": {
                "maintainer": "Rhys Arkins \u003crhys@arkins.net\u003e",
                "org.opencontainers.image.created": "2026-03-03T03:32:56.181Z",
                "org.opencontainers.image.description": "",
                "org.opencontainers.image.licenses": "ISC",
                "org.opencontainers.image.revision": "74da5cf8a28688f4a909681f098c60e6a48cb514",
                "org.opencontainers.image.source": "https://github.com/renovatebot/renovate-approve-bot",
                "org.opencontainers.image.title": "renovate-approve-bot",
                "org.opencontainers.image.url": "https://github.com/renovatebot/renovate-approve-bot",
                "org.opencontainers.image.version": "main"
            },
            "OnBuild": null,
            "User": "renovate",
            "Volumes": null,
            "WorkingDir": "/opt/app/"
        }
    }
]

[NVolcz]

I’m interested in this as well. I recently reviewed a digest-only Valkey update (a35428eba904 → c9b77919daeb). The Renovate PR description did not explain what changed and I had some free time so I did some research.

If the image had published the relevant org.opencontainers.image.source, org.opencontainers.image.revision, and org.opencontainers.image.version values, Renovate could have presented something like:

Package	Type	Version	Revision	Source changes
valkey/valkey	image	9.1.0 (unchanged)	0b13d7b → 99afc7f	Compare
alpine:3.23	base image	3.23.4 → 3.23.5	c68e084 → 4ad948c	Compare

Renovate could use the source, version, and revision metadata to include the same release notes or source comparison it already generates for other dependencies. When org.opencontainers.image.base.name and org.opencontainers.image.base.digest identify a changed base image, Renovate could resolve its metadata and repeat the changelog lookup recursively.

A related consideration is multi-platform indexes: sometimes the index digest changes even though the platform a consumer uses is unchanged. A platform-level summary could be useful too, although that may be better handled separately.