Support release timestamp for digest-only updates

[dmivankov]

Tell us more.

#39781 (reply in thread) mentions there are discussions about it already but couldn't find them so creating a new one.

Short background: if custom datasource is implemented to expose releaseTimestamp for containers digest-only updates (say for specific registry or image) renovate will not pick up that timestamp or age.

The fix potentially is small, something like

diff --git a/lib/workers/repository/process/lookup/index.ts b/lib/workers/repository/process/lookup/index.ts
index 31f0f5044..9ee553336 100644
--- a/lib/workers/repository/process/lookup/index.ts
+++ b/lib/workers/repository/process/lookup/index.ts
@@ -707,9 +707,16 @@ export async function lookupUpdates(
             update.updateType !== 'replacement' ||
             update.newName === config.packageName
           ) {
-            update.newDigest ??= dependency?.releases.find(
+            const releaseForDigest = dependency?.releases.find(
               (r) => r.version === update.newValue,
-            )?.newDigest;
+            );
+            update.newDigest ??= releaseForDigest?.newDigest;
+            if (releaseForDigest?.releaseTimestamp && !update.releaseTimestamp) {
+              update.releaseTimestamp = releaseForDigest.releaseTimestamp;
+              update.newVersionAgeInDays = getElapsedDays(
+                releaseForDigest.releaseTimestamp,
+              );
+            }
           }
 
           update.newDigest ??= await getDigest(

but don't have e2e validation if that'd work yet