Flux OCIRepository digest pinning produces unparseable YAML for flow-style (kyaml) manifests

[notpeelz]

How are you running Renovate?

None

Which platform you running Renovate on?

Forgejo

Which version of Renovate are you using?

46.245.0

Please tell us more about your question or problem

When the flux manager has pinDigests: true, digest pinning for OCIRepository tag-only refs produces invalid YAML if the manifest uses flow-style YAML (kyaml).

Given this manifest:

---
{
  apiVersion: "source.toolkit.fluxcd.io/v1",
  kind: "OCIRepository",
  metadata: {
    name: "flux-operator",
  },
  spec: {
    interval: "30m",
    url: "oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator",
    layerSelector: {
      mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip",
      operation: "copy",
    },
    ref: {
      tag: "0.56.0",
    },
  },
}

And this Renovate config:

{
  "packageRules": [
    {
      "matchManagers": ["flux"],
      "pinDigests": true
    }
  ]
}

Logs (if relevant)

Logs

DEBUG: packageFiles with updates (repository=myorg/myrepo, baseBranch=master)
       "config": {
         "flux": [
           {
             "packageFile": "config/flux-system/operator.yaml",
             "deps": [
               {
                 "depName": "ghcr.io/controlplaneio-fluxcd/charts/flux-operator",
                 "packageName": "ghcr.io/controlplaneio-fluxcd/charts/flux-operator",
                 "currentValue": "0.56.0",
                 "datasource": "docker",
                 "replaceString": "tag: \"0.56.0\"",
                 "autoReplaceStringTemplate": "tag: \"{{newValue}}\"{{#if newDigest}}\n      digest: {{newDigest}}{{/if}}",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "0.57.0",
                     "newValue": "0.57.0",
                     "newMajor": 0,
                     "newMinor": 57,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "newDigest": "sha256:35105642acae3aceaf6a22e986653f766827c46e72179a9fec23214ec5f5317c",
                     "branchName": "renovate/ghcr.io-controlplaneio-fluxcd-charts-flux-operator-0.x"
                   },
                   {
                     "isPinDigest": true,
                     "updateType": "pinDigest",
                     "newValue": "0.56.0",
                     "newDigest": "sha256:1eb327c982827714f8849cfca5231aea7c070467b2a3550d7ac3112fab164a3e",
                     "branchName": "renovate/pin-dependencies"
                   }
                 ],
                 "versioning": "docker",
                 "warnings": [],
                 "sourceUrl": "https://github.com/controlplaneio-fluxcd/flux-operator",
                 "registryUrl": "https://ghcr.io",
                 "homepage": "https://fluxoperator.dev",
                 "lookupName": "controlplaneio-fluxcd/charts/flux-operator",
                 "currentVersion": "0.56.0",
                 "isSingleVersion": true,
                 "fixedVersion": "0.56.0"
               }
             ]
           }
         ]
       }

...

DEBUG: Failed to parse YAML file (repository=myorg/myrepo, branch=renovate/pin-dependencies)
DEBUG: Could not extract config/flux-system/operator.yaml (manager=flux) after autoreplace. Did the autoreplace make the file unparseable? (repository=myorg/myrepo, branch=renovate/pin-dependencies)
 WARN: Error updating branch: update failure (repository=myorg/myrepo, branch=renovate/pin-dependencies)