apm SHA pins that follow a branch (#<sha> # main) never update

[MPV]

Tell us more.

APM pins a dependency to a commit as owner/repo#<sha>. With pinDigests, the apm manager keeps such a pin current when a trailing comment names a release tag, owner/repo#<sha> # v2.0.0, the way github-actions does for uses: owner/action@<sha> # v4.

Many repositories that publish agent skills have no tags, so a commit is the only reproducible pin and the natural comment is the branch it follows. For example, anthropics/skills has no tags:

dependencies:
  apm:
    - anthropics/skills/skills/doc-coauthoring#b0cbd3df1533b396d281a6886d5132f623393a9c # main

These pins never move. The apm manager looks the dependency up with github-tags. main isn't a version, so lookup skips the releases and asks for the digest of main. github-tags treats that value as a tag (findCommitOfTag), finds no tag named main and returns null. No PR is opened, and the Dependency Dashboard reports a failed lookup.

Minimal reproduction: https://github.com/MPV/renovate-apm-branch-sha-pin. On the Mend app (44.134.1), its Dependency Dashboard shows:

Warning

Renovate failed to look up the following dependencies: Could not determine new digest for update (github-tags package anthropics/skills).

Files affected: apm.yml

Its "Detected Dependencies" section lists the pin with the branch as its version:

• anthropics/skills/skills/doc-coauthoring main@b0cbd3df1533b396d281a6886d5132f623393a9c

github-actions already handles this. When the ref, or the comment of a SHA pin, doesn't look like a version (/^v?\d+/), it uses the github-digest datasource with exact versioning. That datasource returns tags and branches, so uses: owner/action@<sha> # main gets digest updates for the head of main.

Proposal

Do the same in the apm manager. When the ref or the comment of a SHA pin doesn't look like a version, use:

• github-digest with exact versioning on GitHub hosts;
• git-refs on other hosts.

Then #<sha> # main follows the head of main, and with pinDigests a plain #main pin gets pinned to its commit, with the branch kept as the comment.

Without pinDigests, a plain branch pin would get no update, as uses: owner/action@main does. APM's lockfile records its commit, and lock file maintenance moves it.

Questions for maintainers

1. Should the apm manager reuse the github-actions test for "version-like" (/^v?\d+/), or check validity under the default versioning? A tag such as release-2024 would go to github-digest under the first, and stay on github-tags under the second.
2. Should github-tags' getDigest fall back to a branch when no tag matches? That would fix this for every manager using github-tags, but it changes shared behaviour.

[RahulGautamSingh]

Fix pr: #46881