Support renovating apk add commands in Dockerfiles

[felixfbecker]

What would you like Renovate to be able to do?
Out builds frequently break because versions get removed from the apk repositories and replaced with newer versions. When using pinned versions in the Dockerfiles (which is a good idea), this causes build failures. It would be nice if Renovate could detect apk add lines in Dockerfiles and proactively open PRs to update.

Describe the solution you'd like
Renovate could use a simple regex match to detect lines with apk add (should work across multiple lines too) in Dockerfiles and shell scripts.

Describe alternatives you've considered
#1938, but that seems up in the air

Additional context
Example PR: https://github.com/sourcegraph/sourcegraph/pull/8342/files

[rarkins]

Looks like the first step is an apk datasource. After that, it would be a good candidate for generic version replacement or a dedicated apk manager.

[rarkins]

Docs on the regex manager just released: https://docs.renovatebot.com/modules/manager/regex/

This now needs an apk datasource added.

[rarkins]

@ppmathis is this also enabled by your repology datasource?

[ppmathis]

This specific issue can indeed be solved by using the new repology datasource. As Alpine unfortunately does not keep old package versions, a Dockerfile with outdated package versions immediately breaks as described by @felixfbecker. I've decided to configure Renovate to group all OS package upgrades together, as this will guarantee that status checks may still pass when multiple dependencies are outdated.

First of all, you have to configure a regex manager to parse version environment variables within your Dockerfile, e.g.:

{
  "regexManagers": [
    {
      "fileMatch": [
        "(^|/)Dockerfile$"
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sENV .*?_VERSION=\"?(?<currentValue>.*?)\"?\\s"
      ],
      "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
    }
  ]
}

Then you may configure a package rule for grouping all OS package upgrades together to avoid CI failure when multiple packages are out of date, as this will allow Renovate to upgrade these dependencies in one shot. Please note that you may have to change/adjust the package patterns based on your needs, as the example would match all dependencies named alpine_3_12/<anything>:

{
  "packageRules": [
    {
      "datasources": [
        "repology"
      ],
      "packagePatterns": [
        "^alpine_3_12/"
      ],
      "separateMajorMinor": false,
      "groupName": "alpine packages",
      "groupSlug": "alpine"
    }
  ]
}

After that has been done, you may start adding environment variables to your Dockerfile which contain the package version and annotate them using comments, which the regex manager will end up parsing:

# renovate: datasource=repology depName=alpine_3_12/py3-virtualenv
ENV PY3_VIRTUALENV_VERSION="16.7.8-r0"
# renovate: datasource=repology depName=alpine_3_12/python3
ENV PYTHON3_VERSION="3.8.2-r0"

The examples above will look for the newest version of py3-virtualenv as well as python3 within the alpine_3_12 repository on Repology, which can be found here. If you want to see a real-life example, you may take a look at this repository.

[viceice]

We should add the grouping info to the docs