Run the docker-compose version tagging update manually instead of using Dependabot (#8506)

## Summary of changes

- Dependabot sucks
- I guess we'll do it ourselves

## Reason for change

tl;dr; [Dependabot continues to be terrible at its
job](https://github.com/DataDog/dd-trace-dotnet/actions/runs/24776168750/job/72494856573#step:3:1525)

<details><summary>🤖 explanation</summary>
<p>

```
 Root cause

  The dependabot job fails on the first image it checks (dotnet/aspnet 2.1-stretch-slim) with DockerRegistry2::NotFound — Image not found at mcr.microsoft.com, and because the whole group shares a single job, one failure kills the run.

  The actual HTTP call that 404s (from the proxy log):

  HEAD https://mcr.microsoft.com/v2/dotnet/aspnet/blobs/sha256:80ddf066edeeb7e489b23c3c90d8e5dd741037d4a4875150c1dec777fd24cc76
  → 404

  That digest is the one we pinned in smoke-test-images.docker-compose.yml:15. I verified against MCR:

  ┌───────────────────────────────────────────────────┬────────────────────────────────────┐
  │                     Endpoint                      │               Result               │
  ├───────────────────────────────────────────────────┼────────────────────────────────────┤
  │ HEAD /v2/dotnet/aspnet/manifests/sha256:80ddf066… │ 200 (it's a valid manifest digest) │
  ├───────────────────────────────────────────────────┼────────────────────────────────────┤
  │ HEAD /v2/dotnet/aspnet/blobs/sha256:80ddf066…     │ 404                                │
  └───────────────────────────────────────────────────┴────────────────────────────────────┘

  So the digest is fine — the problem is Dependabot is querying the wrong endpoint for it.

  Why Dependabot does this

  The stack trace leads to apply_cooldown → publication_detail → get_tag_publication_details (docker/update_checker.rb:346 → 362 → 380). That method:

  1. Calls client.digest(repo, tag) which does a HEAD /manifests/<tag> and returns the Docker-Content-Digest header — that's the manifest digest.
  2. Then does client.dohead "v2/#{repo}/blobs/#{digest}" and reads Last-Modified from the response to know when the image was published (so it can apply the 2-day cooldown).

  Step 2 assumes the manifest digest is also accessible via the /blobs/ endpoint. MCR doesn't do that cross-storage, so every cooldown lookup 404s. The docker-compose ecosystem is the only one of ours where we enabled cooldown and target
  MCR, so it's the only one this surfaces on. This is a bug in dependabot-core's Docker update checker, not in our config per se.
```

</p>
</details> 

We could either remove the cool down (not acceptable) or we could try to
fix the bug in dependabot (not worth the hassle), or we can just do it
ourselves (what I settled on)

## Implementation details

Told 🤖 to "implement it properly" and it did a good enough job 😄 It
handles getting an anonymous token for the docker hub registry and
managing the cool down, but there _is_ a possibility that we could hit
rate limits. For now I'm inclined to just "meh" over it, as these
_should_ be very rare, because most of the requests don't count towards
it, and it shouldn't be an issue for mcr.

One slight issue is the way the tagging works we can't get "all the
recent new images", so that we can update to the latest image _outside_
the cooldown. We get the latest, see if it's in the cooldown, and if
not, don't update. In the pathological case, we could end up never
updating. In practice, that shouldn't be an issue for the images we're
using

## Test coverage

We can't actually test this properly until it's merged, but I ran a test
locally, and it output the following (abbreviated)

```
╬════════════════════════════════
║ UpdateSmokeTestImageDigests
╬═══════════════════════
​
09:46:16 [INF] ────────────────────────────────────────────────────────────
09:46:16 [INF] Updating pinned digests in C:\repos\dd-trace-dotnet-5\tracer\build\_build\SmokeTests\smoke-test-images.docker-compose.yml
09:46:16 [INF] ────────────────────────────────────────────────────────────
09:46:16 [INF] Found 96 pinned images to evaluate
09:46:16 [DBG] Evaluating mcr.microsoft.com/dotnet/aspnet:2.1-alpine3.12
09:46:16 [INF] Unchanged mcr.microsoft.com/dotnet/aspnet:2.1-alpine3.12 (digest 43ff07984cea)
09:46:16 [DBG] Evaluating mcr.microsoft.com/dotnet/aspnet:2.1-stretch-slim
...
09:46:33 [DBG] Evaluating andrewlock/dotnet-ubuntu:25.04-9.0
09:46:33 [INF] Unchanged andrewlock/dotnet-ubuntu:25.04-9.0 (digest 0e5c1ae3e68d)
09:46:33 [INF] Rewrote C:\repos\dd-trace-dotnet-5\tracer\build\_build\SmokeTests\smoke-test-images.docker-compose.yml with 10 digest update(s)
09:46:33 [INF] Summary - updated: 10, cooldown: 8, unchanged: 78, failed: 0
09:46:33 [INF] Image digest cooldown report saved to C:\repos\dd-trace-dotnet-5\.nuke\temp\smoke_test_image_cooldown_report.md
​
╬══════════════════════
║ Errors & Warnings
╬═════════════
​
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:8.0-bookworm-slim: new digest f88c77644f4c is only 28h old (< 48h cooldown); keeping current pin f24d74e8185b
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim: new digest 4e07e00025f1 is only 28h old (< 48h cooldown); keeping current pin d6c93f1bd94f
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-noble: new digest 55e37c7795bf is only 41h old (< 48h cooldown); keeping current pin ccdca44cd4f2
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled: new digest f43461f1774d is only 41h old (< 48h cooldown); keeping current pin 1191b4891ae8
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-composite: new digest a6fe6804ff21 is only 41h old (< 48h cooldown); keeping current pin 168f51340812
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-windowsservercore-ltsc2022: new digest 17c963b25ddb is only 41h old (< 48h cooldown); keeping current pin 31eccd550269
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/sdk:9.0-bookworm-slim: new digest f9ddb8a31ae9 is only 28h old (< 48h cooldown); keeping current pin dbbdd47fae7a
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/sdk:10.0-noble: new digest 8a90a473da52 is only 41h old (< 48h cooldown); keeping current pin f061e5a7532b
```

And seems to work 🤞 

## Other details

I'd _like_ to update the pipeline to always run _all_ smoke tests for
these PRs, but I'll move that to a separate PR so as not to block this,
as might require some faffing

https://datadoghq.atlassian.net/browse/APMLP-1282

Author: andrewlock

.github/chainguard/self.auto_bump_smoke_test_docker_images.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: repo:DataDog/dd-trace-dotnet:.*
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-dotnet/\.github/workflows/auto_bump_smoke_test_docker_images\.yml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write

.github/dependabot.yml

@@ -102,21 +102,6 @@ updates:
     cooldown:
       default-days: 2
 
-  # Docker images used in smoke tests - Dependabot updates pinned digests
-  - package-ecosystem: "docker-compose"
-    directory: "/tracer/build/_build/SmokeTests"
-    schedule:
-      interval: "weekly"
-    labels:
-      - "dependencies"
-      - "area:dependabot"
-    groups:
-      smoke-test-images:
-        patterns:
-          - "*"
-    cooldown:
-      default-days: 2
-
   - package-ecosystem: "github-actions"
     directories:
       - "/"

.github/workflows/auto_bump_smoke_test_docker_images.yml

@@ -0,0 +1,77 @@
+name: Auto bump smoke test docker images
+
+on:
+  schedule:
+    - cron: "0 0 * * 1" # Every Monday at midnight
+    - cron: "0 0 * * 4" # Every Thursday at midnight
+  workflow_dispatch:
+
+jobs:
+  bump_smoke_test_docker_images:
+    runs-on: windows-latest
+    permissions:
+      actions: read # read secrets
+      id-token: write # Required for dd-octo-sts authentication
+
+    steps:
+      - name: Support longpaths
+        run: git config --system core.longpaths true
+
+      - name: Get dd-octo-sts token
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-dotnet
+          policy: self.auto_bump_smoke_test_docker_images.create-pr
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        with:
+          global-json-file: global.json
+
+      - name: "Regenerating docker image versions"
+        run: .\tracer\build.ps1 UpdateSmokeTestImageDigests --PackageVersionCooldownDays 2
+
+      - name: Read cooldown report
+        id: cooldown
+        if: always()
+        shell: pwsh
+        run: |
+          $report = ""
+          $reportPath = ".nuke/temp/smoke_test_image_cooldown_report.md"
+          if (Test-Path $reportPath) {
+            $report = Get-Content $reportPath -Raw
+          }
+          "report<<EOF" >> $env:GITHUB_OUTPUT
+          $report >> $env:GITHUB_OUTPUT
+          "EOF" >> $env:GITHUB_OUTPUT
+
+      - name: Create Pull Request
+        id: pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.octo-sts.outputs.token }}
+          branch: "bot/smoke-test-docker-image-bump"
+          commit-message: "[Smoke Test Docker Image Bump]"
+          delete-branch: true
+          base: master
+          title: "[Smoke Test Docker Image Bump] Updating docker image tags "
+          labels: "area:dependabot,area:test-apps,dependencies"
+          body: |
+            Updates the docker images used for smoke tests.
+
+            ${{ steps.cooldown.outputs.report }}
+
+      - name: Send Slack notification about generating failure
+        if: failure()
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        with:
+          # This data can be any valid JSON from a previous step in the GitHub Action
+          payload: |
+            {
+              "github_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBOOK_URL_GENERATEPACKAGEVERSIONS }}

tracer/build/_build/Build.SmokeTests.cs

@@ -1,3 +1,4 @@
+using System;
 using Nuke.Common;
 using static Nuke.Common.IO.FileSystemTasks;
 using Logger = Serilog.Log;
@@ -25,4 +26,18 @@ await SmokeTests.SmokeTestRunner.RunSmokeTestAsync(
                 Version,
                 GetDotnetSdkVersion(RootDirectory));
         });
+
+    Target UpdateSmokeTestImageDigests => _ => _
+        .Description("Queries each registry and updates pinned sha256 digests in smoke-test-images.docker-compose.yml, respecting a 2-day cooldown")
+        .Unlisted()
+        .Executes(async () =>
+        {
+            var composeFile = TracerDirectory / "build" / "_build" / "SmokeTests" / "smoke-test-images.docker-compose.yml";
+            var reportPath = TemporaryDirectory / "smoke_test_image_cooldown_report.md";
+            var cooldown = PackageVersionCooldownDays.HasValue
+                             ? TimeSpan.FromDays(PackageVersionCooldownDays.Value)
+                             : TimeSpan.FromDays(0);
+            using var updater = new SmokeTests.SmokeTestImageDigestUpdater(cooldown);
+            await updater.UpdateAsync(composeFile, reportPath);
+        });
 }

tracer/build/_build/SmokeTests/CooldownReport.cs

@@ -0,0 +1,142 @@
+// <copyright file="CooldownReport.cs" company="Datadog">
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc.
+// </copyright>
+
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SmokeTests;
+
+/// <summary>
+/// Collects smoke-test image digests that were skipped by the cooldown filter
+/// and renders them as a markdown report for inclusion in the PR body.
+/// </summary>
+public class CooldownReport
+{
+    readonly TimeSpan _cooldown;
+    readonly List<CooldownEntry> _cooldownEntries = new();
+    readonly List<FailureEntry> _failureEntries = new();
+
+    public CooldownReport(TimeSpan cooldown)
+    {
+        _cooldown = cooldown;
+    }
+
+    public bool HasEntries => _cooldownEntries.Count > 0 || _failureEntries.Count > 0;
+
+    public IReadOnlyList<CooldownEntry> Entries => _cooldownEntries;
+
+    public IReadOnlyList<FailureEntry> Failures => _failureEntries;
+
+    public void Add(CooldownEntry entry)
+    {
+        _cooldownEntries.Add(entry);
+    }
+
+    public void AddFailure(FailureEntry entry)
+    {
+        _failureEntries.Add(entry);
+    }
+
+    public string ToMarkdown()
+    {
+        if (!HasEntries)
+        {
+            return string.Empty;
+        }
+
+        var sb = new StringBuilder();
+
+        if (_cooldownEntries.Count > 0)
+        {
+            sb.AppendLine("## Smoke Test Image Digest Cooldown Report");
+            sb.AppendLine();
+            sb.AppendLine($"The following images have newer digests available but were published less than **{(int)_cooldown.TotalDays} day(s)** ago, so the existing pin is retained.");
+            sb.AppendLine("They will be picked up automatically by a future run once they age out of the cooldown window.");
+            sb.AppendLine();
+            sb.AppendLine("| Image | Current pinned | Available digest | Published | Age |");
+            sb.AppendLine("|-------|----------------|------------------|-----------|-----|");
+
+            foreach (var entry in _cooldownEntries)
+            {
+                var published = entry.PublishedDate?.UtcDateTime.ToString("yyyy-MM-dd") ?? "unknown";
+                var age = entry.PublishedDate.HasValue
+                    ? FormatAge(DateTimeOffset.UtcNow - entry.PublishedDate.Value)
+                    : "?";
+
+                sb.AppendLine($"| `{entry.Image}` | `{Shorten(entry.CurrentDigest)}` | `{Shorten(entry.AvailableDigest)}` | {published} | {age} |");
+            }
+        }
+
+        if (_failureEntries.Count > 0)
+        {
+            if (_cooldownEntries.Count > 0)
+            {
+                sb.AppendLine();
+            }
+            sb.AppendLine("## Smoke Test Image Digest Failures");
+            sb.AppendLine();
+            sb.AppendLine("The following images could not be evaluated this run. The existing pin has been kept. Investigate before the next scheduled run if these persist.");
+            sb.AppendLine();
+            sb.AppendLine("| Image | Error |");
+            sb.AppendLine("|-------|-------|");
+
+            foreach (var entry in _failureEntries)
+            {
+                sb.AppendLine($"| `{entry.Image}` | {EscapeTableCell(entry.ErrorMessage)} |");
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    public async Task SaveToFile(string path)
+    {
+        var markdown = ToMarkdown();
+        if (!string.IsNullOrEmpty(markdown))
+        {
+            // Saved to disk so it can later be fed into the PR description of the automation workflow.
+            await File.WriteAllTextAsync(path, markdown);
+        }
+    }
+
+    static string EscapeTableCell(string value)
+    {
+        // Collapse newlines and escape the pipe so a single error string can't blow up the table.
+        return value
+            .Replace("\r", " ")
+            .Replace("\n", " ")
+            .Replace("|", "\\|");
+    }
+
+    static string FormatAge(TimeSpan age)
+    {
+        if (age.TotalDays >= 1)
+        {
+            return $"{(int)age.TotalDays}d";
+        }
+        return $"{(int)age.TotalHours}h";
+    }
+
+    static string Shorten(string digest)
+    {
+        var colon = digest.IndexOf(':');
+        var hex = colon >= 0 ? digest[(colon + 1)..] : digest;
+        return hex.Length > 12 ? hex.Substring(0, 12) : hex;
+    }
+
+    public record CooldownEntry(
+        string Image,
+        string CurrentDigest,
+        string AvailableDigest,
+        DateTimeOffset? PublishedDate);
+
+    public record FailureEntry(
+        string Image,
+        string ErrorMessage);
+}