fix: drop container image digest pinning and bump Fedora to 44

raballew · claude · raballew · commit 2599a040f567 · 2026-06-09T17:12:51.000+02:00
Most container registries prune untagged manifests within weeks, so
pinned digests break reproducibility instead of guaranteeing it and
force an unsustainable biweekly update cycle. Disable pinDigests in
Renovate while keeping GitHub Action commit-SHA pinning via
helpers:pinGitHubActionDigests.

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -5,9 +5,10 @@ ENV UV_LINK_MODE=copy
 
 WORKDIR /opt
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv  /bin/uv
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uvx /bin/uvx
+COPY .uv-version /tmp/.uv-version
+RUN curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx
 COPY ./.py-version ./.python-version
 
 # Install required tools for development
-RUN apt-get update && apt-get install -y iperf3 libusb-dev
+RUN apt-get update && apt-get install -y iperf3 libusb-dev
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
@@ -59,7 +59,7 @@ jobs:
           - image_name: jumpstarter-dev/jumpstarter-dev
             label: jumpstarter-dev
             dockerfile: python/.devfile/Containerfile
-            context: python
+            context: .
           - image_name: jumpstarter-dev/jumpstarter-devspace
             label: jumpstarter-devspace
             dockerfile: python/.devfile/Containerfile.client
diff --git a/.github/workflows/build-oci-bundle.yaml b/.github/workflows/build-oci-bundle.yaml
@@ -6,7 +6,7 @@ on:
 jobs:
   build-fits:
     runs-on: ubuntu-24.04-arm
-    container: fedora:43
+    container: fedora:44
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
diff --git a/.github/workflows/documentation.yaml b/.github/workflows/documentation.yaml
@@ -45,10 +45,12 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.6"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Setup Pages
@@ -81,10 +83,12 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.6"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Verify generated gRPC docs are up to date
@@ -103,10 +107,12 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.6"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Check documentation links
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -144,9 +144,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Cache python wheels
@@ -187,9 +190,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
@@ -245,9 +251,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
@@ -281,9 +290,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -38,7 +38,7 @@ jobs:
               - 'python/**'
               - '.github/workflows/lint.yaml'
             renovate:
-              - 'renovate.json'
+              - 'renovate.jsonc'
               - '.github/workflows/lint.yaml'
 
   lint-go:
@@ -94,10 +94,12 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.19"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Run ty
diff --git a/.github/workflows/python-tests.yaml b/.github/workflows/python-tests.yaml
@@ -53,10 +53,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install the latest version of uv
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
+      - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.19"
+          version: ${{ steps.uv.outputs.version }}
           python-version: ${{ matrix.python-version }}
 
       - name: Install Qemu (Linux)
diff --git a/.uv-version b/.uv-version
@@ -0,0 +1 @@
+0.11.19
diff --git a/e2e/compat/setup.sh b/e2e/compat/setup.sh
@@ -58,7 +58,7 @@ install_dependencies() {
 
     if ! command -v uv &> /dev/null; then
         log_info "Installing uv..."
-        curl -LsSf https://astral.sh/uv/install.sh | sh
+        curl -LsSf "https://astral.sh/uv/$(cat "$REPO_ROOT/.uv-version")/install.sh" | sh
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
 
diff --git a/e2e/setup-e2e.sh b/e2e/setup-e2e.sh
@@ -43,7 +43,7 @@ install_dependencies() {
     # Install uv if not already installed
     if ! command -v uv &> /dev/null; then
         log_info "Installing uv..."
-        curl -LsSf https://astral.sh/uv/install.sh | sh
+        curl -LsSf "https://astral.sh/uv/$(cat "$REPO_ROOT/.uv-version")/install.sh" | sh
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
     
diff --git a/python/.devfile/Containerfile b/python/.devfile/Containerfile
@@ -8,8 +8,9 @@ LABEL summary="devfile jumpstarter developer image"
 LABEL description="Image with developers tools."
 LABEL io.k8s.display-name="jumpstarter-developer-universal"
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv  /bin/uv
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uvx /bin/uvx
+COPY .uv-version /tmp/.uv-version
+RUN curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx
 
 USER root
 
diff --git a/python/.devfile/Containerfile.client b/python/.devfile/Containerfile.client
@@ -1,10 +1,10 @@
-FROM --platform=$BUILDPLATFORM ghcr.io/astral-sh/uv:0.11.19 AS uv
-
 FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/ubi:9.5 AS builder
-RUN dnf install -y make git && \
+COPY .uv-version /tmp/.uv-version
+RUN dnf install -y make git curl && \
+    curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx && \
     dnf clean all && \
     rm -rf /var/cache/dnf
-COPY --from=uv /uv /uvx /bin/
 ADD . /src
 RUN make -C /src/python build
 
@@ -41,4 +41,3 @@ RUN mkdir -p /home/user/.config/jumpstarter/clients
 RUN chown 10001:0 -R /home/user/{.config,.local,.cache} && chmod g+rwx -R /home/user/{.config,.local,.cache}
 
 USER 10001
-
diff --git a/python/Dockerfile b/python/Dockerfile
@@ -1,17 +1,19 @@
-FROM --platform=$BUILDPLATFORM ghcr.io/astral-sh/uv:0.11.19 AS uv
-
-FROM --platform=$BUILDPLATFORM fedora:43 AS builder
+FROM --platform=$BUILDPLATFORM fedora:44 AS builder
+COPY .uv-version /tmp/.uv-version
 RUN dnf install -y make git && \
+    curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx && \
     dnf clean all && \
     rm -rf /var/cache/dnf
-COPY --from=uv /uv /uvx /bin/
 
-FROM fedora:43 AS product
+FROM fedora:44 AS product
+COPY .uv-version /tmp/.uv-version
 RUN dnf install -y python3 ustreamer libusb1 android-tools python3-libgpiod curl \
     nftables dnsmasq iproute procps-ng tcpdump && \
+    curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx && \
     dnf clean all && \
     rm -rf /var/cache/dnf
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv /uvx /bin/
 
 ARG FLS_VERSION=0.2.0
 RUN ARCH=$(uname -m) && \
diff --git a/python/Dockerfile.utils b/python/Dockerfile.utils
@@ -1,4 +1,4 @@
-FROM fedora:43
+FROM fedora:44
 RUN dnf install -y kubernetes-client easy-rsa trurl && \
     dnf clean all && \
     rm -rf /var/cache/dnf
diff --git a/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh b/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh
@@ -4,7 +4,8 @@ cd "$(dirname "$0")"
 
 # run only in a container
 if [[ -z "$container" && ! -f /.dockerenv ]]; then
-    exec podman run --rm -it -v $(pwd):/host:Z -w /host fedora:43 "$0" "$@"
+    # renovate: datasource=docker depName=fedora
+    exec podman run --rm -it -v $(pwd):/host:Z -w /host fedora:44 "$0" "$@"
 else
 	set -euo pipefail
 	BUILDROOT_DIR="/var/tmp/buildroot"
diff --git a/renovate.jsonc b/renovate.jsonc
@@ -4,7 +4,12 @@
     "config:recommended",
     "helpers:pinGitHubActionDigests"
   ],
-  "pinDigests": true,
+  // Most container registries prune untagged manifests within weeks, so
+  // pinned digests break reproducibility instead of guaranteeing it and
+  // force an unsustainable biweekly update cycle. Keep tag-based version
+  // pinning only; GitHub Action commit-SHA pinning is handled separately
+  // by helpers:pinGitHubActionDigests and is unaffected.
+  "pinDigests": false,
   "timezone": "Etc/UTC",
   "schedule": [
     "before 5am on monday"
@@ -42,6 +47,28 @@
       "depNameTemplate": "python",
       "datasourceTemplate": "python-version",
       "versioningTemplate": "pep440"
+    },
+    {
+      "description": "Track annotated dependencies in shell scripts (image:tag after renovate comment)",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "**/*.sh"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)\\n[^\\n]*\\s[^\\s:]+:(?<currentValue>\\d[^\\s\"]*)"
+      ]
+    },
+    {
+      "description": "Track .uv-version for uv toolchain pinning",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/(^|/)\\.uv-version$/"
+      ],
+      "matchStrings": [
+        "(?<currentValue>\\d+\\.\\d+\\.\\d+)\\n"
+      ],
+      "depNameTemplate": "astral-sh/uv",
+      "datasourceTemplate": "github-releases"
     }
   ],
   "packageRules": [
@@ -163,6 +190,17 @@
       ],
       "automerge": false
     },
+    {
+      "description": "Group Fedora images from shell scripts with Docker base images",
+      "groupName": "docker-base-images",
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDepNames": [
+        "fedora"
+      ],
+      "automerge": false
+    },
     {
       "description": "Group Python dev tools",
       "groupName": "python-dev-tools",
