fix: drop container image digest pinning and bump Fedora to 44

Most container registries prune untagged manifests within weeks, so
pinned digests break reproducibility instead of guaranteeing it and
force an unsustainable biweekly update cycle. Disable pinDigests in
Renovate while keeping GitHub Action commit-SHA pinning via
helpers:pinGitHubActionDigests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: raballew

.github/workflows/build-oci-bundle.yaml

@@ -6,7 +6,7 @@ on:
 jobs:
   build-fits:
     runs-on: ubuntu-24.04-arm
-    container: fedora:43
+    container: fedora:44
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

python/Dockerfile

@@ -1,12 +1,12 @@
 FROM --platform=$BUILDPLATFORM ghcr.io/astral-sh/uv:0.11.19 AS uv
 
-FROM --platform=$BUILDPLATFORM fedora:43 AS builder
+FROM --platform=$BUILDPLATFORM fedora:44 AS builder
 RUN dnf install -y make git && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 COPY --from=uv /uv /uvx /bin/
 
-FROM fedora:43 AS product
+FROM fedora:44 AS product
 RUN dnf install -y python3 ustreamer libusb1 android-tools python3-libgpiod curl \
     nftables dnsmasq iproute procps-ng tcpdump && \
     dnf clean all && \

python/Dockerfile.utils

@@ -1,4 +1,4 @@
-FROM fedora:43
+FROM fedora:44
 RUN dnf install -y kubernetes-client easy-rsa trurl && \
     dnf clean all && \
     rm -rf /var/cache/dnf

python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh

@@ -4,7 +4,7 @@ cd "$(dirname "$0")"
 
 # run only in a container
 if [[ -z "$container" && ! -f /.dockerenv ]]; then
-    exec podman run --rm -it -v $(pwd):/host:Z -w /host fedora:43 "$0" "$@"
+    exec podman run --rm -it -v $(pwd):/host:Z -w /host fedora:44 "$0" "$@"
 else
 	set -euo pipefail
 	BUILDROOT_DIR="/var/tmp/buildroot"

renovate.json

@@ -4,7 +4,12 @@
     "config:recommended",
     "helpers:pinGitHubActionDigests"
   ],
-  "pinDigests": true,
+  // Most container registries prune untagged manifests within weeks, so
+  // pinned digests break reproducibility instead of guaranteeing it and
+  // force an unsustainable biweekly update cycle. Keep tag-based version
+  // pinning only; GitHub Action commit-SHA pinning is handled separately
+  // by helpers:pinGitHubActionDigests and is unaffected.
+  "pinDigests": false,
   "timezone": "Etc/UTC",
   "schedule": [
     "before 5am on monday"
@@ -42,6 +47,18 @@
       "depNameTemplate": "python",
       "datasourceTemplate": "python-version",
       "versioningTemplate": "pep440"
+    },
+    {
+      "description": "Track Fedora container image in build_fits.sh podman fallback",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "**/build_fits.sh"
+      ],
+      "matchStrings": [
+        "podman run[^\\n]+fedora:(?<currentValue>[^\\s\"]+)"
+      ],
+      "depNameTemplate": "fedora",
+      "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
@@ -163,6 +180,17 @@
       ],
       "automerge": false
     },
+    {
+      "description": "Group build_fits.sh Fedora image with Docker base images",
+      "groupName": "docker-base-images",
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDepNames": [
+        "fedora"
+      ],
+      "automerge": false
+    },
     {
       "description": "Group Python dev tools",
       "groupName": "python-dev-tools",