fix: drop container image digest pinning, unify uv version, bump Fedora to 44 (#781)

raballew · web-flow · commit 590da7b4c176 · 2026-06-16T13:20:19.000+02:00
## Summary

### Drop container image digest pinning
- Disable `pinDigests` in Renovate config -- most container registries
prune untagged manifests within weeks, so pinned digests break
reproducibility instead of guaranteeing it and force an unsustainable
biweekly update cycle
- Keep `helpers:pinGitHubActionDigests` for GitHub Action commit-SHA
pinning (those are permanent, not pruned)
- Rename `renovate.json` to `renovate.jsonc` to formally support
comments, add rationale for the `pinDigests` decision

### Unify uv version management
- Add `.uv-version` as single source of truth for the uv toolchain
version
- Dockerfiles install uv via `curl` reading `.uv-version` at build time
-- no hardcoded image tags or `ARG` defaults
- CI workflows read `.uv-version` into a step output and pass it to
`setup-uv`
- E2e scripts (`setup-e2e.sh`, `compat/setup.sh`) pin the curl installer
to `.uv-version`
- Renovate tracks `.uv-version` via a custom regex manager using the
`github-releases` datasource
- Fixes a cross-platform build bug: the old `COPY --from=uv` copied the
build-platform binary into the target-platform product stage

### Bump Fedora 43 to 44
- `python/Dockerfile`, `python/Dockerfile.utils`,
`.github/workflows/build-oci-bundle.yaml`
- `build_fits.sh` podman fallback: replaced hardcoded `fedora:44` with a
`Containerfile` so Renovate's native dockerfile manager tracks it (no
custom regex needed)
diff --git a/.devcontainer/Containerfile b/.devcontainer/Containerfile
@@ -0,0 +1,11 @@
+FROM mcr.microsoft.com/devcontainers/base:2.1.9-bookworm
+
+ENV PYTHONUNBUFFERED=True
+ENV UV_LINK_MODE=copy
+
+WORKDIR /opt
+
+COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv /uvx /bin/
+COPY ./.py-version ./.python-version
+
+RUN apt-get update && apt-get install -y iperf3 libusb-dev
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -2,7 +2,7 @@
 	"name": "uv",
 	"build": {
 		"context": "..",
-		"dockerfile": "Dockerfile"
+		"dockerfile": "Containerfile"
 	},
 	"postCreateCommand": "cd python && make sync",
 	"postStartCommand": "cd python && uv python pin $(cat ../.py-version) && uv run pre-commit install",
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
@@ -32,15 +32,15 @@ jobs:
           # Controller images
           - image_name: jumpstarter-dev/jumpstarter-controller
             label: jumpstarter-controller
-            dockerfile: controller/Dockerfile
+            dockerfile: controller/Containerfile
             context: controller
           - image_name: jumpstarter-dev/jumpstarter-operator
             label: jumpstarter-operator
-            dockerfile: controller/Dockerfile.operator
+            dockerfile: controller/Containerfile.operator
             context: controller
           - image_name: jumpstarter-dev/jumpstarter-operator-bundle
             label: jumpstarter-operator-bundle
-            dockerfile: controller/deploy/operator/bundle.Dockerfile
+            dockerfile: controller/deploy/operator/Containerfile.bundle
             context: controller/deploy/operator
             generate_bundle: true
           - image_name: jumpstarter-dev/microshift/bootc
@@ -50,16 +50,16 @@ jobs:
           # Python images (use repo root context for .git access needed by hatch-vcs)
           - image_name: jumpstarter-dev/jumpstarter
             label: jumpstarter
-            dockerfile: python/Dockerfile
+            dockerfile: python/Containerfile
             context: .
           - image_name: jumpstarter-dev/jumpstarter-utils
             label: jumpstarter-utils
-            dockerfile: python/Dockerfile.utils
+            dockerfile: python/Containerfile.utils
             context: python
           - image_name: jumpstarter-dev/jumpstarter-dev
             label: jumpstarter-dev
             dockerfile: python/.devfile/Containerfile
-            context: python
+            context: .
           - image_name: jumpstarter-dev/jumpstarter-devspace
             label: jumpstarter-devspace
             dockerfile: python/.devfile/Containerfile.client
diff --git a/.github/workflows/build-oci-bundle.yaml b/.github/workflows/build-oci-bundle.yaml
@@ -6,7 +6,7 @@ on:
 jobs:
   build-fits:
     runs-on: ubuntu-24.04-arm
-    container: fedora:43@sha256:762d73ba1c455232b0272c5d445a34f36c4b9f421cbc05ce8102552325b6a222
+    container: registry.fedoraproject.org/fedora:44
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
diff --git a/.github/workflows/documentation.yaml b/.github/workflows/documentation.yaml
@@ -45,10 +45,13 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
+        working-directory: .
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.21"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Setup Pages
@@ -81,10 +84,13 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
+        working-directory: .
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.21"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Verify generated gRPC docs are up to date
@@ -103,10 +109,13 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
+        working-directory: .
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.21"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Check documentation links
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -70,7 +70,7 @@ jobs:
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: /tmp/controller-image.tar
-          key: controller-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Dockerfile', 'controller/go.mod', 'controller/go.sum', 'controller/cmd/**', 'controller/api/**', 'controller/internal/**') }}
+          key: controller-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Containerfile', 'controller/go.mod', 'controller/go.sum', 'controller/cmd/**', 'controller/api/**', 'controller/internal/**') }}
 
       - name: Build controller image
         if: steps.cache.outputs.cache-hit != 'true'
@@ -115,7 +115,7 @@ jobs:
           path: |
             /tmp/operator-image.tar
             /tmp/operator-install.yaml
-          key: operator-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Dockerfile.operator', 'controller/go.mod', 'controller/go.sum', 'controller/deploy/operator/**', 'controller/api/**', 'controller/internal/**') }}
+          key: operator-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Containerfile.operator', 'controller/go.mod', 'controller/go.sum', 'controller/deploy/operator/**', 'controller/api/**', 'controller/internal/**') }}
 
       - name: Build operator image and installer manifest
         if: steps.cache.outputs.cache-hit != 'true'
@@ -144,9 +144,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Cache python wheels
@@ -187,9 +190,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
@@ -245,9 +251,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
@@ -281,9 +290,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -38,7 +38,7 @@ jobs:
               - 'python/**'
               - '.github/workflows/lint.yaml'
             renovate:
-              - 'renovate.json'
+              - 'renovate.jsonc'
               - '.github/workflows/lint.yaml'
 
   lint-go:
@@ -94,10 +94,12 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.21"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Run ty
diff --git a/.github/workflows/python-tests.yaml b/.github/workflows/python-tests.yaml
@@ -53,10 +53,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install the latest version of uv
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
+      - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.21"
+          version: ${{ steps.uv.outputs.version }}
           python-version: ${{ matrix.python-version }}
 
       - name: Install Qemu (Linux)
diff --git a/.uv-version b/.uv-version
@@ -0,0 +1 @@
+0.11.19
diff --git a/controller/Containerfile b/controller/Containerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3@sha256:430cd439ea3bb4af3727a843c0302594bb1973211ecbfc98e4450a40798075df AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 ARG GIT_VERSION=unknown
diff --git a/controller/Containerfile.operator b/controller/Containerfile.operator
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3@sha256:430cd439ea3bb4af3727a843c0302594bb1973211ecbfc98e4450a40798075df AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.26.3 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 ARG GIT_VERSION=unknown
diff --git a/controller/Makefile b/controller/Makefile
@@ -126,7 +126,7 @@ docker-build: ## Build docker image with the manager.
 		--build-arg GIT_VERSION=$(GIT_VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--build-arg BUILD_DATE=$(BUILD_DATE) \
-		-t ${IMG} .
+		-t ${IMG} -f Containerfile .
 
 .PHONY: docker-push
 docker-push: ## Push docker image with the manager.
@@ -141,8 +141,8 @@ docker-push: ## Push docker image with the manager.
 PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
-	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
+	# copy existing Containerfile and insert --platform=${BUILDPLATFORM} into Containerfile.cross, and preserve the original Containerfile
+	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Containerfile > Containerfile.cross
 	- $(CONTAINER_TOOL) buildx create --name jumpstarter-controller-builder
 	$(CONTAINER_TOOL) buildx use jumpstarter-controller-builder
 	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) \
@@ -151,9 +151,9 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
 			--build-arg BUILD_DATE=$(BUILD_DATE) \
 			--tag ${DOCKER_REPO}:${DOCKER_TAG} \
 			--tag ${DOCKER_REPO}:latest \
-			-f Dockerfile.cross .
+			-f Containerfile.cross .
 	- $(CONTAINER_TOOL) buildx rm jumpstarter-controller-builder
-	rm Dockerfile.cross
+	rm Containerfile.cross
 
 .PHONY: build-installer
 build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
diff --git a/controller/deploy/operator/Containerfile.bundle b/controller/deploy/operator/Containerfile.bundle
diff --git a/controller/deploy/operator/Makefile b/controller/deploy/operator/Makefile
@@ -175,7 +175,7 @@ docker-build: ## Build docker image with the manager.
 		--build-arg GIT_VERSION=$(GIT_VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--build-arg BUILD_DATE=$(BUILD_DATE) \
-		-t ${IMG} ../../ -f ../../Dockerfile.operator
+		-t ${IMG} ../../ -f ../../Containerfile.operator
 
 .PHONY: docker-push
 docker-push: ## Push docker image with the manager.
@@ -190,17 +190,17 @@ docker-push: ## Push docker image with the manager.
 PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
-	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' ../../Dockerfile.operator > ../../Dockerfile.operator.cross
+	# copy existing Containerfile and insert --platform=${BUILDPLATFORM} into Containerfile.cross, and preserve the original Containerfile
+	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' ../../Containerfile.operator > ../../Containerfile.operator.cross
 	- $(CONTAINER_TOOL) buildx create --name jumpstarter-operator-builder
 	$(CONTAINER_TOOL) buildx use jumpstarter-operator-builder
 	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) \
 		--build-arg GIT_VERSION=$(GIT_VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--build-arg BUILD_DATE=$(BUILD_DATE) \
-		--tag ${IMG} -f ../../Dockerfile.operator.cross ../../
+		--tag ${IMG} -f ../../Containerfile.operator.cross ../../
 	- $(CONTAINER_TOOL) buildx rm jumpstarter-operator-builder
-	rm ../../Dockerfile.operator.cross
+	rm ../../Containerfile.operator.cross
 
 .PHONY: build-installer
 build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
@@ -347,7 +347,7 @@ contribute: bundle ## Update community-operators repos with the current bundle.
 
 .PHONY: bundle-build
 bundle-build: ## Build the bundle image.
-	$(CONTAINER_TOOL) build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
+	$(CONTAINER_TOOL) build -f Containerfile.bundle -t $(BUNDLE_IMG) .
 
 .PHONY: bundle-push
 bundle-push: ## Push the bundle image.
diff --git a/e2e/compat/setup.sh b/e2e/compat/setup.sh
@@ -58,10 +58,12 @@ install_dependencies() {
 
     if ! command -v uv &> /dev/null; then
         log_info "Installing uv..."
-        curl -LsSf https://astral.sh/uv/install.sh | sh
+        grep -qxE '[0-9]+\.[0-9]+\.[0-9]+' "$REPO_ROOT/.uv-version" || { log_error "Invalid .uv-version"; exit 1; }
+        curl -LsSf "https://astral.sh/uv/$(cat "$REPO_ROOT/.uv-version")/install.sh" | sh
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
 
+    grep -qxE '[0-9]+\.[0-9]+' "$REPO_ROOT/.py-version" || { log_error "Invalid .py-version"; exit 1; }
     PY_VERSION="$(cat "$REPO_ROOT/.py-version")"
     log_info "Installing Python ${PY_VERSION}..."
     uv python install "$PY_VERSION"
diff --git a/e2e/setup-e2e.sh b/e2e/setup-e2e.sh
@@ -43,10 +43,12 @@ install_dependencies() {
     # Install uv if not already installed
     if ! command -v uv &> /dev/null; then
         log_info "Installing uv..."
-        curl -LsSf https://astral.sh/uv/install.sh | sh
+        grep -qxE '[0-9]+\.[0-9]+\.[0-9]+' "$REPO_ROOT/.uv-version" || { log_error "Invalid .uv-version"; exit 1; }
+        curl -LsSf "https://astral.sh/uv/$(cat "$REPO_ROOT/.uv-version")/install.sh" | sh
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
-    
+
+    grep -qxE '[0-9]+\.[0-9]+' "$REPO_ROOT/.py-version" || { log_error "Invalid .py-version"; exit 1; }
     PY_VERSION="$(cat "$REPO_ROOT/.py-version")"
     log_info "Installing Python ${PY_VERSION}..."
     uv python install "$PY_VERSION"
diff --git a/python/.devfile/Containerfile b/python/.devfile/Containerfile
@@ -8,14 +8,15 @@ LABEL summary="devfile jumpstarter developer image"
 LABEL description="Image with developers tools."
 LABEL io.k8s.display-name="jumpstarter-developer-universal"
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv  /bin/uv
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uvx /bin/uvx
-
 USER root
 
-RUN dnf -y install make git python3.12 libusbx python3-pyusb golang podman && dnf clean all
+COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv /uvx /bin/
+
+COPY .py-version /tmp/.py-version
+RUN grep -qxE '[0-9]+\.[0-9]+' /tmp/.py-version && \
+    PY=$(cat /tmp/.py-version) && \
+    dnf -y install make git "python${PY}" libusbx python3-pyusb golang podman && dnf clean all
 
 USER 10001
 
-# This will make sure that we always run python from our venv instead
 RUN echo "alias python='uv run python'" >> /home/user/.bashrc
diff --git a/python/.devfile/Containerfile.client b/python/.devfile/Containerfile.client
diff --git a/python/Containerfile b/python/Containerfile
diff --git a/python/Containerfile.utils b/python/Containerfile.utils
diff --git a/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/Containerfile b/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/Containerfile
diff --git a/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh b/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh
diff --git a/renovate.jsonc b/renovate.jsonc
