fix: drop container image digest pinning, unify uv version, bump Fedora to 44

[raballew]

Summary

Drop container image digest pinning

• Disable pinDigests in Renovate config -- most container registries prune untagged manifests within weeks, so pinned digests break reproducibility instead of guaranteeing it and force an unsustainable biweekly update cycle
• Keep helpers:pinGitHubActionDigests for GitHub Action commit-SHA pinning (those are permanent, not pruned)
• Rename renovate.json to renovate.jsonc to formally support comments, add rationale for the pinDigests decision

Unify uv version management

• Add .uv-version as single source of truth for the uv toolchain version
• Dockerfiles install uv via curl reading .uv-version at build time -- no hardcoded image tags or ARG defaults
• CI workflows read .uv-version into a step output and pass it to setup-uv
• E2e scripts (setup-e2e.sh, compat/setup.sh) pin the curl installer to .uv-version
• Renovate tracks .uv-version via a custom regex manager using the github-releases datasource
• Fixes a cross-platform build bug: the old COPY --from=uv copied the build-platform binary into the target-platform product stage

Bump Fedora 43 to 44

• python/Dockerfile, python/Dockerfile.utils, .github/workflows/build-oci-bundle.yaml
• build_fits.sh podman fallback: replaced hardcoded fedora:44 with a Containerfile so Renovate's native dockerfile manager tracks it (no custom regex needed)

Test plan

• renovate-config-validator passes
• No @sha256: digest references remain in Dockerfiles, Containerfiles, or CI workflows
• No fedora:43 references remain in tracked files
• No hardcoded ghcr.io/astral-sh/uv: references remain -- all read from .uv-version
• All setup-uv version pins unified at 0.11.19 via .uv-version
• Verify Renovate stops opening digest-pinning PRs after merge
• Verify container image builds succeed

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR upgrades Fedora base images from version 43 to 44 across CI workflows and Dockerfiles, and enhances Renovate to automatically track Fedora updates in shell scripts via a custom regex manager while disabling digest pinning.

Changes

Infrastructure Updates

Layer / File(s)	Summary
Fedora base image upgrade across CI and build containers .github/workflows/build-oci-bundle.yaml, python/Dockerfile, python/Dockerfile.utils, python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh	All container base images are bumped from fedora:43 to fedora:44 in the CI workflow, multi-stage Python build, utilities Dockerfile, and the podman re-exec path in the build script.
Renovate configuration for automated Fedora tracking renovate.jsonc, .github/workflows/lint.yaml	Digest pinning is disabled; a new regex-based custom manager targets shell scripts to parse renovate: directives and extract datasource, depName, and version; a package rule groups Fedora updates from the custom manager into docker-base-images with automerge: false; the lint workflow path filter is updated to trigger on renovate.jsonc.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• jumpstarter-dev/jumpstarter#644: Both PRs modify packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh to update the Fedora container workflow.
• jumpstarter-dev/jumpstarter#577: Both PRs change the Fedora base image tag in Python Dockerfiles to a newer Fedora release.
• jumpstarter-dev/jumpstarter#773: Both PRs modify Renovate configuration to handle Fedora base-image updates via package rules and custom directive parsing.

Suggested reviewers

• bennyz
• kirkbrauer
• mangelajo

Poem

A rabbit hops with glee, preparing for the newest Fedora spree—
From forty-three to forty-four, the containers improve once more! 🐰🐳
Renovate scripts now parse directives true, ensuring updates pull through.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the three main changes: disabling digest pinning, unifying uv version management, and upgrading Fedora from 43 to 44.
Description check	✅ Passed	The pull request description clearly relates to the changeset, describing the removal of container image digest pinning, Fedora version bumps, and uv version management unification.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-oci-bundle.yaml:
- Line 9: The podman fallback image in the script build_fits.sh is still
hardcoded to fedora:43 while the CI workflow uses container: fedora:44; update
the podman run invocation that references "fedora:43" in
python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh
to "fedora:44" (or add a clear comment documenting why 43 must be retained) so
local/manual builds match the CI environment.

In `@python/Dockerfile.utils`:
- Around line 1-4: The Dockerfile is missing a non-root runtime user, leaving
the container running as root; add creation of a dedicated unprivileged user
(e.g., "utils" or "appuser") and group during image build, ensure any
directories the runtime will need (WORKDIR, caches, or installed app
directories) are chowned to that user, and add a USER <username> directive near
the end of the Dockerfile (after installations and ownership changes) so the
container runs unprivileged by default; reference the Dockerfile build steps
that run dnf install and cleanup to locate where to add the user creation,
chown, and USER directives.

In `@renovate.json`:
- Around line 7-12: The file renovate.json contains C-style comments (//) which
break strict JSON parsers; either remove all comments to produce valid JSON
(keeping the "pinDigests": false value intact) or rename the file to
renovate.jsonc and update the workflow's paths-filter entry that currently
references renovate.json so the linter/CI and local Biome will accept JSONC;
ensure any references to helpers:pinGitHubActionDigests remain unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4608b8f3-7c2d-4dce-ae75-84f9b1463619

📥 Commits

Reviewing files that changed from the base of the PR and between 1cebbd0 and 2d68a97.

📒 Files selected for processing (4)

• .github/workflows/build-oci-bundle.yaml
• python/Dockerfile
• python/Dockerfile.utils
• renovate.json

[coderabbitai]

🧹 Nitpick comments (1)

python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh (1)

7-7: ⚡ Quick win

Quote $(pwd) to prevent word splitting.

The Fedora upgrade looks good, but since this line is already being modified, please quote the $(pwd) expansion to prevent word splitting if the path contains spaces.

♻️ Proposed fix

-    exec podman run --rm -it -v $(pwd):/host:Z -w /host fedora:44 "$0" "$@"
+    exec podman run --rm -it -v "$(pwd)":/host:Z -w /host fedora:44 "$0" "$@"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh`
at line 7, The podman invocation in build_fits.sh uses an unquoted command
substitution $(pwd) which can suffer word-splitting for paths with spaces;
update the exec podman run line so the volume mount uses a quoted expansion like
"$(pwd)":/host:Z (i.e., replace $(pwd) with "$(pwd)") to ensure the current
directory is passed as a single argument to -v.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh`:
- Line 7: The podman invocation in build_fits.sh uses an unquoted command
substitution $(pwd) which can suffer word-splitting for paths with spaces;
update the exec podman run line so the volume mount uses a quoted expansion like
"$(pwd)":/host:Z (i.e., replace $(pwd) with "$(pwd)") to ensure the current
directory is passed as a single argument to -v.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 45e433c0-79dd-4015-afd9-7d97c2d0a2bf

📥 Commits

Reviewing files that changed from the base of the PR and between 88d2f41 and 3462daa.

📒 Files selected for processing (5)

• .github/workflows/build-oci-bundle.yaml
• python/Dockerfile
• python/Dockerfile.utils
• python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh
• renovate.json

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/build-oci-bundle.yaml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh`:
- Line 8: The podman bind-mount uses unquoted command substitution which breaks
on paths with spaces; update the exec line in build_fits.sh (the podman run
invocation) to quote the host path or use $PWD so the -v argument is passed as a
single token (e.g., change -v $(pwd):/host:Z to use a quoted or $PWD form) to
avoid word splitting when the working directory contains whitespace.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 46b24725-d323-4c1e-a798-0d2f388f8d9a

📥 Commits

Reviewing files that changed from the base of the PR and between 3462daa and 302501e.

📒 Files selected for processing (6)

• .github/workflows/build-oci-bundle.yaml
• .github/workflows/lint.yaml
• python/Dockerfile
• python/Dockerfile.utils
• python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh
• renovate.json5

✅ Files skipped from review due to trivial changes (1)

• .github/workflows/build-oci-bundle.yaml

[kirkbrauer]

Added a comment, overall, I think this looks good, switching to the Containerfile is nice, agnostic, and Red Hat friendly ;)

[mangelajo]

The renovate config looks good, but this didn't pin back for some reason.

[mangelajo]

based on our conversation renovate will update those pinnings on a 2nd pass once the json is merged to main.