Renovate upgrading Temurin Docker image to non-LTS version

[dankress]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Azure DevOps with Renovate 38.18.17

Please tell us more about your question or problem

Renovate tries to update the Eclipse Temurin docker image to version 22-jre-jammy for both Gradle and Maven. We don't want this behavior since that version is not LTS.

This repo's renovate.json5 extends from our repo where renovate is run from

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["local>OTIC-2340_MFB/renovate"]
}

In the Renovate repo is a default.json which looks like this:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "osvVulnerabilityAlerts": true,
  "updateLockFiles": true,
  "extends": [
    "config:best-practices",
    ":semanticPrefixFixDepsChoreOthers",
    "group:monorepos",
    "group:recommended",
    "replacements:all",
    "workarounds:all",
    "security:openssf-scorecard"
  ],
  "ignoreDeps": [],
  "packageRules": [
    {
      "description": "Trigger breaking release for major updates",
      "matchUpdateTypes": ["major"],
      "semanticCommitType": "feat",
      "commitMessageSuffix": "BREAKING CHANGE: Major update"
    },
    {
      "description": "Automatically merge minor updates without notifying anyone",
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "automerge": true,
      "automergeType": "branch"
    }
  ],
  "baseBranches": ["master"]
}

The workflow yaml looks like this:

trigger: none
  
schedules:
  - cron: "0 2 * * 1-5" # at 2am Mon-Fri
    branches:
      include:
        - master
    always: true
    batch: true


pool:
  name: vm-name
  demands: 
  - docker

jobs:
  - job: check_and_update_dependencies
    displayName: Check and Update Dependencies
    steps:
    - task: AzureKeyVault@1
      inputs:
        azureSubscription: '$(serviceConnectionName)'
        KeyVaultName: '$(keyVaultName)'
        SecretsFilter: '*'
        RunAsPreJob: true
    - script: "docker login -u $(serviceAccountHarbor) -p $(sa-prod) $(harborServerName)"
      displayName: log into image registry
    - script: "docker build -t renovate-local ."
      displayName: Build Renovate
    - script: >
        docker run --rm -e RENOVATE_TOKEN="$SYSTEM_ACCESSTOKEN"
        -e SERVICEACCOUNTHARBOR="$(serviceAccountHarbor)"
        -e SERVICEPASSWORDHARBOR="$(sa-prod)"
        -e LOGIN_USERNAME="$(TechnicalUserName)"
        -e LOGIN_PASSWORD="$(TechnicalUserPassword)"
        -e LOG_LEVEL="debug"
        -v './config.js:/usr/src/app/config.js'
        renovate-local
      displayName: Run Renovate
      env:
        SYSTEM_ACCESSTOKEN: $(system.accesstoken)

I expected Renovate to not try to upgrade to Temurin 22 with the Java LTS workaround. Is there an error in my configuration? Thanks in advance!

Logs (if relevant)

Logs

DEBUG: getLabels(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, latest) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, latest, get) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, sha256:ff770fdb023e381d20c962331137e199006ef97028003770d50b825ff2cc6c40, get) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: found labels in manifest (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
       "labels": {
         "org.opencontainers.image.ref.name": "ubuntu",
         "org.opencontainers.image.version": "24.04"
       }
DEBUG: getDigest(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 22-jdk-jammy) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getDigest(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 22-jre-jammy) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, sha256:7b9c017c1c7272e8768a59422a7c37a9c870c9eae9926f715d4278bc5c3c3b9d, head) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, sha256:870aae69d4521fdaf26e952f8026f75b37cb721e6302d4d4d7100f6b09823057, head) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 22-jre-jammy, head) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 22-jdk-jammy, head) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: Got docker digest sha256:bbfa10d59f7b90568aa19a935b6112554798261b13e915cbb06e990ea7322c36 (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getDigest(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 21-jre-jammy) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 21-jre-jammy, head) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: Got docker digest sha256:aa5d66004611f64f47891a7c5ab34edd6eac75b05b8a1f484b45928118a4f3eb (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getDigest(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 21-jdk-jammy) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getManifestResponse(https://company_container_registry_harbor.com, dockerhub/library/eclipse-temurin, 21-jdk-jammy, head) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: Got docker digest sha256:870aae69d4521fdaf26e952f8026f75b37cb721e6302d4d4d7100f6b09823057 (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: Got docker digest sha256:7b9c017c1c7272e8768a59422a7c37a9c870c9eae9926f715d4278bc5c3c3b9d (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: PackageFiles.add() - Package file saved for base branch (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: Package releases lookups complete (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: branchifyUpgrades (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: detectSemanticCommits() (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: getCommitMessages (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: semanticCommits: detected "angular" (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: semanticCommits: enabled (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: 2 flattened updates found: company_container_registry_harbor/dockerhub/library/eclipse-temurin, company_container_registry_harbor/dockerhub/library/eclipse-temurin (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: Returning 1 branch(es) (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: config.repoIsOnboarded=true (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
DEBUG: packageFiles with updates (repository=OTIC-2340_MFB/devops-template-gradle, baseBranch=master)
       "config": {
         "dockerfile": [
           {
             "deps": [
               {
                 "depName": "company_container_registry_harbor/dockerhub/library/eclipse-temurin",
                 "currentValue": "21-jdk-jammy",
                 "currentDigest": "sha256:7b9c017c1c7272e8768a59422a7c37a9c870c9eae9926f715d4278bc5c3c3b9d",
                 "replaceString": "company_container_registry_harbor/dockerhub/library/eclipse-temurin:21-jdk-jammy@sha256:7b9c017c1c7272e8768a59422a7c37a9c870c9eae9926f715d4278bc5c3c3b9d",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "depType": "stage",
                 "updates": [
                   {
                     "bucket": "major",
                     "newVersion": "22",
                     "newValue": "22-jdk-jammy",
                     "newMajor": 22,
                     "newMinor": null,
                     "newPatch": null,
                     "updateType": "major",
                     "newDigest": "sha256:aa5d66004611f64f47891a7c5ab34edd6eac75b05b8a1f484b45928118a4f3eb",
                     "branchName": "renovate/company_container_registry_harbor-dockerhub-library-eclipse-temurin-22.x"
                   }
                 ],
                 "packageName": "company_container_registry_harbor/dockerhub/library/eclipse-temurin",
                 "versioning": "docker",
                 "warnings": [],
                 "registryUrl": "https://company_container_registry_harbor.com",
                 "lookupName": "dockerhub/library/eclipse-temurin",
                 "currentVersion": "21",
                 "isSingleVersion": true,
                 "fixedVersion": "21-jdk-jammy"
               },
               {
                 "depName": "company_container_registry_harbor/dockerhub/library/eclipse-temurin",
                 "currentValue": "21-jre-jammy",
                 "currentDigest": "sha256:870aae69d4521fdaf26e952f8026f75b37cb721e6302d4d4d7100f6b09823057",
                 "replaceString": "company_container_registry_harbor/dockerhub/library/eclipse-temurin:21-jre-jammy@sha256:870aae69d4521fdaf26e952f8026f75b37cb721e6302d4d4d7100f6b09823057",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "depType": "final",
                 "updates": [
                   {
                     "bucket": "major",
                     "newVersion": "22",
                     "newValue": "22-jre-jammy",
                     "newMajor": 22,
                     "newMinor": null,
                     "newPatch": null,
                     "updateType": "major",
                     "newDigest": "sha256:bbfa10d59f7b90568aa19a935b6112554798261b13e915cbb06e990ea7322c36",
                     "branchName": "renovate/company_container_registry_harbor-dockerhub-library-eclipse-temurin-22.x"
                   }
                 ],
                 "packageName": "company_container_registry_harbor/dockerhub/library/eclipse-temurin",
                 "versioning": "docker",
                 "warnings": [],
                 "registryUrl": "https://company_container_registry_harbor.com",

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

Good luck,

The Renovate team

[dankress]

Minimal reproduction can be found here

[rarkins]

That config isn't minimal