.github/workflows/actionlint.yaml

@@ -11,7 +11,7 @@ jobs:
   actionlint:
     uses: suzuki-shunsuke/actionlint-workflow/.github/workflows/actionlint.yaml@b6a5f966d4504893b2aeb60cf2b0de8946e48504 # v0.5.0
     with:
-      aqua_version: v2.24.0
+      aqua_version: v2.24.1
       aqua_policy_allow: true
     permissions:
       pull-requests: write

.github/workflows/debug-with-action-tmate.yaml

@@ -25,7 +25,7 @@ jobs:
           GITHUB_TOKEN: ${{github.token}}
       - uses: aquaproj/aqua-installer@7c7338067bdb97d5bea2acc82b5870afca470d18 # v2.3.0
         with:
-          aqua_version: v2.24.0
+          aqua_version: v2.24.1
         env:
           AQUA_GITHUB_TOKEN: ${{github.token}}
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0

.github/workflows/release.yaml

@@ -11,7 +11,7 @@ jobs:
       homebrew: true
       go-version: 1.22.1
       aqua_policy_allow: true
-      aqua_version: v2.24.0
+      aqua_version: v2.24.1
       app_token_repositories: >-
         [
           "${{github.event.repository.name}}",

.github/workflows/wc-ghalint.yaml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - uses: aquaproj/aqua-installer@7c7338067bdb97d5bea2acc82b5870afca470d18 # v2.3.0
         with:
-          aqua_version: v2.24.0
+          aqua_version: v2.24.1
         env:
           AQUA_GITHUB_TOKEN: ${{github.token}}
       - run: ghalint run

.github/workflows/wc-go-mod-tidy.yaml

@@ -12,7 +12,7 @@ jobs:
     uses: suzuki-shunsuke/go-mod-tidy-workflow/.github/workflows/go-mod-tidy.yaml@8facac38f5b2008648c14e31c632c3a709439b9c # v0.1.1
     with:
       go-version: 1.22.1
-      aqua_version: v2.24.0
+      aqua_version: v2.24.1
     secrets:
       gh_app_id: ${{secrets.gh_app_id}}
       gh_app_private_key: ${{secrets.gh_app_private_key}}

.github/workflows/wc-update-aqua-checksums.yaml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     with:
-      aqua_version: v2.24.0
+      aqua_version: v2.24.1
       prune: true
     secrets:
       gh_app_id: ${{secrets.gh_app_id}}

Dockerfile-prebuilt

@@ -9,5 +9,5 @@ WORKDIR /home/foo/workspace
 RUN curl -sSfL -O https://raw.githubusercontent.com/aquaproj/aqua-installer/v2.3.0/aqua-installer
 RUN echo "1577b99b74751a5ddeea757198cee3b600fce3ef18990540e4d0e667edcf1b5f  aqua-installer" | sha256sum -c
 RUN chmod +x aqua-installer
-RUN ./aqua-installer -v "v2.24.0"
+RUN ./aqua-installer -v "v2.24.1"
 ENV PATH=/home/foo/.local/share/aquaproj-aqua/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

aqua/aqua-checksums.json

@@ -216,8 +216,8 @@
       "algorithm": "sha256"
     },
     {
-      "id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.152.0/registry.yaml",
-      "checksum": "1F49DF47ABCAFBDC22FC705233525D904281690A60268E12F6C458459C1C19AEAB59A4347D52C92DC7B885567DF2DE2DF0AC69A7891B58D183D9195B90CDF981",
+      "id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.154.0/registry.yaml",
+      "checksum": "8DD34CC8E818D5B85DC29610AB7BCC758A01B269B3B94D6FBEF94F91D0D6D9CCBAE6A71AD06EC58B0EC93144FCD168CDA43CB3C4D5756A89BFA9B1CC7C56040A",
       "algorithm": "sha512"
     }
   ]

aqua/aqua.yaml

@@ -6,6 +6,6 @@ checksum:
   require_checksum: true
 registries:
   - type: standard
-    ref: v4.152.0 # renovate: depName=aquaproj/aqua-registry
+    ref: v4.154.0 # renovate: depName=aquaproj/aqua-registry
 packages:
   - import: imports/*.yaml

aqua/imports/cosign.yaml

@@ -1,2 +1,4 @@
 packages:
   - name: sigstore/cosign@v1.13.2
+    update:
+      enabled: false

json-schema/aqua-yaml.json

@@ -71,6 +71,9 @@
         },
         "link": {
           "type": "string"
+        },
+        "update": {
+          "$ref": "#/$defs/Update"
         }
       },
       "additionalProperties": false,
@@ -130,6 +133,15 @@
         ]
       },
       "type": "array"
+    },
+    "Update": {
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
     }
   }
 }

pkg/config/aqua/config.go

@@ -14,9 +14,30 @@ type Package struct {
 	Tags        []string `yaml:",omitempty" json:"tags,omitempty"`
 	Description string   `yaml:",omitempty" json:"description,omitempty"`
 	Link        string   `yaml:",omitempty" json:"link,omitempty"`
+	Update      *Update  `yaml:",omitempty" json:"update,omitempty"`
 	FilePath    string   `json:"-" yaml:"-"`
 }
 
+type Update struct {
+	// # If enabled is false, aqua up command ignores the package.
+	// If the package name is passed to aqua up command explicitly, enabled is ignored.
+	// By default, enabled is true.
+	Enabled *bool `yaml:",omitempty" json:"enabled,omitempty"`
+	// The condition of allowed version.
+	// expr https://github.com/expr-lang/expr is used.
+	// By default, all versions are allowed.
+	// The version must meet both allowed_version and types.
+	AllowedVersion string `yaml:"allowed_version,omitempty" json:"allowed_version,omitempty"`
+	// The list of allowed update types
+	// By default, all types are allowed.
+	// major, minor, patch, other
+	Types []string `yaml:",omitempty" json:"types,omitempty"`
+}
+
+func (u *Update) GetEnabled() bool {
+	return u == nil || u.Enabled == nil || *u.Enabled
+}
+
 func (p *Package) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	type alias Package
 	a := alias(*p)

pkg/controller/generate-registry/version_overrides.go

@@ -3,12 +3,12 @@ package genrgst
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"sort"
 
 	"github.com/aquaproj/aqua/v2/pkg/config/aqua"
 	"github.com/aquaproj/aqua/v2/pkg/config/registry"
 	"github.com/aquaproj/aqua/v2/pkg/github"
+	"github.com/aquaproj/aqua/v2/pkg/versiongetter"
 	"github.com/hashicorp/go-version"
 	"github.com/sirupsen/logrus"
 	"github.com/suzuki-shunsuke/logrus-error/logerr"
@@ -46,29 +46,12 @@ func listPkgsFromVersions(pkgName string, versions []string) []*aqua.Package {
 	return pkgs
 }
 
-var versionPattern = regexp.MustCompile(`^(.*?)v?((?:\d+)(?:\.\d+)?(?:\.\d+)?(?:(\.|-).+)?)$`)
-
-func GetVersionAndPrefix(tag string) (*version.Version, string, error) {
-	if v, err := version.NewVersion(tag); err == nil {
-		return v, "", nil
-	}
-	a := versionPattern.FindStringSubmatch(tag)
-	if a == nil {
-		return nil, "", nil
-	}
-	v, err := version.NewVersion(a[2])
-	if err != nil {
-		return nil, "", err //nolint:wrapcheck
-	}
-	return v, a[1], nil
-}
-
 func (c *Controller) getPackageInfoWithVersionOverrides(ctx context.Context, logE *logrus.Entry, pkgName string, pkgInfo *registry.PackageInfo, limit int) (*registry.PackageInfo, []string) {
 	ghReleases := c.listReleases(ctx, logE, pkgInfo, limit)
 	releases := make([]*Release, len(ghReleases))
 	for i, release := range ghReleases {
 		tag := release.GetTagName()
-		v, prefix, err := GetVersionAndPrefix(tag)
+		v, prefix, err := versiongetter.GetVersionAndPrefix(tag)
 		if err != nil {
 			logE.WithField("tag_name", tag).WithError(err).Warn("parse a tag as semver")
 		}

pkg/controller/initcmd/init.go

@@ -49,7 +49,7 @@ func (c *Controller) Init(ctx context.Context, cfgFilePath string, logE *logrus.
 		return nil
 	}
 
-	registryVersion := "v4.152.0" // renovate: depName=aquaproj/aqua-registry
+	registryVersion := "v4.154.0" // renovate: depName=aquaproj/aqua-registry
 	release, _, err := c.github.GetLatestRelease(ctx, "aquaproj", "aqua-registry")
 	if err != nil {
 		logerr.WithError(logE, err).WithFields(logrus.Fields{

pkg/controller/update/package.go

@@ -51,6 +51,12 @@ func (c *Controller) updatePackagesInFile(ctx context.Context, logE *logrus.Entr
 		return nil
 	}
 	for _, pkg := range pkgs {
+		if len(param.Args) == 0 && !param.Insert {
+			if !pkg.Package.Update.GetEnabled() {
+				// If the update is disabled, the package is ignored
+				continue
+			}
+		}
 		logE := logE.WithFields(logrus.Fields{
 			"package_name":    pkg.Package.Name,
 			"package_version": pkg.Package.Version,

pkg/versiongetter/github_release.go

@@ -3,12 +3,14 @@ package versiongetter
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 
 	"github.com/aquaproj/aqua/v2/pkg/config/registry"
 	"github.com/aquaproj/aqua/v2/pkg/expr"
 	"github.com/aquaproj/aqua/v2/pkg/fuzzyfinder"
 	"github.com/aquaproj/aqua/v2/pkg/github"
+	"github.com/hashicorp/go-version"
 	"github.com/sirupsen/logrus"
 )
 
@@ -27,6 +29,62 @@ type GitHubReleaseClient interface {
 	ListReleases(ctx context.Context, owner, repo string, opts *github.ListOptions) ([]*github.RepositoryRelease, *github.Response, error)
 }
 
+type Release struct {
+	Tag           string
+	Version       *version.Version
+	VersionPrefix string
+	Prerelease    bool
+}
+
+func convRelease(release *github.RepositoryRelease) *Release {
+	v, prefix, _ := GetVersionAndPrefix(release.GetTagName())
+	return &Release{
+		Tag:           release.GetTagName(),
+		Version:       v,
+		VersionPrefix: prefix,
+		Prerelease:    release.GetPrerelease() || v.Prerelease() != "",
+	}
+}
+
+func compareRelease(latest, release *Release) bool {
+	if latest.Prerelease && !release.Prerelease {
+		return true
+	}
+	if !latest.Prerelease && release.Prerelease {
+		return false
+	}
+	if release.Version == nil {
+		if latest.Version != nil {
+			return false
+		}
+		if release.Tag > latest.Tag {
+			return true
+		}
+		return false
+	}
+	if latest.Version == nil {
+		return true
+	}
+	if release.Version.GreaterThan(latest.Version) {
+		return true
+	}
+	return false
+}
+
+func getLatestRelease(releases []*Release) *Release {
+	if len(releases) == 0 {
+		return nil
+	}
+	latest := releases[0]
+	for _, release := range releases[1:] {
+		if compareRelease(latest, release) {
+			latest = release
+			continue
+		}
+	}
+	return latest
+}
+
 func (g *GitHubReleaseVersionGetter) Get(ctx context.Context, logE *logrus.Entry, pkg *registry.PackageInfo, filters []*Filter) (string, error) {
 	repoOwner := pkg.RepoOwner
 	repoName := pkg.RepoName
@@ -36,15 +94,7 @@ func (g *GitHubReleaseVersionGetter) Get(ctx context.Context, logE *logrus.Entry
 		logGHRateLimit(logE, respToLog)
 	}()
 
-	release, resp, err := g.gh.GetLatestRelease(ctx, repoOwner, repoName)
-	respToLog = resp
-	if err != nil {
-		return "", fmt.Errorf("get the latest GitHub Release: %w", err)
-	}
-
-	if len(filters) == 0 || filterRelease(release, filters) {
-		return release.GetTagName(), nil
-	}
+	candidates := []*Release{}
 
 	opt := &github.ListOptions{
 		PerPage: 30, //nolint:gomnd
@@ -57,9 +107,12 @@ func (g *GitHubReleaseVersionGetter) Get(ctx context.Context, logE *logrus.Entry
 		}
 		for _, release := range releases {
 			if filterRelease(release, filters) {
-				return release.GetTagName(), nil
+				candidates = append(candidates, convRelease(release))
 			}
 		}
+		if len(candidates) > 0 {
+			return getLatestRelease(candidates).Tag, nil
+		}
 		if resp.NextPage == 0 {
 			return "", nil
 		}
@@ -147,3 +200,20 @@ func filterTagByFilter(tagName string, filter *Filter) bool {
 	}
 	return false
 }
+
+var versionPattern = regexp.MustCompile(`^(.*?)v?((?:\d+)(?:\.\d+)?(?:\.\d+)?(?:(\.|-).+)?)$`)
+
+func GetVersionAndPrefix(tag string) (*version.Version, string, error) {
+	if v, err := version.NewVersion(tag); err == nil {
+		return v, "", nil
+	}
+	a := versionPattern.FindStringSubmatch(tag)
+	if a == nil {
+		return nil, "", nil
+	}
+	v, err := version.NewVersion(a[2])
+	if err != nil {
+		return nil, "", err //nolint:wrapcheck
+	}
+	return v, a[1], nil
+}

pkg/versiongetter/github_tag.go

@@ -24,6 +24,16 @@ type GitHubTagClient interface {
 	ListTags(ctx context.Context, owner string, repo string, opts *github.ListOptions) ([]*github.RepositoryTag, *github.Response, error)
 }
 
+func convTag(tag *github.RepositoryTag) *Release {
+	v, prefix, _ := GetVersionAndPrefix(tag.GetName())
+	return &Release{
+		Tag:           tag.GetName(),
+		Version:       v,
+		VersionPrefix: prefix,
+		Prerelease:    v.Prerelease() != "",
+	}
+}
+
 func (g *GitHubTagVersionGetter) Get(ctx context.Context, logE *logrus.Entry, pkg *registry.PackageInfo, filters []*Filter) (string, error) {
 	repoOwner := pkg.RepoOwner
 	repoName := pkg.RepoName
@@ -36,6 +46,8 @@ func (g *GitHubTagVersionGetter) Get(ctx context.Context, logE *logrus.Entry, pk
 		logGHRateLimit(logE, respToLog)
 	}()
 
+	candidates := []*Release{}
+
 	for {
 		tags, resp, err := g.gh.ListTags(ctx, repoOwner, repoName, opt)
 		respToLog = resp
@@ -44,9 +56,12 @@ func (g *GitHubTagVersionGetter) Get(ctx context.Context, logE *logrus.Entry, pk
 		}
 		for _, tag := range tags {
 			if filterTag(tag, filters) {
-				return tag.GetName(), nil
+				candidates = append(candidates, convTag(tag))
 			}
 		}
+		if len(candidates) > 0 {
+			return getLatestRelease(candidates).Tag, nil
+		}
 		if resp.NextPage == 0 {
 			return "", nil
 		}

tests/cosign/aqua.yaml

@@ -7,7 +7,7 @@ checksum:
   require_checksum: false
 registries:
   - type: standard
-    ref: v4.152.0 # renovate: depName=aquaproj/aqua-registry
+    ref: v4.154.0 # renovate: depName=aquaproj/aqua-registry
   - name: local
     type: local
     path: registry.yaml

tests/main/aqua.yaml

@@ -4,7 +4,7 @@ checksum:
 registries:
 - type: standard
   type: standard # duplicated keys
-  ref: v4.152.0 # renovate: depName=aquaproj/aqua-registry
+  ref: v4.154.0 # renovate: depName=aquaproj/aqua-registry
 - null
 
 packages: