renovate: Fix Hubble release digest regex

[gandro]

Renovate v35 had a breaking change in how it computes the digest of GitHub releases. Previously, it would use the digest of the release attachements, but now it's just using a git sha as the "digest". This commit changes the data source for the Hubble artifacts to use the data source which preserves the old behavior.

Ref: renovatebot/renovate#20178

---

Note: It might makes sense to merge the outstanding renovate PRs on this file first to not confuse Renovate further.

• chore(deps): update dependency cilium/hubble to v0.11.3 (v1.12) - autoclosed #24490
• chore(deps): update dependency cilium/hubble to v0.11.3 (v1.13) - autoclosed #24468
• renamed renovate PR (updates cilium/hubble on master) #24452

[gandro]

This needs to be merged before Renovate will be able to update the Hubble digests properly. I'm blocking the other PRs for now.

[gandro]

Integration tests failed with a new flake #24491 - restarting.

[gandro]

Integration tests failed again, this time with #23297

[gandro]

Seems like this is not working:

DEBUG: Failed to look up github-release-attachments package cilium/hubble (cilium/hubble)(packageFile="images/cilium/download-hubble.sh", dependency="cilium/hubble")
{
  "baseBranch": "master"
}

[julianwiedmann]

Seems like this is not working:

DEBUG: Failed to look up github-release-attachments package cilium/hubble (cilium/hubble)(packageFile="images/cilium/download-hubble.sh", dependency="cilium/hubble")
{
  "baseBranch": "master"
}

Was this resolved? If it's not working as intended, should we still backport to stable? 🤔

[gandro]

It was not resolved, due to the lack of cycles on my side. I need to investigate why renovate is refusing to update the attachment digests.

Having said that, I think we should still backport the shellscript change here, since the previously used github-releases will cause renovate to open broken PRs on all stable branches without it (due to the change in Renovate's behavior). Once we understand what the issue is, it may be fixable by just updating renovate.json5 on master (which applies to all branches).

[gandro]

Status update. I've attempted running renovate locally to check what is happening, and it seems like renovate itself is unable to talk to the GitHub API:

               {
                 "depName": "cilium/hubble",
                 "currentValue": "v0.11.2",
                 "currentDigest": "7e1496bdc937dcf34de2f282edf62f91edc7ed1435ad78401035dc04e6b66f90",
                 "datasource": "github-release-attachments",
                 "replaceString": "# renovate: datasource=github-release-attachments depName=cilium/hubble digestVersion=v0.11.2\nhubble_sha256[arm64]=\"7e1496bdc937dcf34de2f282edf62f91edc7ed1435ad78401035dc04e6b66f90\"",
                 "updates": [],
                 "packageName": "cilium/hubble",
                 "warnings": [
                   {
                     "topic": "cilium/hubble",
                     "message": "Failed to look up github-release-attachments package cilium/hubble"
                   }
                 ],
                 "versioning": "semver"
               }

DEBUG: POST https://api.github.com/graphql = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=401 retryCount=0, duration=267) (repository=cilium/cilium, baseBranch=master)
DEBUG: Datasource unauthorized (repository=cilium/cilium, baseBranch=master)
       "datasource": "github-release-attachments",
       "packageName": "cilium/hubble",
       "url": "https://api.github.com/graphql"
DEBUG: Failed to look up github-release-attachments package cilium/hubble (repository=cilium/cilium, baseBranch=master, packageFile=images/cilium/download-hubble.sh, dependency=cilium/hubble)
DEBUG: Failed to look up github-release-attachments package cilium/hubble (repository=cilium/cilium, baseBranch=master, packageFile=images/cilium/download-hubble.sh, dependency=cilium/hubble)
DEBUG: Failed to look up github-release-attachments package cilium/hubble (repository=cilium/cilium, baseBranch=master, packageFile=images/cilium/download-hubble.sh, dependency=cilium/hubble)

Investigating weather this is a misconfiguration on our side, or simply a renovate bug (since github-release-attachments doesn't seem to be used in the wild)

[gandro]

Seems like a Renovate bug. Opened an issue upstream: renovatebot/renovate#21230