`docker`: add support for `org.opencontainers.image.version` and `org.opencontainers.image.revision` #13855

yeikel · 2025-12-23T19:09:06Z

What are you trying to accomplish?

Extends metadata extraction to handle digest-only image references, where no tag is present.

This new logic will run when one of the following additional OCI metadata fields are present along with the digest:

From the OCI docs:

org.opencontainers.image.version: Packaged software version. This can sometimes be a tag
org.opencontainers.image.revision: Source control revision identifier for the packaged software

How will you know you've accomplished your goal?

The existing and new spec pass
The new integration tests pass Add tests to validate metadata fetching smoke-tests#362

Checklist

I have run the complete test suite to ensure all tests and linters pass.
I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
I have written clear and descriptive commit messages.
I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
I have ensured that the code is well-documented and easy to understand.

yeikel · 2025-12-23T21:34:30Z

docker/spec/dependabot/docker/metadata_finder_spec.rb

            requirement: nil,
            groups: [],
            source: { registry: "ghcr.io",
-                      digest: "sha256:389a5a9a5457ed237b05d623ddc31a42fa97811051dcd02d7ca4ad46bd3edd3e" }


The only change I applied to this test is to remove the sha256 prefix as the spec was misleading. Our source parser drops sha256 currently

yeikel · 2025-12-23T22:09:53Z

docker/lib/dependabot/docker/metadata_finder.rb

+
+        Dependabot.logger.info "Building source with branch '#{image_version}' and commit '#{revision}'"
+
+        Dependabot::Source.new(


I am not sure if there is any easier way to do this other than to change how Source.from_url works which may cause undesired side-effects. I am open for feedback/ideas 👀

Copilot

Pull request overview

This PR extends Docker metadata extraction to support digest-only image references by utilizing OCI annotations org.opencontainers.image.version and org.opencontainers.image.revision. When an image is referenced by digest without a tag, the implementation now attempts to extract version information from these OCI metadata fields to construct a Dependabot::Source object with branch and commit information.

Key changes:

Added logic to handle digest-only image references using OCI metadata annotations
Extracted image_details method to centralize Docker image inspection logic
Implemented build_source_from_image_version to construct Source objects from OCI version/revision labels

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
`docker/lib/dependabot/docker/metadata_finder.rb`	Refactored `look_up_source` to support digest-only images; extracted `image_details` method for image inspection; added `build_source_from_image_version` to build Source from OCI annotations
`docker/spec/dependabot/docker/metadata_finder_spec.rb`	Added test coverage for digest-only images with OCI version annotations, digest-only images without proper annotations, and fixed digest format consistency (removed "sha256:" prefix)

docker/lib/dependabot/docker/metadata_finder.rb

docker/spec/dependabot/docker/metadata_finder_spec.rb

kbukum1 · 2025-12-31T15:13:59Z

@yeikel ,

There are copilot suggestions. Will it be possible if you go over them? You can either apply the suggested fix or resolve with a feedback.

yeikel · 2025-12-31T15:33:50Z

@yeikel ,

There are copilot suggestions. Will it be possible if you go over them? You can either apply the suggested fix or resolve with a feedback.

Thank you @kbukum1. I believe that I applied the feedback and/or documented some of the decisions that Copilot questioned/were not clear

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

Copilot · 2025-12-31T15:38:14Z

docker/spec/dependabot/docker/metadata_finder_spec.rb

            groups: [],
            source: { registry: "ghcr.io",
-                      digest: "sha256:389a5a9a5457ed237b05d623ddc31a42fa97811051dcd02d7ca4ad46bd3edd3e" }
+                      digest: "389a5a9a5457ed237b05d623ddc31a42fa97811051dcd02d7ca4ad46bd3edd3e" }


The digest format is being corrected to remove the "sha256:" algorithm prefix (changed from the old format with prefix to just the hash). This is a breaking change to the test data format that could affect other code relying on this structure. Ensure that all code paths that read or write digest values consistently use the hash-only format without the algorithm prefix.

This is not a breaking change because the tests are still working as is. The test data was just misleading and never using this. The nature of the misleading test data confused me while creating other tests

Copilot · 2025-12-31T15:38:14Z

docker/lib/dependabot/docker/metadata_finder.rb

+        # This is a safeguard for a first iteration. We may adjust this later based on user feedback.
+        tag_like = image_version&.start_with?("v")
+
+        return unless tag_like || revision


The code supports digest-only images with just a revision (commit) when no version is present (line 82: return unless tag_like || revision). However, there is no test coverage for this scenario. Consider adding a test case for an image that has org.opencontainers.image.revision but not org.opencontainers.image.version to ensure this path works correctly.

I added the spec with a digest but no tag or revision data to cover this

Copilot · 2025-12-31T15:38:14Z

docker/lib/dependabot/docker/metadata_finder.rb

+          # If both tag and digest are present, use the digest as docker ignores the tag when a digest is present
+          if digest


The code handles the case where both tag and digest are present (line 53-54: "If both tag and digest are present, use the digest as docker ignores the tag when a digest is present"). However, there is no test coverage for this scenario. Consider adding a test case with both tag and digest specified to verify the digest takes precedence.

I added the spec with a docker image with both tag and sha that has an OCI source annotation to cover this scenario

Copilot · 2025-12-31T15:38:15Z

docker/lib/dependabot/docker/metadata_finder.rb

+        # We only want to build a source if the version looks like a tag (starts with "v")
+        # This is a safeguard for a first iteration. We may adjust this later based on user feedback.
+        tag_like = image_version&.start_with?("v")


The heuristic for determining if a version is "tag-like" only checks if it starts with "v" (line 80). This is overly restrictive and will miss many valid semantic versions that don't use the "v" prefix (e.g., "1.2.3", "2024.01"). Consider using a more robust check, such as matching against semantic versioning patterns or at least including versions that start with digits.

Suggested change

# We only want to build a source if the version looks like a tag (starts with "v")

# This is a safeguard for a first iteration. We may adjust this later based on user feedback.

tag_like = image_version&.start_with?("v")

# We only want to build a source if the version looks like a tag (starts with "v" or a digit)

# This is a safeguard for a first iteration. We may adjust this later based on user feedback.

tag_like =

if image_version

image_version.start_with?("v") || image_version.match?(/\A\d/)

else

false

end

This is a safeguard for a first iteration. We may adjust this later based on user feedback. I'd like to avoid being overly ambitions because it may cause incorrect behavior such as the Ubuntu example documented in the specs

docker/lib/dependabot/docker/metadata_finder.rb

yeikel · 2025-12-31T16:11:43Z

@yeikel ,
There are copilot suggestions. Will it be possible if you go over them? You can either apply the suggested fix or resolve with a feedback.

Thank you @kbukum1. I believe that I applied the feedback and/or documented some of the decisions that Copilot questioned/were not clear

@kbukum1 I applied the feedback for the latest round of Copilot's feedback

Thanks!

…sion and org.opencontainers.image.revision Extends metadata extraction to handle digest-only image references, where no tag is present. This new logic will run when one of the following additional OCI metadata fields are present along with the digest: - `org.opencontainers.image.version`: Packaged software version. This can sometimes be a tag - `org.opencontainers.image.revision`: Source control revision identifier for the packaged software

yeikel force-pushed the feat/image-version-revision branch from aa3a074 to 37b1bcc Compare December 23, 2025 19:09

github-actions bot added the L: docker Docker containers label Dec 23, 2025

yeikel force-pushed the feat/image-version-revision branch from 37b1bcc to 9a359c5 Compare December 23, 2025 19:10

yeikel changed the title ~~docker: add metadata finding support for org.opencontainers.image.version and org.opencontainers.image.revision~~ docker: add support for org.opencontainers.image.version and org.opencontainers.image.revision Dec 23, 2025

yeikel changed the title ~~docker: add support for org.opencontainers.image.version and org.opencontainers.image.revision~~ docker: add support for org.opencontainers.image.version and org.opencontainers.image.revision Dec 23, 2025

yeikel force-pushed the feat/image-version-revision branch 6 times, most recently from 939b164 to 591a979 Compare December 23, 2025 21:32

yeikel commented Dec 23, 2025

View reviewed changes

yeikel force-pushed the feat/image-version-revision branch 3 times, most recently from f66c0ff to ccd2792 Compare December 23, 2025 22:08

yeikel commented Dec 23, 2025

View reviewed changes

yeikel closed this Dec 23, 2025

yeikel reopened this Dec 23, 2025

yeikel mentioned this pull request Dec 23, 2025

Add tests to validate metadata fetching dependabot/smoke-tests#362

Draft

yeikel force-pushed the feat/image-version-revision branch 3 times, most recently from 3d2cc65 to a911de9 Compare December 23, 2025 22:17

yeikel marked this pull request as ready for review December 23, 2025 22:17

yeikel requested a review from a team as a code owner December 23, 2025 22:17

yeikel force-pushed the feat/image-version-revision branch from a911de9 to ffee40b Compare December 31, 2025 14:50

kbukum1 requested a review from Copilot December 31, 2025 15:07

Copilot started reviewing on behalf of kbukum1 December 31, 2025 15:07 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

kbukum1 self-assigned this Dec 31, 2025

kbukum1 added this to Dependabot Dec 31, 2025

kbukum1 moved this to On Hold in Dependabot Dec 31, 2025

yeikel force-pushed the feat/image-version-revision branch 2 times, most recently from 5e4befe to 8421b3e Compare December 31, 2025 15:31

kbukum1 requested a review from Copilot December 31, 2025 15:35

Copilot started reviewing on behalf of kbukum1 December 31, 2025 15:35 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

yeikel force-pushed the feat/image-version-revision branch 3 times, most recently from 0a9feab to 37785e8 Compare December 31, 2025 16:10

yeikel force-pushed the feat/image-version-revision branch from 37785e8 to cd071ad Compare January 1, 2026 22:53


		Dependabot.logger.info "Building source with branch '#{image_version}' and commit '#{revision}'"

		Dependabot::Source.new(

		# If both tag and digest are present, use the digest as docker ignores the tag when a digest is present
		if digest

docker: add support for org.opencontainers.image.version and org.opencontainers.image.revision #13855

Are you sure you want to change the base?

docker: add support for org.opencontainers.image.version and org.opencontainers.image.revision #13855

Conversation

yeikel commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What are you trying to accomplish?

How will you know you've accomplished your goal?

Checklist

Uh oh!

yeikel Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kbukum1 commented Dec 31, 2025

Uh oh!

yeikel commented Dec 31, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yeikel commented Dec 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`docker`: add support for `org.opencontainers.image.version` and `org.opencontainers.image.revision` #13855

`docker`: add support for `org.opencontainers.image.version` and `org.opencontainers.image.revision` #13855

yeikel commented Dec 23, 2025 •

edited

Loading