refactor: add pinDigests configuration option for docker (#1033)

docs/configuration.md

@@ -92,6 +92,7 @@ $ node renovate --help
     --package-files <list>               Package file paths
     --ignore-paths <list>                Skip any package.json whose path matches one of these.
     --ignore-deps <list>                 Dependencies to ignore
+    --pin-digests [boolean]              Whether to add digests to Dockerfile source images
     --pin-versions [boolean]             Convert ranged versions in package.json to pinned versions
     --separate-major-releases [boolean]  If set to false, it will upgrade dependencies to latest release only, and not separate major/minor branches
     --separate-patch-releases [boolean]  If set to true, it will separate minor and patch updates into separate branches
@@ -458,6 +459,14 @@ Obviously, you can't set repository or package file location with this method.
   <td></td>
   <td><td>
 </tr>
+<tr>
+  <td>`pinDigests`</td>
+  <td>Whether to add digests to Dockerfile source images</td>
+  <td>boolean</td>
+  <td><pre>true</pre></td>
+  <td>`RENOVATE_PIN_DIGESTS`</td>
+  <td>`--pin-digests`<td>
+</tr>
 <tr>
   <td>`pinVersions`</td>
   <td>Convert ranged versions in package.json to pinned versions</td>

lib/config/definitions.js

@@ -315,6 +315,12 @@ const options = [
     env: false,
   },
   // Version behaviour
+  {
+    name: 'pinDigests',
+    description: 'Whether to add digests to Dockerfile source images',
+    stage: 'package',
+    type: 'boolean',
+  },
   {
     name: 'pinVersions',
     description: 'Convert ranged versions in package.json to pinned versions',

lib/workers/package/docker.js

@@ -5,29 +5,34 @@ module.exports = {
 };
 
 async function renovateDockerImage(config) {
-  const newDigest = await dockerApi.getDigest(
-    config.depName,
-    config.currentTag,
-    config.logger
-  );
-  if (!newDigest || config.currentDigest === newDigest) {
-    return [];
+  const { currentTag, logger } = config;
+  const upgrades = [];
+  if (config.pinDigests) {
+    logger.debug('Checking Docker pinDigests');
+    const newDigest = await dockerApi.getDigest(
+      config.depName,
+      currentTag,
+      config.logger
+    );
+    if (newDigest && config.currentDigest !== newDigest) {
+      const upgrade = {};
+      upgrade.newTag = currentTag;
+      upgrade.newDigest = newDigest;
+      upgrade.newVersion = newDigest;
+      upgrade.newFrom = config.depName;
+      if (upgrade.newTag) {
+        upgrade.newFrom += `:${upgrade.newTag}`;
+      }
+      upgrade.newFrom += `@${upgrade.newDigest}`;
+      if (config.currentDigest) {
+        upgrade.type = 'digest';
+        upgrade.isDigest = true;
+      } else {
+        upgrade.type = 'pin';
+        upgrade.isPin = true;
+      }
+      upgrades.push(upgrade);
+    }
   }
-  const upgrade = {};
-  upgrade.newTag = config.currentTag;
-  upgrade.newDigest = newDigest;
-  upgrade.newVersion = newDigest;
-  upgrade.newFrom = config.depName;
-  if (upgrade.newTag) {
-    upgrade.newFrom += `:${upgrade.newTag}`;
-  }
-  upgrade.newFrom += `@${upgrade.newDigest}`;
-  if (config.currentDigest) {
-    upgrade.type = 'digest';
-    upgrade.isDigest = true;
-  } else {
-    upgrade.type = 'pin';
-    upgrade.isPin = true;
-  }
-  return [upgrade];
+  return upgrades;
 }