NORTHSET
Proof-of-Pass Receipt — M-016
CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION
Project
Work
fix(manager/quadlet): pass specifyReplaceString to getDep so docker:pinDigests can pin/update digests · PR #44538
Verification execution
runtime: northset-oss executor v1
human operator: aeziz
Code
- base
77da69117e70421ae034f2723f8007dd6829f142- recorded patch commit
77ba52c5b58855836bb00545c37f81cb7d2d1747
declared metadata; not execution-bound- patch diff SHA-256
sha256:19902c75871d1443d6dd3040ad366857a13c16c9b43c568a73fc7a0e86a49cfb
bound to executed patch bytes
Environment
- image reference
- node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7
- repository digest
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7- network
- phaseA:bridge,phaseB:none
Declared checks
Execution summary
1/1 declared command returned exit 0 in the recorded environment
node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.tsexit 0 · 5s
unclassified executor time (derived residual) 2m54s
run wall (derived from recorded timestamps) 2m59s
PASS — 1/1 declared command
Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.
Public scope interpretation
The declared network-off check runs one focused Vitest spec for Quadlet digest replacement. It does not run Renovate’s full test, lint, typecheck, or coverage gates.
Record details
- payment
- none · not merge-contingent
- redactions
- none recorded
- Bundle contents digest
sha256:4a0512e8d6e6ed0dc578b9a8f13e8551592127d98ed6a0bd9a8b5bff0f759ef2- Signed asset SHA-256
sha256:215c2a7f6a4fa32e3d4a6cf481c364f898e8fcd1b55fb136e256ae0956353287- Signed provenance recorded
- verified 2026-07-14T14:21:48Z
NOT INCLUDED
- Does not prove code quality
- Does not prove security
- Contributor self-run record of Northset's own contribution; not the maintainer's verification.
Signed bundle
Verify this receipt
gh attestation verify run-record-M-016-4a0512e8d6e6.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.ymlAttestation confirms that Northset's signing workflow produced this exact bundle. The signer does not witness the recorded run, and verification does not turn it into maintainer verification.
QR → receipt pageCommitted patch.diff
diff --git a/lib/modules/manager/quadlet/digest-replacement.spec.ts b/lib/modules/manager/quadlet/digest-replacement.spec.ts
new file mode 100644
index 0000000000000000000000000000000000000000..05d30e92a567ad61e0584e65fa4a5f2e059b49a4
--- /dev/null
+++ b/lib/modules/manager/quadlet/digest-replacement.spec.ts
@@ -0,0 +1,32 @@
+import { codeBlock } from 'common-tags';
+import { extractPackageFile } from './extract.ts';
+
+describe('modules/manager/quadlet/digest-replacement', () => {
+ it('supports digest replacement metadata for Quadlet images', () => {
+ const image =
+ 'docker.io/library/alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375';
+ const content = codeBlock`
+ [Container]
+ Image=${image}
+ `;
+
+ const result = extractPackageFile(content, 'alpine.container', {});
+
+ expect(result).toEqual({
+ deps: [
+ {
+ autoReplaceStringTemplate:
+ '{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+ currentDigest:
+ 'sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375',
+ currentValue: '3.23.0',
+ datasource: 'docker',
+ depName: 'docker.io/library/alpine',
+ depType: 'image',
+ packageName: 'docker.io/library/alpine',
+ replaceString: image,
+ },
+ ],
+ });
+ });
+});
diff --git a/lib/modules/manager/quadlet/extract.ts b/lib/modules/manager/quadlet/extract.ts
index f7e6dcc08f0ef4a96c4d603538e86016f1147374..dcd803533fa690036170f577976af48e65942956 100644
--- a/lib/modules/manager/quadlet/extract.ts
+++ b/lib/modules/manager/quadlet/extract.ts
@@ -40,7 +40,7 @@ function getQuadletImage(
const cleanedImage = image
.replace(regEx(/^docker:\/\//), '')
.replace(regEx(/^docker-daemon:/), '');
- const dep = getDep(cleanedImage, false, config.registryAliases);
+ const dep = getDep(cleanedImage, true, config.registryAliases);
if (dep) {
dep.depType = 'image';
Redacted stdout
=== cmd 1: node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.ts ===
[1m[30m[46m RUN [49m[39m[22m [36mv4.1.10 [39m[90m/workspace[39m
[2mCoverage enabled with [22m[33mv8[39m
[32m✓[39m lib/modules/manager/quadlet/digest-replacement.spec.ts [2m([22m[2m1 test[22m[2m)[22m[32m 7[2mms[22m[39m
[2m Test Files [22m [1m[32m1 passed[39m[22m[90m (1)[39m
[2m Tests [22m [1m[32m1 passed[39m[22m[90m (1)[39m
[2m Start at [22m 18:10:44
[2m Duration [22m 3.14s[2m (transform 688ms, setup 591ms, import 1.77s, tests 7ms, environment 0ms)[22m
<?xml version="1.0" encoding="UTF-8" ?>
<testsuites name="vitest tests" tests="1" failures="0" errors="0" time="0.006817833">
<testsuite name="lib/modules/manager/quadlet/digest-replacement.spec.ts" timestamp="2026-07-13T18:10:47.837Z" hostname="ec0ab839a8b9" tests="1" failures="0" errors="0" skipped="0" time="0.006817833">
<testcase classname="lib/modules/manager/quadlet/digest-replacement.spec.ts" name="modules/manager/quadlet/digest-replacement > supports digest replacement metadata for Quadlet images" time="0.004128458">
</testcase>
</testsuite>
</testsuites>
[34m % [39m[2mCoverage report from [22m[33mv8[39m
=============================== Coverage summary ===============================
Statements : 8.09% ( 291/3595 )
Branches : 2.79% ( 55/1971 )
Functions : 12.76% ( 83/650 )
Lines : 8.13% ( 289/3554 )
================================================================================
Redacted stderr
=== cmd 1: node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.ts ===