Renovate: enable fork processing and simplify Chunkah tracking

.github/workflows/build.yml

@@ -146,7 +146,7 @@ jobs:
       # ever has to hold two unpacked copies of the image at once.
       - name: Rechunk Image with Chunkah
         env:
-          CHUNKAH_IMAGE: quay.io/coreos/chunkah:v0.6.0@sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708
+          CHUNKAH_IMAGE: quay.io/coreos/chunkah:v0.6.0
         run: |
           set -euo pipefail
 

.github/renovate.json5 → renovate.json

@@ -1,23 +1,27 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:best-practices",
+    "config:best-practices"
   ],
 
+  "forkProcessing": "enabled",
+
   "rebaseWhen": "never",
 
   "customManagers": [
     {
       "customType": "regex",
       "description": "Track stable Chunkah container releases",
-      "managerFilePatterns": ["/^\\.github\/workflows\/.*\\.ya?ml$/"],
+      "managerFilePatterns": [
+        "/^\\.github/workflows/.*\\.ya?ml$/"
+      ],
       "matchStrings": [
-        "CHUNKAH_IMAGE:\\s+quay\\.io/coreos/chunkah:(?<currentValue>v\\d+\\.\\d+\\.\\d+)@(?<currentDigest>sha256:[a-f0-9]+)",
+        "CHUNKAH_IMAGE:\\s+\"?quay\\.io/coreos/chunkah:(?<currentValue>v\\d+\\.\\d+\\.\\d+)\"?"
       ],
       "depNameTemplate": "quay.io/coreos/chunkah",
       "datasourceTemplate": "docker",
-      "versioningTemplate": "semver-coerced",
-    },
+      "versioningTemplate": "semver-coerced"
+    }
   ],
 
   "packageRules": [
@@ -29,17 +33,22 @@
       "enabled": false,
       "matchUpdateTypes": ["digest", "pinDigest", "pin"],
       "matchDepTypes": ["container"],
-      "matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"],
+      "matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"]
+    },
+    {
+      "enabled": false,
+      "matchUpdateTypes": ["digest", "pinDigest", "pin"],
+      "matchPackageNames": ["quay.io/coreos/chunkah"]
     },
     {
       "description": "Dependabot owns GitHub Actions version updates; disable Renovate's github-actions manager to avoid duplicate PRs. Renovate still owns the Chunkah custom manager above.",
       "enabled": false,
-      "matchManagers": ["github-actions"],
+      "matchManagers": ["github-actions"]
     },
     {
       "description": "Containerfile images are hand-managed via ARGs; the weekly scheduled build tracks :stable by design. Do not update or pin them.",
       "enabled": false,
-      "matchManagers": ["dockerfile"],
-    },
+      "matchManagers": ["dockerfile"]
+    }
   ]
 }