[mergeraptor]

This PR contains the following updates:

Package	Update	Change
bst2	digest	0fadcdc → 2232beb

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[hivecommons-hive]

aba5b5d

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @mergeraptor[bot], head aba5b5d10ad2) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • Justfile

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Summary: This automated update moves the build-tool container (the "bst2" image our local builds and CI run BuildStream inside) to a newer upstream version. The new version does not exist yet: the upstream project's build for that commit failed, so no image was ever published. Merging this as-is would make every local build and the CI validation step fail with "image not found".

What I need from you: Hold this PR until upstream publishes the image (or Renovate re-targets to a commit that has one); do not merge now.

---

correctness

• high — pinned bst2 tag does not exist in the registry. Justfile:10 now sets bst2_image to ...bst2:e9149d58061b3d388e6be42a39e1fab5ffa80bdc, and every just bst invocation (Justfile:51) pulls it. The validate check on this head fails with reading manifest e9149d58… : manifest unknown (job 122279234304). Verified against GitLab directly: registry tag lookup returns 404 Tag Not Found, and the upstream master pipeline for commit e9149d5 (MR !800, "Upgrade container to 26.08.4") has status failed (pipeline 2994833247), so the image was never built. The previous tag 0fadcdc… still resolves. Fix: wait for upstream to publish (then tick the rebase/retry box so Renovate re-validates), or leave on 0fadcdc until a later master commit has a published tag.

docs-currency (out-of-scope, backlog)

• low — docs assert every upstream merge publishes a tag; this PR shows that is not guaranteed. docs/skills/ci-tooling.md:72-73 ("every merge there publishes a tag for its commit") and the matching renovate.json:31 description are the rationale for following master with git-refs. A failed upstream pipeline leaves a merge with no tag, which is exactly what happened here. Worth softening the wording and/or adding an existence check (e.g. a manifest HEAD before just bst in validate) so the failure mode is explicit rather than a bare manifest unknown.

No findings from: security, intent-alignment, style.

Confidence: 3/5 (needs attention) — 1 high finding

— hive: agent=reviewer backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Hive filed review findings that do not block this PR as backlog items:

• Review backlog (docs-currency): Docs claim every upstream merge publishes a bst2 tag; failed upstream pipelines break that assumption #549 — Review backlog (docs-currency): Docs claim every upstream merge publishes a bst2 tag; failed upstream pipelines break that assumption (Review backlog (docs-currency): Docs claim every upstream merge publishes a bst2 tag; failed upstream pipelines break that assumption #549)

Cap: 10 backlog item(s) per PR per day.

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Danathar]

Not mergeable yet: the bumped image doesn't exist. validate (run 40529795469) fails with manifest unknown pulling registry.gitlab.com/freedesktop-sdk/infrastructure/freedesktop-sdk-docker-images/bst2:e9149d58061b3d388e6be42a39e1fab5ffa80bdc, and re-checked just now, that tag still isn't in the registry. Renovate picked up a commit that has no published image yet; it should replace this PR once a published tag exists.

[hivecommons-hive]

This mergeraptor PR has failed validate on its current head for over 4 hours. Hive does not repair dependency-bot PRs. If the failure was transient (a flaky job or an infrastructure problem), re-run the failed check. If the bump breaks the build, fix the code or lockfile on this branch, pin or ignore the dependency in the bot's config, or close the PR; a rebase will not fix it.

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

2ba81a5

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @mergeraptor[bot], head 2ba81a587405) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • Justfile

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Summary: This automated update points our build tooling at a newer version of a container image used to run BuildStream, but that newer version was never actually published: the image's upstream build failed, so pulling it fails and our own validation check breaks. Merging as-is would leave every just bst/just validate run broken until someone changes the pin again.

What I need from you: Don't merge this; wait for upstream to publish the image (or let Renovate re-propose once a working commit exists).

---

correctness

• high, in-scope — Justfile:10 now pins bst2:2232beb539e95b5c18f64d418fcdff18bf2ea530, but that tag does not exist in the registry. GET /v2/.../bst2/manifests/2232beb… returns 404 (the previous 0fadcdc… returns 200); the tags list contains only 2232beb…-arm64, -ppc64le, -riscv64 — no -amd64 and no multi-arch index. Upstream pipeline for that commit is failed (https://gitlab.com/freedesktop-sdk/infrastructure/freedesktop-sdk-docker-images/-/pipelines/2998809721). CI validate on this head fails at Justfile:51 (podman run … "{{bst2_image}}"): reading manifest 2232beb… : manifest unknown, exit 125. Fix: keep 0fadcdc… until upstream publishes a complete image for a master commit, then re-run Renovate (rebase/retry checkbox).
• low, out-of-scope — renovate.json:31-43 tracks git-refs on upstream master, which races against the image publish: any master commit whose pipeline fails or is still running yields an unpullable pin like this one. Consider a post-upgrade check or switching the datasource to the registry's tag list filtered to 40-hex tags that have a manifest.

No findings from: security, intent-alignment, style, docs-currency.

Confidence: 3/5 (needs attention) — 1 high finding

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jeefy]

Nothing to do on this PR: the tag doesn't exist yet. bst2:2232beb539e95b5c18f64d418fcdff18bf2ea530 returns manifest unknown, because the freedesktop-sdk-docker-images pipeline for that commit failed. Every master pipeline there has failed since Oct 27 (0fadcdc, e9149d5, 2232beb); the last success was 0fadcdc on Oct 26, which is what main uses now.

Renovate will move this PR to the next commit that publishes a tag. Once validate is green it gets auto-merge (platformAutomerge) like the other digest updates. #553 adds a clear error for this case to just bst.

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull request changes no files, so there is nothing to approve.

[mergeraptor]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[hivecommons-hive]

Summary: This update was meant to move the build-tool container image to a newer version, but that newer image was never published upstream, so the last fix reverted the change. The pull request now changes nothing at all: merging it would record "updated to the new version" in history while the version stays exactly where it is. It should be closed rather than merged; the next upstream build will produce a fresh update.

What I need from you: Close this PR (do not merge the empty diff).

---

Reviewed delta 2ba81a5…6041d60 (Justfile, 2 lines). Head Justfile:10 now pins bst2:0fadcdcabdb66c7b6cd3721072fd41abe38f5c10, byte-identical to main Justfile:10; compare/main...6041d60 reports files: [] and prow already notes "This pull request changes no files".

intent-alignment

• medium, in-scope — Title/body promise 0fadcdc → 2232beb, but the net diff against main is empty (Justfile:10 at head == main). Merging records a dependency bump that did not happen. Registry check at review time: bst2:2232beb… manifest → 404, bst2:0fadcdc… → 200, so the bump still cannot land. Remediation: close this PR; Renovate will open a new one for the next published upstream commit. Renovate also will not rebase this branch anymore (its "Edited/Blocked" comment), so leaving it open gains nothing.

correctness

• Previous finding "Justfile:10 pinned tag not published; validate fails" — fixed by the revert; validate check-run is success at head.
• Previous finding "renovate.json:31 git-refs tracking races upstream image publish" — still present, now out-of-scope (renovate.json untouched by this PR). renovate.json:31–43 follows master of the upstream git repo via git-refs, so every upstream merge whose image pipeline fails (as 2998809721 did) yields another unmergeable PR. Backlog: gate on image existence (e.g. docker datasource + versioning that can order the tags, or a pre-merge tag probe in validate).

No findings from: security, style, docs-currency.

Confidence: 3/5 (needs attention) — 1 medium finding; 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull request changes no files, so there is nothing to approve.

[Danathar]

Closing per the hive review: the bst2 2232beb image was never published (manifest 404, upstream pipeline failed), and after the revert this PR changes no files. Renovate will propose the next published digest.