Pin exact versions of images and actions

Floating tags (17-alpine, 3.4-slim, nginx:alpine, :latest, :debug, @v7)
change under a deploy without anyone deciding it: the storage deploy
moved Postgres to 17.12 on its own because of postgres:17-alpine. Pin
every image and action to its exact current version, so each change
arrives as a reviewed Renovate PR and a rollback is a revert.

Assisted-by: Claude:opus-5-5

.forgejo/workflows/deploy.yaml

@@ -32,7 +32,7 @@ jobs:
         run: nix-env -iA nixpkgs.nodejs_22
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up credentials
         env:

ansible/inventory/group_vars/services_servers/forgejo_runner.yaml

@@ -3,7 +3,7 @@
 
 # Runner version and settings
 # renovate: datasource=docker depName=code.forgejo.org/forgejo/runner
-forgejo_runner_version: "13"
+forgejo_runner_version: "13.2.1"
 forgejo_runner_capacity: 4
 forgejo_runner_timeout: 3h
 

ansible/roles/forgejo_runner/tasks/main.yaml

@@ -47,7 +47,7 @@
       --token {{ forgejo_runner_token }}
       --name runner-{{ inventory_hostname }}
       --instance http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
-      --labels ubuntu-latest:docker://node:20-bookworm,ubuntu-22.04:docker://node:20-bookworm,ubuntu-24.04:docker://node:22-bookworm,debian-latest:docker://debian:bookworm,debian-12:docker://debian:bookworm,debian-11:docker://debian:bullseye,arch-latest:docker://archlinux:latest,nginx-latest:docker://nginx:latest,nginx-alpine:docker://nginx:alpine,node-20:docker://node:20,node-22:docker://node:22,python-3.11:docker://python:3.11,python-3.12:docker://python:3.12,alpine-latest:docker://alpine:latest
+      --labels ubuntu-latest:docker://node:20.20.2-bookworm,ubuntu-22.04:docker://node:20.20.2-bookworm,ubuntu-24.04:docker://node:22.23.5-bookworm,debian-latest:docker://debian:12.15,debian-12:docker://debian:12.15,debian-11:docker://debian:11.11,arch-latest:docker://archlinux:base-20261108.0.623074,nginx-latest:docker://nginx:1.31.8,nginx-alpine:docker://nginx:1.31.8-alpine,node-20:docker://node:20.20.2,node-22:docker://node:22.23.5,python-3.11:docker://python:3.11.18,python-3.12:docker://python:3.12.16,alpine-latest:docker://alpine:3.24.4
   when: not runner_registered.stat.exists
   changed_when: true
   register: registration_result

ansible/roles/forgejo_runner/templates/config.yaml.j2

@@ -14,20 +14,20 @@ runner:
   fetch_interval: 2s
   report_interval: 1s
   labels:
-    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-latest:docker://node:20.20.2-bookworm"
-    - "ubuntu-22.04:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20.20.2-bookworm"
-    - "ubuntu-24.04:docker://node:22-bookworm"
+    - "ubuntu-24.04:docker://node:22.23.5-bookworm"
-    - "debian-latest:docker://debian:bookworm"
+    - "debian-latest:docker://debian:12.15"
-    - "debian-12:docker://debian:bookworm"
+    - "debian-12:docker://debian:12.15"
-    - "debian-11:docker://debian:bullseye"
+    - "debian-11:docker://debian:11.11"
-    - "arch-latest:docker://archlinux:latest"
+    - "arch-latest:docker://archlinux:base-20261108.0.623074"
-    - "nginx-latest:docker://nginx:latest"
+    - "nginx-latest:docker://nginx:1.31.8"
-    - "nginx-alpine:docker://nginx:alpine"
+    - "nginx-alpine:docker://nginx:1.31.8-alpine"
-    - "node-20:docker://node:20"
+    - "node-20:docker://node:20.20.2"
-    - "node-22:docker://node:22"
+    - "node-22:docker://node:22.23.5"
-    - "python-3.11:docker://python:3.11"
+    - "python-3.11:docker://python:3.11.18"
-    - "python-3.12:docker://python:3.12"
+    - "python-3.12:docker://python:3.12.16"
-    - "alpine-latest:docker://alpine:latest"
+    - "alpine-latest:docker://alpine:3.24.4"
     - "nix-latest:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
 
 cache:

ansible/roles/minecraft/files/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   minecraft:
-    image: eclipse-temurin:21-jre
+    image: eclipse-temurin:21.0.13_9-jre
     container_name: minecraft
     working_dir: /data
     command: java -Xmx4G -Xms2G -jar paper-1.21.11-54.jar nogui

renovate.json

@@ -13,16 +13,76 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+[a-z_0-9]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
       ]
+    },
+    {
+      "description": "Runner job images, pinned in the labels: docker://<image>:<tag>",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^ansible/roles/forgejo_runner/(templates/config\\.yaml\\.j2|tasks/main\\.yaml)$/"
+      ],
+      "matchStrings": [
+        "docker://(?<depName>[a-z0-9./_-]+):(?<currentValue>[A-Za-z0-9._-]+)"
+      ],
+      "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
     {
-      "description": "Paper needs Java 21; the tag is a floating JRE line",
+      "description": "Paper needs Java 21: patch updates of the 21 JRE only",
       "matchPackageNames": [
         "eclipse-temurin"
       ],
+      "allowedVersions": "/^21\\./"
+    },
+    {
+      "description": "Runner labels name their line (node-20, debian-12, python-3.11): never leave it",
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
       "enabled": false
     },
+    {
+      "description": "python-3.11 / python-3.12 labels stay on their minor line",
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "matchPackageNames": [
+        "python"
+      ],
+      "matchCurrentValue": "/^3\\.11\\./",
+      "allowedVersions": "/^3\\.11\\./"
+    },
+    {
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "matchPackageNames": [
+        "python"
+      ],
+      "matchCurrentValue": "/^3\\.12\\./",
+      "allowedVersions": "/^3\\.12\\./"
+    },
+    {
+      "description": "archlinux tags are base-YYYYMMDD.0.BUILD",
+      "matchPackageNames": [
+        "archlinux"
+      ],
+      "versioning": "regex:^base-(?<major>\\d{8})\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
+    },
+    {
+      "description": "Both label files carry the same pins: one PR per image",
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "groupName": "runner job images",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ]
+    },
     {
       "description": "Every job runs this image and a nix-store volume tied to its version",
       "matchPackageNames": [