From 0bd73aa138fd1201d557404aabaecd1d42047999 Mon Sep 17 00:00:00 2001
From: Patrick Hermann <patrick.hermann@sva.de>
Date: Wed, 29 Jul 2026 13:02:07 +0000
Subject: [PATCH] fix(ansible): refresh stale dagger defaults and let renovate
 manage them

call-release-artifact.yaml declared dagger-module-version: v0.2.1 and
dagger-version: "0.18.10". Upstream is v0.121.0 and v0.21.7, so the module
default sat about 119 releases behind - the same trap #121 fixed in
call-ansible-collection.yaml, where it had sat at v0.13.0.

Harmless only because every caller passes explicit values. Called without them,
this workflow silently runs a module predating the monotonic version scheme and
the tag-naming fix, so it would publish a release tagged with a filename and a
version that can run backwards.

Both pins are hand-maintained in six places across two repos and were aligned
by hand three times this week, so add custom managers rather than fix the
values and wait for the next drift. The existing managers key on _version: and
Version:, neither of which matches these, and one of the six is a workflow_call
input default where the key and the value are three lines apart.

Verified with renovate's own extractor over the real files: 11 of 11 pins
found across both repos, including the two stale ones here.

Refs stuttgart-things/ansible#1043 (finding #8)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY
---
 .github/workflows/call-release-artifact.yaml |  4 +--
 renovate.json                                | 31 ++++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/call-release-artifact.yaml b/.github/workflows/call-release-artifact.yaml
index e5c5ea2..6c14aea 100644
--- a/.github/workflows/call-release-artifact.yaml
+++ b/.github/workflows/call-release-artifact.yaml
@@ -24,11 +24,11 @@ on:
       dagger-module-version:
         required: false
         type: string
-        default: v0.2.1
+        default: v0.121.0
       dagger-version:
         required: false
         type: string
-        default: "0.18.10"
+        default: v0.21.7
 
 jobs:
   release-artifact:
diff --git a/renovate.json b/renovate.json
index 3129bd2..46af5c3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,5 +3,36 @@
   "extends": [
     "config:recommended",
     "helpers:pinGitHubActionDigests"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "STUTTGART-THINGS DAGGER ANSIBLE MODULE PIN. LIVES IN SIX PLACES ACROSS TWO REPOS AND WAS ALIGNED BY HAND THREE TIMES",
+      "fileMatch": [
+        "^\\.github/workflows/[^/]+\\.ya?ml$"
+      ],
+      "matchStrings": [
+        "DAGGER_ANSIBLE_MODULE_VERSION:[ \\t]*(?<currentValue>v\\d+\\.\\d+\\.\\d+)",
+        "dagger-module-version:[ \\t]*(?<currentValue>v\\d+\\.\\d+\\.\\d+)",
+        "dagger-module-version:\\n(?:[ \\t]+[^\\n]*\\n)*?[ \\t]+default:[ \\t]*['\"]?(?<currentValue>v?\\d+\\.\\d+\\.\\d+)['\"]?"
+      ],
+      "depNameTemplate": "stuttgart-things/dagger",
+      "datasourceTemplate": "github-releases",
+      "versioningTemplate": "semver"
+    },
+    {
+      "customType": "regex",
+      "description": "DAGGER CLI PIN, PASSED TO dagger/dagger-for-github",
+      "fileMatch": [
+        "^\\.github/workflows/[^/]+\\.ya?ml$"
+      ],
+      "matchStrings": [
+        "dagger-version:[ \\t]*(?<currentValue>v\\d+\\.\\d+\\.\\d+)",
+        "dagger-version:\\n(?:[ \\t]+[^\\n]*\\n)*?[ \\t]+default:[ \\t]*['\"]?(?<currentValue>v?\\d+\\.\\d+\\.\\d+)['\"]?"
+      ],
+      "depNameTemplate": "dagger/dagger",
+      "datasourceTemplate": "github-releases",
+      "versioningTemplate": "semver"
+    }
   ]
 }