Skip to content

fix(lookup): write back sourceUrl from packageRules after source-url stage#1

Draft
camjay wants to merge 1 commit into
mainfrom
fix/sourceurl-packagerules-override
Draft

fix(lookup): write back sourceUrl from packageRules after source-url stage#1
camjay wants to merge 1 commit into
mainfrom
fix/sourceurl-packagerules-override

Conversation

@camjay

@camjay camjay commented Feb 25, 2026

Copy link
Copy Markdown
Owner

Fixes an issue where sourceUrl set via packageRules doesn't override the value provided by a datasource (e.g. Docker OCI image labels).

The problem: When applyPackageRules runs at the 'source-url' stage in lookupUpdates, any user-configured sourceUrl override is applied to config — but it's never written back to res.sourceUrl. So the datasource value always wins.

This doesn't matter for datasources that don't provide a sourceUrl, since there's nothing in res to compete with. But for Docker images with org.opencontainers.image.source OCI labels, the label value always takes precedence over the user's packageRule.

The fix: After the 'source-url' call to applyPackageRules, write config.sourceUrl back to res.sourceUrl when the two differ. This lets the user's explicit override win.

Testing:

  • Added a test case that sets up a Docker datasource returning a sourceUrl and a packageRule overriding it, then asserts the override is reflected in the result
  • All 374 existing tests in the lookup suite pass
  • Verified with a self-hosted dry-run against a repo with mirrored Harbor images

Upstream: renovatebot#41506
Discussion: renovatebot#41505

@camjay camjay force-pushed the fix/sourceurl-packagerules-override branch from 99973df to 43e4cad Compare February 25, 2026 23:49
…stage

When packageRules set sourceUrl, the override was applied to config
but never written back to the result object. This meant datasource-
provided values (e.g. from Docker OCI image labels) always won, even
when a user explicitly overrode sourceUrl in their packageRules.

Adds write-back of config.sourceUrl to res.sourceUrl after the
source-url stage of applyPackageRules, plus a test case.
@camjay camjay force-pushed the fix/sourceurl-packagerules-override branch from 43e4cad to 33039cc Compare February 26, 2026 01:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant