This PR pins pm-agent's dispatcher image: and PM_WORKER_IMAGE to agent-runner sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d, the images run 383 publish of ddd04d4. They were on c4eba5b… (run 340). It also bumps config-generation"2" → "3", per the convention in deployment.yaml. The # renovate-digest: markers are unchanged, and no *.sops.yaml file is touched.
Evidence
Registry, read-only. Both agent-runner:main and :sha-ddd04d460ef6 return docker-content-digest: sha256:df36d9b7…771d.
The baked worker template, read from the published layers.
df36d9b's /etc/pm-agent/worker-job-template.yaml has imagePullSecrets: - name: pm-agent-registry.
c4eba5b's has no imagePullSecrets. That is why worker Jobs fail the new admission rule.
Why Renovate didn't do it
Run 385 was a real run at 16:14 UTC, which is 12:14 in New York, outside the after 3am and before 6am schedule, so it created no branch. Dependency Dashboard #91 shows the update found but held under Awaiting Schedule: Update …/agent-runner:main Docker digest to df36d9b. Nothing else blocked it: no open Renovate PRs or branches, and no limits hit. This is not a config defect.
Also found: the repo has no labels except agent, so Gitea silently drops every Renovate label (needs-review, blast-radius, …). All Renovate PRs so far show labels: []. The operator needs to create the labels. See the handoff decisions/2026-10-31-pm-agent-runner-digest.md.
Gate
The local toolbox gate returned rc 3 (UNDETERMINED, not green). gitea-settings is the only stage that did not run. platform/pm-agent/** is not a sensitive path in approval-policy.json, so no override is needed.
## What
This PR pins pm-agent's dispatcher `image:` and `PM_WORKER_IMAGE` to agent-runner `sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d`, the images run 383 publish of ddd04d4. They were on `c4eba5b…` (run 340). It also bumps `config-generation` `"2"` → `"3"`, per the convention in `deployment.yaml`. The `# renovate-digest:` markers are unchanged, and no `*.sops.yaml` file is touched.
## Evidence
- **Registry, read-only.** Both `agent-runner:main` and `:sha-ddd04d460ef6` return `docker-content-digest: sha256:df36d9b7…771d`.
- **The baked worker template, read from the published layers.**
- df36d9b's `/etc/pm-agent/worker-job-template.yaml` has `imagePullSecrets: - name: pm-agent-registry`.
- c4eba5b's has no `imagePullSecrets`. That is why worker Jobs fail the new admission rule.
## Why Renovate didn't do it
Run 385 was a **real** run at 16:14 UTC, which is 12:14 in New York, outside the `after 3am and before 6am` schedule, so it created no branch. Dependency Dashboard #91 shows the update found but held under **Awaiting Schedule**: `Update …/agent-runner:main Docker digest to df36d9b`. Nothing else blocked it: no open Renovate PRs or branches, and no limits hit. This is not a config defect.
Also found: the repo has no labels except `agent`, so Gitea silently drops every Renovate label (`needs-review`, `blast-radius`, …). All Renovate PRs so far show `labels: []`. The operator needs to create the labels. See the handoff `decisions/2026-10-31-pm-agent-runner-digest.md`.
## Gate
The local toolbox gate returned **rc 3** (UNDETERMINED, not green). `gitea-settings` is the only stage that did not run. `platform/pm-agent/**` is not a sensitive path in `approval-policy.json`, so **no override is needed**.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
c4eba5b (run 340) bakes a worker template without imagePullSecrets, so the new admission rule
refuses worker Jobs. df36d9b is agent-runner:main == :sha-ddd04d460ef6 (measured on the registry),
and its /etc/pm-agent/worker-job-template.yaml carries imagePullSecrets: pm-agent-registry (read
from the published layer).
Renovate found df36d9b but holds it under "Awaiting Schedule" on dashboard #91: the operator's
dispatch (run 385) was a real run at 12:14 New York, outside the 03:00-06:00 window. The
renovate-digest markers are unchanged, so later bumps remain Renovate's.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
jakman85
What
This PR pins pm-agent's dispatcher
image:andPM_WORKER_IMAGEto agent-runnersha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d, the images run 383 publish ofddd04d4. They were onc4eba5b…(run 340). It also bumpsconfig-generation"2"→"3", per the convention indeployment.yaml. The# renovate-digest:markers are unchanged, and no*.sops.yamlfile is touched.Evidence
agent-runner:mainand:sha-ddd04d460ef6returndocker-content-digest: sha256:df36d9b7…771d./etc/pm-agent/worker-job-template.yamlhasimagePullSecrets: - name: pm-agent-registry.imagePullSecrets. That is why worker Jobs fail the new admission rule.Why Renovate didn't do it
Run 385 was a real run at 16:14 UTC, which is 12:14 in New York, outside the
after 3am and before 6amschedule, so it created no branch. Dependency Dashboard #91 shows the update found but held under Awaiting Schedule:Update …/agent-runner:main Docker digest to df36d9b. Nothing else blocked it: no open Renovate PRs or branches, and no limits hit. This is not a config defect.Also found: the repo has no labels except
agent, so Gitea silently drops every Renovate label (needs-review,blast-radius, …). All Renovate PRs so far showlabels: []. The operator needs to create the labels. See the handoffdecisions/2026-10-31-pm-agent-runner-digest.md.Gate
The local toolbox gate returned rc 3 (UNDETERMINED, not green).
gitea-settingsis the only stage that did not run.platform/pm-agent/**is not a sensitive path inapproval-policy.json, so no override is needed.🤖 Generated with Claude Code
ddd04d4), bump config-generation