From 7cee8789a2a1ad36d4d7c23c56632537ef0d664a Mon Sep 17 00:00:00 2001
From: Christopher Plieger <917744+cplieger@users.noreply.github.com>
Date: Wed, 8 Jul 2026 01:29:31 +0200
Subject: [PATCH] fix: delay golang docker image bumps by 1 day to ride out
 multi-arch publish race

The official golang tag publishes its multi-arch manifest in stages; Renovate can pin the tag digest mid-publish while the manifest-list index is still empty (0 platforms), which fails consumers' native amd64+arm64 builds with 'no match for platform in manifest'. A 1-day minimumReleaseAge scoped to the docker datasource rides out that race. Same guard homelab uses for PostgreSQL.
---
 default.json | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/default.json b/default.json
index 4276681..5ac3614 100644
--- a/default.json
+++ b/default.json
@@ -162,6 +162,16 @@
       ],
       "groupName": "golang toolchain"
     },
+    {
+      "description": "golang docker image: wait 1 day before pinning a version bump. The official golang tag publishes its multi-arch manifest in stages, so Renovate can resolve the tag digest during the publish window while the manifest-list index is still EMPTY (0 platform manifests); that empty digest then fails every consumer's native amd64+arm64 docker build with 'no match for platform in manifest'. A 1-day stabilization delay rides out the publish race (the same failure mode homelab guards PostgreSQL against). Scoped to matchDatasources=docker so it never delays the go.dev-tarball golang-version dep or the golang-amd64/golang-arm64 sha deps.",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchDepNames": [
+        "golang"
+      ],
+      "minimumReleaseAge": "1 day"
+    },
     {
       "description": "vibecli's Dockerfile (and the sister vibekit image, same approach) pins tsgo via @typescript/native-preview plus a per-arch sha256 (TSGO_SHA256_X64 / TSGO_SHA256_ARM64) of the platform-specific tarballs, which publish in lockstep at the same version. The generic Dockerfile customManager rewrites TSGO_VERSION but leaves the shas stale, fail-closing the build. Label the PR and embed the per-arch recompute commands. matchDepNames keeps it a no-op for repos without this pin.",
       "matchManagers": [