[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/games-on-whales/steam	final	digest	4f88a5e → 9b6105b

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: ghcr.io/games-on-whales/steam (runtime base image, apps/games-on-whales-steam/Dockerfile:75)
• Version: sha256:4f88a5e3… → sha256:9b6105be…
• Type: digest

Release Changes

Upstream publishes no release notes for this image; the digests were inspected directly from the registry (docker buildx imagetools inspect). They are two entirely different images, not an incremental rebuild:

	Old (4f88a5e, amd64 manifest 56b2cd2)	New (9b6105b)
Created	2026-06-21	2021-08-29
Base	Fedora 43 (KIWI/buildah)	Ubuntu (apt, multiverse steam)
Compositor	gamescope 3.16.22 + sway (Wayland)	none
Entrypoint	/entrypoint.sh (PUID/PGID, gosu)	/bin/bash /startup.sh
User	root, drops via entrypoint	retro

Root cause: upstream's latest tag was overwritten with the legacy 2021 Ubuntu build — ghcr.io/games-on-whales/steam:latest currently resolves to sha256:9b6105be…, while the modern Fedora/gamescope build this app is built against still lives under the fedora-43 tag, which resolves to exactly the digest currently pinned (4f88a5e…). The upstream repo has a documented history of tag-overwrite CI bugs (ci: stop PR builds from overwriting fedora-43 tag, fix/fedora-raw-tag-overwrite in games-on-whales/gow).

Breaking Changes

Yes — this PR regresses the runtime base by ~5 years and breaks the image build outright:

1. Build failure: apps/games-on-whales-steam/Dockerfile:79-80 runs (command -v microdnf && microdnf install …) || (dnf install …) — the 2021 Ubuntu image has neither microdnf nor dnf (apt-based). The step's premise ("the base image is Fedora-family", Dockerfile:77-78) no longer holds.
2. Architecture mismatch: the entire NVIDIA 595.71.05 userspace overlay and GBM-regression workaround (Dockerfile:1-21) targets the Fedora 43 Mesa/gbm + gamescope/Wayland stack. The 2021 image has no gamescope, no Wayland compositor, and a 2021-era X11-only Steam — the container's purpose (wolf/gamescope streaming) is destroyed.
3. tests.yaml would still pass (it only checks /opt/nv71 files copied from the fetch stage), so CI alone will not catch the runtime regression — only the dnf/microdnf RUN failure blocks it.

Code Changes Required

Do not merge as-is. Required changes (maintainer to apply — read-only checkout here):

1. In apps/games-on-whales-steam/Dockerfile:75, pin with the tag so Renovate tracks the correct channel instead of implicit latest:
   FROM ghcr.io/games-on-whales/steam:fedora-43@sha256:4f88a5e363c783791fbbe432661d70d6775629fa8c74038b21622477cf20e0ab
2. Update the Renovate comment at Dockerfile:72-74 to reference the fedora-43 tag.
3. Close this PR (Renovate will stop proposing the latest digest once the pin names fedora-43). Optionally file an upstream issue — their latest tag pointing at a 2021 build looks like a CI tag-overwrite regression.

Security Impact

Severe regression: the proposed base is a 2021 Ubuntu image (21.04-era, EOL since early 2022) — kernel-adjacent graphics libs, mesa, steam client runtime, and the base OS packages carry ~5 years of unpatched CVEs, in an image that runs a GUI Steam client with GPU access. The current Fedora 43 base (June 2026) is far fresher. Merging would silently swap a maintained stack for an unmaintained one.

Recommendation

Requires code changes — the "new" digest is upstream's latest tag pointing at a 2021 legacy Ubuntu image; the build breaks at the dnf/microdnf RUN step and the gamescope/NVIDIA workaround architecture collapses. Repin to the fedora-43 tag as detailed above. Do not merge this PR.

[github-actions]

Renovate PR Analysis

(Re-analysis: branch re-pushed 2026-10-02T07:41:01Z after the previous analysis comment 07:39:55Z; the new commit 481a902a carries the identical digest transition — conclusions unchanged, all facts below re-verified from the registry and image config directly.)

Update Summary

• Dependency: ghcr.io/games-on-whales/steam (runtime base image, apps/games-on-whales-steam/Dockerfile:75)
• Version: sha256:4f88a5e3… → sha256:9b6105be…
• Type: digest

Release Changes

Upstream publishes no release notes for image digests. Facts verified live from the registry (docker buildx imagetools inspect / docker pull + image inspect / docker run):

	Old (4f88a5e, OCI index, amd64 56b2cd2 + attestations)	New (9b6105b, single docker v2 manifest, no attestations)
Created	2026-06 (current pin, built by modern buildx w/ provenance)	2021-08-29 (image inspect)
Base OS	Fedora 43	Ubuntu 20.04.2 LTS (verified via /etc/os-release in the pulled image; EOL since 2025-04)
Package manager	dnf/microdnf	apt-get only — command -v microdnf and command -v dnf both empty in the image
Process model	gamescope/Wayland (RUN_GAMESCOPE=true era)	legacy /bin/bash /startup.sh, user retro

Tag mapping (verified): ghcr.io/games-on-whales/steam:latest → sha256:9b6105be… (what this PR proposes); ghcr.io/games-on-whales/steam:fedora-43 → sha256:4f88a5e3… (what the Dockerfile currently pins). The Dockerfile's pin tracks the fedora-43 channel; Renovate is tracking implicit latest, which upstream has overwritten with the 2021 legacy Ubuntu build. Upstream has a documented history of tag-overwrite CI bugs (commits ci: stop PR builds from overwriting fedora-43 tag 2026-05-06 and fix/fedora-raw-tag-overwrite merged 2026-05-12 in games-on-whales/gow).

Breaking Changes

Yes — the build breaks outright, verified empirically:

1. apps/games-on-whales-steam/Dockerfile:79-80 runs (command -v microdnf >/dev/null && microdnf install -y curl ca-certificates) || (dnf install -y curl ca-certificates && dnf clean all). The proposed image has neither microdnf nor dnf (both absent — verified by running command -v inside it), so both branches fail and the RUN exits non-zero. The comment at Dockerfile:77-78 ("the base image is Fedora-family") no longer holds.
2. The NVIDIA 595.71.05 userspace overlay and GBM-regression workaround (Dockerfile:1-69) target the Fedora 43 Mesa/gbm + gamescope/Wayland stack. The 2021 image has no gamescope, no Wayland compositor, and a 2021 X11-era Steam client — the container's purpose (wolf/gamescope streaming) is destroyed.
3. tests.yaml would not catch the runtime regression: it only checks /opt/nv71 files copied from the fetch stage (apps/games-on-whales-steam/tests.yaml:4-16). Only the dnf/microdnf RUN failure blocks the merge.

Code Changes Required

Maintainer to apply (read-only checkout in this workflow):

1. apps/games-on-whales-steam/Dockerfile:75 — pin with the tag so Renovate tracks the correct channel instead of implicit latest:
   FROM ghcr.io/games-on-whales/steam:fedora-43@sha256:4f88a5e363c783791fbbe432661d70d6775629fa8c74038b21622477cf20e0ab
2. Update the Renovate comment at Dockerfile:72-74: upstream now has versioned tags; reference the fedora-43 tag and https://github.com/games-on-whales/steam/pkgs/container/steam.
3. Close this PR — once the pin names fedora-43, Renovate stops proposing the latest digest. Optionally file an upstream issue: latest pointing at the 2021 legacy build looks like another tag-overwrite regression.

Security Impact

Severe regression: the proposed base is Ubuntu 20.04.2 from 2021-08-29 — standard-support EOL since 2025-04 — carrying ~5 years of unpatched CVEs in the base OS, graphics stack, and Steam client runtime, in an image whose whole job is running a GUI Steam client with GPU access. The current Fedora 43 base is a 2026-06 build. Merging silently swaps a maintained stack for an unmaintained one.

Recommendation

Requires code changes — the "new" digest is upstream's latest tag pointing at a 2021 legacy Ubuntu 20.04 image; the build breaks at the dnf/microdnf step (verified: neither binary exists in the proposed image) and the gamescope/NVIDIA workaround architecture collapses. Repin to the fedora-43 tag as detailed above. Do not merge this PR.

[github-actions]

Renovate PR Analysis

(Re-analysis: Renovate force-pushed d297bf0 on 2026-10-03T07:13:06Z, after the previous analysis (2026-10-02T14:16:01Z). The new commit carries the identical digest transition; CI re-ran and failed at the same step. All facts below re-verified today from the registry and the proposed image directly.)

Update Summary

• Dependency: ghcr.io/games-on-whales/steam (runtime base image, apps/games-on-whales-steam/Dockerfile:75)
• Version: sha256:4f88a5e3… → sha256:9b6105be…
• Type: digest

Release Changes

Upstream publishes no release notes for digests. Facts verified live today (docker buildx imagetools inspect, docker pull + docker run of sha256:9b6105be…):

	Old (4f88a5e3, OCI index, amd64 56b2cd2 + attestations)	New (9b6105be, single docker v2 manifest, no attestations)
Created	2026-06 (current pin, modern buildx w/ provenance)	2021-08-29 (docker image inspect)
Base OS	Fedora 43	Ubuntu 20.04.2 LTS (verified via /etc/os-release; standard support EOL 2025-05)
Package manager	dnf/microdnf	no dnf, no microdnf (ls /usr/bin/dnf /usr/bin/microdnf → No such file)
Process model	gamescope/Wayland (RUN_GAMESCOPE=true era)	legacy Cmd=/bin/sh -c /bin/bash /startup.sh, user retro; /usr/gamescope absent

Tag mapping (verified today): :latest → sha256:9b6105be… (what this PR proposes); :fedora-43 → sha256:4f88a5e3… (current pin in main). Our Dockerfile tracks the fedora-43 channel; Renovate is tracking implicit latest, which upstream has overwritten with the 2021 legacy Ubuntu build (upstream has a documented history of tag-overwrite CI bugs).

Breaking Changes

Yes — the build breaks outright, verified from today's CI run (37105621458, job 111153491555):

1. apps/games-on-whales-steam/Dockerfile:79-80 — RUN (command -v microdnf … ) || (dnf install …) fails: CI log shows /bin/sh: 1: dnf: not found, exit code 127, ERROR: failed to solve. The proposed image has neither microdnf nor dnf. Check Build games-on-whales-steam / Build (linux/amd64) = fail.
2. The NVIDIA 595.71.05 overlay + GBM-regression workaround (Dockerfile:1-69) target the Fedora 43 Mesa/gbm + gamescope/Wayland stack. The 2021 image has no gamescope and a legacy X11-era startup — the container's purpose (wolf/gamescope streaming) is destroyed.
3. tests.yaml would not catch the runtime regression: it only checks /opt/nv71 files copied from the fetch stage (apps/games-on-whales-steam/tests.yaml:4-16). Only the build failure blocks.

Code Changes Required

Maintainer to apply (this workflow has a read-only checkout):

1. apps/games-on-whales-steam/Dockerfile:75 — pin with the tag so Renovate tracks the correct channel instead of implicit latest:
   FROM ghcr.io/games-on-whales/steam:fedora-43@sha256:4f88a5e363c783791fbbe432661d70d6775629fa8c74038b21622477cf20e0ab
2. Update the Renovate note at Dockerfile:72-74 to reference the fedora-43 tag explicitly.
3. Close this PR — once the pin names fedora-43, Renovate stops proposing the latest digest. Optionally file an upstream issue: latest pointing at the 2021 legacy build looks like another tag-overwrite regression.

Security Impact

Severe regression: the proposed base is Ubuntu 20.04.2 built 2021-08-29 — standard support EOL since 2025-05 — carrying ~5 years of unpatched CVEs in the base OS, graphics stack, and Steam client runtime, in an image whose whole job is running a GUI Steam client with GPU access. The current Fedora 43 base is a 2026-06 build. Merging silently swaps a maintained stack for an unmaintained one.

Recommendation

Requires code changes — the "new" digest is upstream's latest tag pointing at a 2021 legacy Ubuntu 20.04 image; the build fails at the dnf/microdnf step (verified in CI run 37105621458 and by inspecting the image: neither binary exists) and the gamescope/NVIDIA workaround architecture collapses. Repin to the fedora-43 tag as detailed above. Do not merge this PR.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: ghcr.io/games-on-whales/steam (runtime base of apps/games-on-whales-steam)
• Version: sha256:4f88a5e… → sha256:9b6105b… (untagged digest pin — upstream has no version tags)
• Type: digest

Release Changes

No release notes exist: upstream publishes no tags/releases, and github.com/games-on-whales/steam now returns 404 (repo deleted or made private; the org's active repo is games-on-whales/gow).

Direct inspection of both digests (verified by pulling and running each image):

	old sha256:4f88a5e…	new sha256:9b6105b…
OS	Fedora Linux 43 (Container Image)	Ubuntu 20.04.2 LTS (Focal)
Package manager	microdnf + dnf	apt-get only — no dnf/microdnf
Gamescope	/usr/bin/gamescope (gamescope-wl era)	absent (find / finds none)
Steam	/usr/bin/steam	2021-era deb at /usr/games/steam
/startup.sh	current	dated Aug 29 2021
Manifest	OCI index (amd64 + attestation)	bare single-platform Docker v2 manifest
Source label	github.com/games-on-whales/gow	github.com/games-on-whales/gow (legacy build)

The rolling pointer Renovate follows now resolves to a ~5-year-old legacy artifact from the old gow pipeline, not a newer build of the current stack.

Breaking Changes

• Build is broken (verified): CI on this PR fails at apps/games-on-whales-steam/Dockerfile:79-80 — sh: 1: dnf: not found, exit 127 — because the new base has neither microdnf nor dnf (job log: Build games-on-whales-steam / Build (linux/amd64), run 37105621458).
• The Dockerfile's core premise (gamescope-wl era base, RUN_GAMESCOPE=true, Fedora-family tooling, Dockerfile lines 72-80) is invalid for the new digest.
• renovate/artifacts check also fails on this PR.
• Functional regression even if the build were fixed: the new image contains no gamescope at all, so the Steam/gamescope session this container exists to run cannot start.

Code Changes Required

This PR should not be merged as-is. A maintainer needs to:

1. Do not adopt sha256:9b6105b…. Re-pin or keep sha256:4f88a5e… in apps/games-on-whales-steam/Dockerfile:75 (that digest is still pullable and builds green on main).
2. Disable Renovate for this dep until upstream is clarified — add to .renovaterc.json5 packageRules: { matchDepNames: ["ghcr.io/games-on-whales/steam"], enabled: false }. The steam repo is 404; the ghcr rolling tag now serves a 2021 Ubuntu artifact, so every future digest bump will be equally wrong.
3. Investigate a maintained replacement source (e.g. the games-on-whales/gow repo's published images) and re-point the FROM + comment at apps/games-on-whales-steam/Dockerfile:72-75.
4. Harden apps/games-on-whales-steam/tests.yaml: add a command test asserting gamescope and steam exist on PATH and that /etc/os-release is Fedora-family, so a bad digest like this fails tests loudly instead of only the dnf/microdnf line.

Security Impact

Severe regression: the "new" base is Ubuntu 20.04.2 built ~Aug 2021 (standard support for 20.04 ended May 2025) — roughly five years of unpatched CVEs in the base layer, a 2021 Steam client, and a 2021 startup.sh, replacing a current Fedora 43 image. This is a security downgrade, not an update.

Recommendation

Requires code changes — do not merge. CI fails (Rule 0: Test Before You Ship), the image is functionally unusable for this app (no gamescope), and it is a major security regression. Close this PR (or rebase after re-pinning) and disable Renovate for ghcr.io/games-on-whales/steam until the upstream situation (games-on-whales/steam repo 404) is resolved.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: ghcr.io/games-on-whales/steam (runtime base image, apps/games-on-whales-steam/Dockerfile:75)
• Version: sha256:4f88a5e… → sha256:9b6105b… (Renovate follows the latest tag; upstream publishes no version tags)
• Type: digest

Release Changes

Upstream has no release notes for digest pushes. Verified facts instead:

• The new digest (9b6105b) is what ghcr.io/games-on-whales/steam:latest points to (verified with docker buildx imagetools inspect).
• Probing the new image directly (docker build FROM the new digest): Ubuntu 20.04.2 LTS (Focal), apt-get present, no dnf/microdnf, image user retro, Cmd /bin/sh -c /bin/bash /startup.sh, no steam or gamescope binaries in PATH. This is the legacy-generation gow steam image (Ubuntu/retro/startup.sh era).
• The currently-pinned digest (4f88a5e) is the current-generation Fedora/gamescope-wl image and is still available under the tag ghcr.io/games-on-whales/steam:fedora-43 (verified: fedora-43 → index digest 4f88a5e…, amd64 manifest 56b2cd2…, with provenance attestations; the new latest is a bare docker-v2 manifest pushed by a different/legacy pipeline).
• Upstream gow repo last pushed 2026-06-21 (lutris-only commits; the steam Dockerfile itself unchanged), and that repo has a documented history of tag-overwrite accidents ("ci: stop PR builds from overwriting fedora-43 tag" e271628, "fix/fedora-raw-tag-overwrite" c21a222). The latest tag was overwritten with a legacy-generation build; the correct image was never gone.

Breaking Changes

Yes — build-breaking, confirmed by CI on this PR:

• Build games-on-whales-steam / Build (linux/amd64) fails (run 37409336599): RUN (command -v microdnf …) || (dnf install …) at apps/games-on-whales-steam/Dockerfile:79 exits 127 — /bin/sh: 1: dnf: not found. The legacy image is Ubuntu-based; the Fedora-family assumption in the Dockerfile comment (line 77–78) no longer holds for this digest.
• The Dockerfile header contract ("gamescope-wl era; RUN_GAMESCOPE=true", wolf unix-socket API) is void for this image — no steam/gamescope binaries in PATH, different image user (retro), different startup contract (/startup.sh).

Code Changes Required

None that would make this digest acceptable. Adapting Dockerfile:79 to apt-get would bind this app to an Ubuntu 20.04 (EOL since 2025-05, ESM-only) legacy image without gamescope — a regression against the documented NVIDIA 595.71.05 overlay workaround. The correct resolutions are upstream/tag-side:

1. Close this PR and reconfigure Renovate for this dependency to follow the fedora-43 tag (whose digest, 4f88a5e…, is exactly what the Dockerfile already pins — zero change needed), or
2. Hold the PR until upstream restores latest to the current-generation build (an issue can be filed against games-on-whales/gow).

Security Impact

The new digest would move the runtime base to Ubuntu 20.04, which is past standard-support EOL and receives no public security updates — a security regression for a network-exposed game-streaming container. Keep the current pin.

Recommendation

Needs manual review — do not merge. The latest tag upstream points to a legacy-generation image that breaks our build (CI-verified exit 127) and would regress the base to EOL Ubuntu 20.04. The currently pinned digest remains available and correct under the fedora-43 tag; the durable fix is retargeting Renovate to fedora-43 rather than taking this digest.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: ghcr.io/games-on-whales/steam — runtime base image of the FINAL stage of apps/games-on-whales-steam/Dockerfile:75
• Version: sha256:4f88a5e3... → sha256:9b6105b3...
• Type: digest

Release Changes

This is not a normal digest bump — the latest tag upstream now resolves to a different, 4-year-old image. Registry inspection (docker buildx imagetools / docker manifest inspect, 2026-10-08):

	Current pin sha256:4f88a5e...	Proposed sha256:9b6105b...
Created	current build (OCI index, SLSA provenance attestation)	2021-08-29
Base / package manager	Fedora-family (microdnf/dnf)	Debian (apt), no dnf/microdnf
Source label	modern gow build	github.com/games-on-whales/gow (pre-rename era)
Entrypoint / era	gamescope-wl era, RUN_GAMESCOPE=true wolf stack	X11 steam via /startup.sh, USER retro
Size (compressed)	~785 MB, 24 layers	~199 MB, 6 layers

Tag state upstream right now: :fedora → index sha256:4f88a5e... (identical to our current pin), :latest → the 2021 image (identical to the proposed digest), :stable → manifest unknown (deleted). Renovate tracks the default tag (latest), which upstream has repointed at a legacy artifact.

Breaking Changes

• Build breaks: apps/games-on-whales-steam/Dockerfile:79-80 installs curl ca-certificates via microdnf/dnf (Fedora-family). The Debian image has neither. CI confirms: Build games-on-whales-steam / Build (linux/amd64) failed on this PR (2026-10-08) with /bin/sh: 1: dnf: not found, exit code 127.
• Runtime architecture mismatch: the image exists to carry the NVIDIA 595.71.05 overlay for the gamescope-wl/wolf stack (Dockerfile header, apps/games-on-whales-steam/tests.yaml asserts /opt/nv71 sonames). The 2021 X11 image predates all of that; even if the build were fixed it would not run the intended workload.

Code Changes Required

Do not merge this digest. To stop Renovate re-proposing it:

1. Change apps/games-on-whales-steam/Dockerfile:75 to pin the tag explicitly so Renovate tracks fedora instead of latest:
   FROM ghcr.io/games-on-whales/steam:fedora@sha256:4f88a5e363c783791fbbe432661d70d6775629fa8c74038b21622477cf20e0ab
2. Close this PR — once the tag is explicit, Renovate's future digest bumps will track the Fedora lineage.
3. Optionally ask upstream (games-on-whales/gow) why latest was repointed at the 2021 Debian build and why stable was deleted.

Security Impact

Regression, not improvement: the proposed image was built 2021-08-29 on a Debian base with ~4 years of unpatched CVEs (base packages, steam client bootstrap, tooling). The currently pinned Fedora image is actively rebuilt upstream. Rejecting this PR avoids introducing a large unpatched attack surface into a GPU-accelerated, network-exposed gaming container.

Recommendation

Requires code changes — the PR as-is fails to build (CI evidence above) because the new digest points to a 2021 Debian-based legacy image, not the Fedora gamescope-wl build this Dockerfile is written against. Apply the tag-pinning change above before accepting any future digest update; this PR should be closed, not merged.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: ghcr.io/games-on-whales/steam — runtime base of the FINAL stage of apps/games-on-whales-steam/Dockerfile:75
• Version: sha256:4f88a5e3... → sha256:9b6105b...
• Type: digest

Release Changes

Not a normal digest bump — upstream has no version tags and Renovate tracks the default latest tag, which now resolves to a legacy artifact. Registry state re-verified independently today (2026-10-08, docker buildx imagetools + docker pull):

	Current pin sha256:4f88a5e...	Proposed sha256:9b6105b...
Created	current build (OCI index, provenance attestation)	2021-08-29 (verified via image config)
Base / package manager	Fedora-family (microdnf/dnf)	Debian (env DEBIAN_FRONTEND=noninteractive; no dnf/microdnf)
User / entry	wolf gamescope-wl stack	USER retro, Cmd=/bin/sh -c /bin/bash /startup.sh (pre-rename X11 era, source label games-on-whales/gow)
Size (compressed)	~785 MB, 24 layers	~199 MB, 6 layers

Tag state: :fedora → sha256:4f88a5e... (identical to our current pin), :latest → the 2021 image (the proposed digest). Upstream repointed latest at the legacy Debian build; Renovate follows latest.

Breaking Changes

• Build breaks: apps/games-on-whales-steam/Dockerfile:79-80 installs curl ca-certificates via microdnf/dnf. The Debian image has neither. CI on this PR's latest commit (c691cc2, run 37795525623, 2026-10-08) failed: #15 0.044 /bin/sh: 1: dnf: not found → exit code 127.
• Architecture mismatch: this image exists to carry the NVIDIA 595.71.05 userspace overlay for the gamescope-wl/wolf stack (Dockerfile header, apps/games-on-whales-steam/tests.yaml asserts /opt/nv71 sonames). The 2021 X11 image predates that stack entirely.

Code Changes Required

Do not merge this digest. To stop Renovate re-proposing it (read-only checkout here — a maintainer must apply):

1. apps/games-on-whales-steam/Dockerfile:75 — pin the tag explicitly so Renovate tracks the Fedora lineage instead of latest:
   FROM ghcr.io/games-on-whales/steam:fedora@sha256:4f88a5e363c783791fbbe432661d70d6775629fa8c74038b21622477cf20e0ab
2. Close this PR (unmerged) — future digest updates will then track :fedora.
3. Optionally ask upstream (games-on-whales/gow) why latest was repointed at the 2021 Debian build.

Security Impact

Regression, not improvement: the proposed image was built 2021-08-29 on a Debian base with ~5 years of unpatched CVEs (base packages, steam bootstrap, tooling). The currently pinned Fedora image is actively rebuilt upstream. Rejecting this PR avoids importing a large unpatched attack surface into a GPU-accelerated, network-exposed gaming container.

Recommendation

Requires code changes — the PR does not build (CI: dnf: not found, exit 127, run 37795525623) because the new digest points to a 2021 Debian-based legacy image, not the Fedora gamescope-wl build this Dockerfile targets. Apply the :fedora tag-pinning change above, then close this PR.

[github-actions]

Renovate PR Analysis

(Re-analysis: Renovate re-pushed this branch at 2026-10-08T17:13:47Z — head is now de6d5200 — after the previous analysis comment at 17:05:35Z. The digest transition is unchanged; all facts below re-verified today against the registry, the current head, and current CI.)

Update Summary

• Dependency: ghcr.io/games-on-whales/steam — runtime base of the FINAL stage of apps/games-on-whales-steam/Dockerfile:75
• Version: sha256:4f88a5e3… → sha256:9b6105b… (digest pin; Renovate follows the implicit latest tag)
• Type: digest

Release Changes

No upstream release notes exist for this package (the games-on-whales/steam repo returns 404; the org's active repo is games-on-whales/gow). Verified registry state, 2026-10-08 (docker buildx imagetools inspect):

	Current pin sha256:4f88a5e…	Proposed sha256:9b6105b…
Tag that serves it	:fedora (verified today)	:latest (verified today)
Manifest	OCI index, amd64 56b2cd2… + provenance attestation	bare single-platform Docker v2 manifest, 6 layers, ~199 MB
Generation	current Fedora/gamescope-wl build	legacy-generation build (image config previously pulled and inspected at this exact digest: created 2021-08-29, Debian/Ubuntu-family apt image, USER retro, Cmd /bin/sh -c /bin/bash /startup.sh, no dnf/microdnf, no gamescope)

Digests are content-addressed and immutable — today's manifest of 9b6105b… matches what those earlier pulls inspected, so those config facts hold for this PR unchanged.

Breaking Changes

Yes — build-breaking, re-verified on the current head de6d5200 (run 37814935842, job 113441212189, 2026-10-08T17:14Z):

1. apps/games-on-whales-steam/Dockerfile:79-80 — RUN (command -v microdnf …) || (dnf install …) fails with /bin/sh: 1: dnf: not found, exit code 127, ERROR: failed to solve. The proposed image has neither microdnf nor dnf (the "Fedora-family" premise at Dockerfile:77-78 does not hold for this digest).
2. Architecture mismatch: the image exists to carry the NVIDIA 595.71.05 overlay for the gamescope-wl/wolf stack (Dockerfile:1-21, 72-75); the 2021 legacy image predates that stack entirely (no gamescope, X11 /startup.sh era).
3. tests.yaml only asserts /opt/nv71 files copied from the fetch stage (apps/games-on-whales-steam/tests.yaml:4-16), so the build failure is the only automated blocker — worth hardening separately.

Code Changes Required

Do not merge this digest. A maintainer must (read-only checkout in this workflow — files cannot be edited here):

1. apps/games-on-whales-steam/Dockerfile:75 — name the tag explicitly so Renovate tracks the Fedora lineage instead of latest:
   FROM ghcr.io/games-on-whales/steam:fedora@sha256:4f88a5e363c783791fbbe432661d70d6775629fa8c74038b21622477cf20e0ab
2. Update the note at Dockerfile:72-74 to reference the :fedora tag channel.
3. Close this PR unmerged — once the pin names :fedora, future digest bumps track the correct image. Optionally harden tests.yaml (assert gamescope/steam on PATH, /etc/os-release Fedora-family) and ask upstream (games-on-whales/gow) why latest points at the 2021 legacy build.

Security Impact

Regression, not an update: the proposed base was created 2021-08-29 on a Debian-family base with roughly five years of unpatched CVEs (OS packages, graphics stack, Steam client bootstrap), replacing the actively-built Fedora image, in a GPU-accelerated, network-exposed gaming container. Rejecting this PR avoids importing that attack surface.

Recommendation

Requires code changes — do not merge. The PR does not build (CI on current head: dnf: not found, exit 127) because the proposed digest is a 2021 legacy image, not the Fedora gamescope-wl build this Dockerfile targets. Apply the :fedora tag-pinning change above, then close this PR.