chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.129.0

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/kimdre/doco-cd	minor	0.127.0 → 0.129.0

---

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

v0.129.0

Compare Source

What's Changed

• The access token file for the OpenBao external secrets provider now supports live token rotation without requiring a doco-cd restart.
• Early source/configuration failures and skipped webhook runs now report commit status under doco-cd/<target>/deploy when a configuration target is set to keep reports for different targets separate on the same commit.

🌟 Improvements

• fix: make obsolete-stack cleanup conservative and retryable by @​kimdre in #​2068
• fix(openbao): reload access token file before each operation by @​kimdre in #​2073
• fix(commitstatus): retain targets in run-level reports by @​kimdre in #​2074

📦 Dependencies

• chore(deps): update docker:29-dind docker digest to 3e5756e by @​renovate[bot] in #​2070
• chore(deps): update dependency zensical to v0.0.71 by @​renovate[bot] in #​2071
• fix(deps): update module github.com/getkin/kin-openapi to v0.151.0 by @​renovate[bot] in #​2072

Full Changelog: kimdre/doco-cd@v0.128.0...v0.129.0

v0.128.0

Compare Source

What's Changed

• Docker Compose v5.6.0 changed the behavior of pre_start container lifecycle hooks. Because of this, scheduled jobs that combine cd.doco.job.execution_mode: one_off with pre_start hooks are now rejected with an error. You need to use restart execution_mode instead. See also the note in the wiki.
• Restart-mode scheduled jobs now also run their pre_start hooks on every execution, not only on the first one.
• Added a new app setting VERSION_CHECK_ENABLED (default: true) to disable the lookup and notification for new doco-cd versions on app startup.
• Added optional automatic deployment retry budgets and delays for Compose projects and Swarm stacks, see retry settings in the wiki.
• Added an optional boolean pause deployment setting that freezes changes without stopping existing workloads, see pause settings in the wiki.
• Errors in Github commit check messages are no longer truncated in the check description.

✨ Features

• feat(config): add option to disable startup version checks by @​kimdre in #​2040
• feat(deploy): add retry budgets and delays by @​kimdre in #​2041
• feat(deploy): add per-deployment pause setting by @​kimdre in #​2062

🌟 Improvements

• fix(commitstatus): preserve full errors in GitHub check summaries by @​kimdre in #​2067

🐛 Bug Fixes

• fix(docker): ignore compose hook containers in service inventory by @​kimdre in #​2045
• fix(reconciliation): ignore compose hook runner events by @​kimdre in #​2046
• fix(docker): prepare fresh pre_start runners for scheduled restarts by @​kimdre in #​2047
• fix(docker): reject pre_start hooks for compose one-off jobs by @​kimdre in #​2048
• fix(docker): honor compose hooks in direct lifecycle operations by @​kimdre in #​2052
• fix(validation): avoid copying live dependency state by @​kimdre in #​2057
• fix(docker): prevent stopped services with autostart disabled from triggering redeploys by @​kimdre in #​2061

📦 Dependencies

• chore(deps): update dependency zensical to v0.0.70 by @​renovate[bot] in #​2038
• chore(deps): update golang:1.27.2 docker digest to 007a316 by @​renovate[bot] in #​2042
• chore(deps): update dependency markdown-exec to v1.12.5 by @​renovate[bot] in #​2054
• chore(deps): update golang:1.27.2 docker digest to 8201530 by @​renovate[bot] in #​2053
• fix(deps): update module github.com/docker/cli to v29.9.1+incompatible by @​renovate[bot] in #​2055
• fix(deps): update module github.com/sigstore/sigstore to v1.11.1 by @​renovate[bot] in #​2056
• chore(deps): update github/codeql-action digest to 6f2ac81 by @​renovate[bot] in #​2063
• fix(deps): update module github.com/getkin/kin-openapi to v0.150.0 by @​renovate[bot] in #​2066
• fix(deps): update module github.com/azure/azure-sdk-for-go/sdk/azidentity to v1.15.0 by @​renovate[bot] in #​2064

📚 Miscellaneous

• test: stabilize Compose hooks and OCI registry lifecycle by @​kimdre in #​2058

Full Changelog: kimdre/doco-cd@v0.127.0...v0.128.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anitrend]

OpenCode Dependabot Risk Review

Schema: local-stack.dependabot-risk.v1

Decision: NEUTRAL
Risk: MEDIUM
Automerge allowed: false
Update type: semver-minor
Ecosystem: docker

Summary

Renovate[bot] bumps the doco-cd deployment controller image from 0.127.0 to 0.129.0 in doco-cd/docker-compose.yml only. The diff is a single image tag change, no generated stacks, workflows, secrets, or stack-rendering tools are touched, and the dependency is a plain Docker update. However, this is a two-minor-version jump of the in-cluster deployment orchestrator (it mounts /var/run/docker.sock and drives deploys for this stack), and the covered v0.128.0 release notes document a behavioral/breaking change to pre_start hook handling for one_off scheduled jobs. The repo does not appear to use scheduled jobs or pre_start hooks, so no direct blocker for this configuration was found, but the update is not a clean low-risk patch-class approve.

Changed runtime artifacts

Image / dependency	From	To	Risk note
ghcr.io/kimdre/doco-cd	0.127.0	0.129.0	minor update spanning two minor releases (0.128.0 and 0.129.0); release notes for v0.128.0 flag a behavior change where scheduled jobs combining execution_mode: one_off with pre_start hooks are now rejected under Docker Compose v5.6.0. This repo's .doco-cd.yml uses polling/reconciliation only and defines no such jobs, but doco-cd is the self-hosted deployment controller, so it is runtime-sensitive.

Runtime impact

Rolling recreation of the doco-cd controller container; it briefly restarts the component that reconciles and deploys this stack (self-referential deploy). No stateful data service images are changed.

Breaking change assessment

v0.129.0 itself contains only additive features (OpenBao token rotation, commit status target retention). v0.128.0 documents a breaking behavior change: scheduled jobs combining 'execution_mode: one_off' with 'pre_start' hooks are now rejected and must use 'restart' instead. A repo-wide search found no 'pre_start', 'execution_mode', or one_off job scheduling in .doco-cd.yml or any service config, so the breaking change does not appear to apply here, but it was not empirically validated against a live controller.

Required checks

• ./stackctl.sh sync
• ./stackctl.sh up --dry-run --no-logs

Manual follow-up

• Confirm no scheduled doco-cd jobs rely on pre_start hooks with one_off execution_mode before adopting the v0.128.0 behavior change.
• Verify doco-cd reconciler reports healthy and continues polling refs/heads/dev after the controller restarts.

Sources checked

• Dependabot/Renovate metadata
• PR diff (.review/patch.diff, doco-cd/docker-compose.yml)
• Upstream kimdre/doco-cd release notes v0.128.0 and v0.129.0 (PR body)
• Repo .doco-cd.yml, doco-cd/swarm.fragment.yml, stacks/platform.yml

[anitrend]

OpenCode risk gate: neutral. Manual review required. Risk: medium. Reason: Renovate[bot] bumps the doco-cd deployment controller image from 0.127.0 to 0.129.0 in doco-cd/docker-compose.yml only. The diff is a single image tag change, no generated stacks, workflows, secrets, or stack-rendering tools are touched, and the dependency is a plain Docker update. However, this is a two-minor-version jump of the in-cluster deployment orchestrator (it mounts /var/run/docker.sock and drives deploys for this stack), and the covered v0.128.0 release notes document a behavioral/breaking change to pre_start hook handling for one_off scheduled jobs. The repo does not appear to use scheduled jobs or pre_start hooks, so no direct blocker for this configuration was found, but the update is not a clean low-risk patch-class approve.