sourceUrl in packageRules doesn't override datasource value from Docker OCI labels

[camjay]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform and version.

GitHub Enterprise Server 3.15.7, Renovate 43.19.2. Fix branch is based on current main (commit 4fce8ec).

Describe the problem

We mirror Docker images to an internal Harbor registry. The upstream images have org.opencontainers.image.source labels pointing to their GitHub repos, which Renovate reads as sourceUrl. We want our Renovate PRs to link to Harbor instead, so we set sourceUrl in packageRules:

{
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "matchPackagePatterns": ["^harbor\\.example\\.com/"],
      "sourceUrl": "https://harbor.example.com/project/repo"
    }
  ]
}

The override gets picked up — you can see it applied in debug logs during the source-url stage of applyPackageRules. But the PRs still link to the upstream GitHub repo, not Harbor.

Root cause

I traced this through lib/workers/repository/process/lookup/index.ts. Here's what happens:

1. assignKeys copies sourceUrl from the datasource result (the OCI label value) into res
2. applyPackageRules runs at the 'source-url' stage, and the user's packageRule override is applied to config
3. But config.sourceUrl is never written back to res.sourceUrl — so the datasource value sticks

The override works fine for datasources that don't provide their own sourceUrl, since there's nothing to overwrite. It only fails when the datasource has a value (like Docker images with OCI labels) that takes precedence.

Fix

I have a one-line fix with a test — PR incoming. The fix writes config.sourceUrl back to res.sourceUrl after the source-url stage when the values differ.

Related

• Allow user configuration of sourceUrl #16011 — original feature request for user-configurable sourceUrl
• Add sourceUrl, sourceDirectory to packageRules #29385 — added sourceUrl/sourceDirectory to packageRules

[hishamanver]

any update on this?

I am also facing this issue when using the custommanager: regex option to pick up docker dependencies

I want to override the sourceUrl using renovate.json, but it seems to still only use values picked up from docker registry metadata