pre-commit: bare SHA revs treated as versions, and frozen metadata bleeds onto matching bare SHAs

[RahulGautamSingh]

Discussed in #44337

^{Originally posted by shaanmajid July 2, 2026}

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.249.5

Please tell us more about your question or problem

The pre-commit manager currently extracts repository rev values that are bare full or short Git SHAs as currentValue.

A bare SHA is an unversioned commit reference, not a tag/version. Renovate should not compare it through github-tags/gitlab-tags unless the config also has a supported version comment marker:

rev: <sha> # frozen: <version>

This is analogous to the GitHub Actions behavior fixed in #42398. This can matter because github-tags uses Renovate's default versioning, so a SHA-like string in currentValue may be interpreted through semver-coerced. For example, a commit SHA starting with digits can be treated as a version-like value even though it is an unversioned commit reference.

(There is a secondary, more nuanced issue -- I'm less sure what the desired behavior here should be. But the regex enrichment is keyed only by digest, so if the same SHA appears once without a frozen comment and once with a frozen comment, the frozen version metadata can be applied to the bare occurrence too.)

MRE

renovate.json:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":enablePreCommit"]
}

.pre-commit-config.yaml:

repos:
  # Case 1: full SHA with frozen comment.
  # Expected: valid digest-pinned dependency for version v3.1.0.
  # Actual: works correctly.
  - repo: https://github.com/pre-commit/mirrors-prettier
    rev: ffb6a759a979008c0e6dff86e39f4745a2d9eac4 # frozen: v3.1.0
    hooks:
      - id: prettier

  # Case 2: bare full SHA, no frozen comment.
  # Expected: disabled unversioned ref.
  # Actual: treated as currentValue instead.
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 745be0411e3c150e246d527e531e5a221b8c3462
    hooks:
      - id: ruff-check

  # Case 3: bare short SHA, no frozen comment.
  # Expected: disabled unversioned ref.
  # Actual: treated as currentValue instead.
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 745be0
    hooks:
      - id: ruff-format

  # Case 4: full SHA with frozen comment.
  # Expected: valid digest-pinned dependency for version v5.0.0.
  # Actual: works correctly in isolation.
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # frozen: v5.0.0
    hooks:
      - id: end-of-file-fixer

  # Case 5: same full SHA, no frozen comment.
  # Expected: disabled unversioned ref.
  # Actual: can inherit frozen metadata from Case 4.
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b
    hooks:
      - id: trailing-whitespace

Output:

[
  {
    "depName": "pre-commit/mirrors-prettier",
    "currentValue": "v3.1.0",
    "currentDigest": "ffb6a759a979008c0e6dff86e39f4745a2d9eac4",
    "versioning": "semver-coerced",
    "updates": []
  },
  {
    "depName": "astral-sh/ruff-pre-commit",
    "currentValue": "745be0411e3c150e246d527e531e5a221b8c3462",
    "currentDigest": null,
    "versioning": "semver-coerced",
    "updates": []
  },
  {
    "depName": "astral-sh/ruff-pre-commit",
    "currentValue": "745be0",
    "currentDigest": null,
    "versioning": "semver-coerced",
    "updates": []
  },
  {
    "depName": "pre-commit/pre-commit-hooks",
    "currentValue": "v5.0.0",
    "currentDigest": "cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b",
    "versioning": "semver-coerced",
    "updates": [{"newValue":"v6.0.0","newDigest":"3e8a8703264a2f4a69428a0aa4dcb512790b2c8c"}]
  },
  {
    "depName": "pre-commit/pre-commit-hooks",
    "currentValue": "v5.0.0",
    "currentDigest": "cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b",
    "versioning": "semver-coerced",
    "updates": [{"newValue":"v6.0.0","newDigest":"3e8a8703264a2f4a69428a0aa4dcb512790b2c8c"}]
  }
]

Logs (if relevant)

No response