Renovate pins an invalid image digest into the Helm chart values

[BergCyrill]

Problem

The docker:pinDigests preset applies to the helm-values manager and rewrites
controller.image.tag / webhook.image.tag in
charts/dependency-controller/values.yaml from "" to "@sha256:…".

These are not external dependencies. Both images are built from this repo, and
helm-publish.yaml overwrites the chart's version and appVersion from the git
tag at publish time. The empty image.tag deliberately inherits .Chart.AppVersion,
which is what keeps chart and images co-versioned from the same commit.

Renovate tracking them therefore creates a feedback loop: docker.yaml publishes on
every push to main, so the digest changes on every merge, so Renovate opens another
pin PR — each one pinning the chart to the image built from the previous commit.
Proposed twice already (#119, #134); closing it just regenerates it with fresh digests.

Secondary symptom: the pinned value also renders an invalid reference, because the
templates emit "{{ .repository }}:{{ .tag | default .Chart.AppVersion }}":

image: "ghcr.io/opendefensecloud/dependency-controller:@sha256:1d0b2cea…"

helm lint and helm template do not validate reference syntax, so CI goes green.

Solution

Exclude both chart images from Renovate:

{
  "matchManagers": ["helm-values"],
  "matchPackageNames": [
    "ghcr.io/opendefensecloud/dependency-controller",
    "ghcr.io/opendefensecloud/dependency-webhook"
  ],
  "enabled": false
}

Then close #134.

Note: "fix the template to accept a digest" is not the fix. It would produce valid
YAML while still overriding the appVersion coupling and still looping on every merge.