[WIP] docker: don't ignore version tag when consolidating dependencies

[mctofu]

Some early work to try and resolve #3173.

This causes the docker file parser to consider the tag in addition to
the image name when extracting dependencies. Previously php:8.0.1-apache and
php:8.0.1-cli would be treated as the same dependency which caused them
to both get updated to php:8.0.3-apache. With the change they are
treated as separate dependencies and get updated to php:8.0.3-apache and
php:8.0.3-cli in separate PRs.

Does this seem like the right place to address this or should we try to handle this when doing updates?

One downside of this is that if we had a reference to php:8.0.1-cli and php:8.0.2-cli they would be treated as 2 different dependencies and you'd end up with an update PR for each. We could address this later by making the deduplication smarter and allowing php:8.0.1-cli and php:8.0.2-cli to be combined but not php:8.0.1-apache.

With this change it parsed these dependencies from my test fixture:

[
  {
    "name": "php",
    "version": "8.0.1-apache",
    "requirements": [
      {
        "requirement": null,
        "groups": [

        ],
        "file": "Dockerfile",
        "source": {
          "tag": "8.0.1-apache"
        }
      },
      {
        "requirement": null,
        "groups": [

        ],
        "file": "Dockerfile.ci",
        "source": {
          "tag": "8.0.1-apache"
        }
      }
    ],
    "package_manager": "docker"
  },
  {
    "name": "php",
    "version": "8.0.1-cli",
    "requirements": [
      {
        "requirement": null,
        "groups": [

        ],
        "file": "Dockerfile.cli",
        "source": {
          "tag": "8.0.1-cli"
        }
      }
    ],
    "package_manager": "docker"
  }
]

and resulted in this output:

=> updating 2 dependencies: php, php

=== php (8.0.1-apache)
 => checking for updates 1/2
 => latest available version is 8.0.3-apache
 => latest allowed version is 8.0.3-apache
 => requirements to unlock: own
 => requirements update strategy: 
 => updating php from 8.0.1-apache to 8.0.3-apache

    ± Dockerfile
    ~~~
    1c1
    < FROM php:8.0.1-apache
    ---
    > FROM php:8.0.3-apache
    ~~~

    ± Dockerfile.ci
    ~~~
    1c1
    < FROM php:8.0.1-apache
    ---
    > FROM php:8.0.3-apache
    ~~~

=== php (8.0.1-cli)
 => checking for updates 2/2
 => latest available version is 8.0.3-cli
 => latest allowed version is 8.0.3-cli
 => requirements to unlock: own
 => requirements update strategy: 
 => updating php from 8.0.1-cli to 8.0.3-cli

    ± Dockerfile.cli
    ~~~
    1c1
    < FROM php:8.0.1-cli
    ---
    > FROM php:8.0.3-cli
    ~~~

Prior to the change the dependences parsed as:

[
  {
    "name": "php",
    "version": "8.0.1-apache",
    "requirements": [
      {
        "requirement": null,
        "groups": [

        ],
        "file": "Dockerfile",
        "source": {
          "tag": "8.0.1-apache"
        }
      },
      {
        "requirement": null,
        "groups": [

        ],
        "file": "Dockerfile.ci",
        "source": {
          "tag": "8.0.1-apache"
        }
      },
      {
        "requirement": null,
        "groups": [

        ],
        "file": "Dockerfile.cli",
        "source": {
          "tag": "8.0.1-cli"
        }
      }
    ],
    "package_manager": "docker"
  }
]

and resulted in this output:

=> updating 1 dependencies: php

=== php (8.0.1-apache)
 => checking for updates 1/1
 => latest available version is 8.0.3-apache
 => latest allowed version is 8.0.3-apache
 => requirements to unlock: own
 => requirements update strategy: 
 => updating php from 8.0.1-apache to 8.0.3-apache

    ± Dockerfile
    ~~~
    1c1
    < FROM php:8.0.1-apache
    ---
    > FROM php:8.0.3-apache
    ~~~

    ± Dockerfile.ci
    ~~~
    1c1
    < FROM php:8.0.1-apache
    ---
    > FROM php:8.0.3-apache
    ~~~

    ± Dockerfile.cli
    ~~~
    1c1
    < FROM php:8.0.1-cli
    ---
    > FROM php:8.0.3-apache
    ~~~

[feelepxyz]

This is a nice and simple fix! I'm slightly worried of changes that introduce more PRs as grouped updates is also one the most requested features.

Reckon the file updater is right place for this fix if we want to keep the grouped update aspect. Maybe we could use the same approach and expand the dependency into two at the file updating stage and apply each each on in turn on the same manifest?

[mctofu]

Reckon the file updater is right place for this fix if we want to keep the grouped update aspect. Maybe we could use the same approach and expand the dependency into two at the file updating stage and apply each each on in turn on the same manifest?

That was a good idea @feelepxyz! I spent a little time experimenting with that and ended up with #3277. One thing I'm struggling with there is that if we only return a single dependency in FileParser then UpdateChecker.latest_version has difficulty with situations where only some of the tags need updating. For ex, if it found php:8.0.3-apache and php:8.0.1-cli it sees that php:8.0.3-apache is up to date and stops there. Is there a way we've worked around that in other ecosystems?

[mctofu]

We ended up going with #3277 to keep the updates in a single PR.