fix: override PGSSLROOTCERT in psql container

postgis/test/check-extension.yaml

@@ -9,14 +9,18 @@ spec:
       containers:
       - name: data-test
         env:
+          # Clear the image-baked PGSSLROOTCERT=system so libpq doesn't
+          # try to verify the CNPG self-signed CA against the OS trust store.
+          - name: PGSSLROOTCERT
           - name: EXT_VERSION
             value: ($values.version)
           - name: DB_URI
             valueFrom:
               secretKeyRef:
                 name: (join('-', [$values.name, 'app']))
                 key: uri
-        image: alpine/psql:latest
+        # renovate: datasource=docker depName=alpine/psql versioning=docker
+        image: alpine/psql:18.4@sha256:51ef105226058360688250fedeac342f020b21d8d3e59dcf9c1fee04f638831c
         command: ['sh', '-c']
         args:
          - |

renovate.json

@@ -8,6 +8,7 @@
     ":automergeMinor",
     ":automergeDigest"
   ],
+  "ignorePaths": [],
   "enabledManagers": [
     "github-actions",
     "custom.regex"
@@ -51,15 +52,16 @@
       "datasourceTemplate": "deb"
     },
     {
-      "description": "updates the Taskfile and GitHub Actions workflow dependencies",
+      "description": "updates the Taskfile, test files and GitHub Actions workflow dependencies",
       "customType": "regex",
       "managerFilePatterns": [
         "Taskfile.yml",
-        ".github/workflows/*.yml"
+        ".github/workflows/*.yml",
+        "**/test/*.yaml"
       ],
       "matchStrings": [
         "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: currentValue=(?<currentValue>[^\\s]+?))?\\s+[A-Za-z0-9_]+?_SHA\\s*:\\s*[\"']?(?<currentDigest>[a-f0-9]+?)[\"']?\\s",
-        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+[^:]+\\s*:\\s*[\"']?(?<currentValue>[^@]+?)(@(?<currentDigest>sha256:[0-9a-f]+))?[\"']?\\s"
+        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?\\s+[^:]+\\s*:\\s*[\"']?(?:[a-zA-Z0-9._\/-]+:)?(?<currentValue>[^@]+?)(@(?<currentDigest>sha256:[0-9a-f]+))?[\"']?\\s"
       ]
     },
     {

test/check-extension.yaml

@@ -9,6 +9,9 @@ spec:
       containers:
       - name: data-test
         env:
+          # Clear the image-baked PGSSLROOTCERT=system so libpq doesn't
+          # try to verify the CNPG self-signed CA against the OS trust store.
+          - name: PGSSLROOTCERT
           - name: EXT_SQL_NAME
             value: ($values.sql_name)
           - name: EXT_VERSION
@@ -20,7 +23,8 @@ spec:
               secretKeyRef:
                 name: (join('-', [$values.name, 'app']))
                 key: uri
-        image: alpine/psql:latest
+        # renovate: datasource=docker depName=alpine/psql versioning=docker
+        image: alpine/psql:18.4@sha256:51ef105226058360688250fedeac342f020b21d8d3e59dcf9c1fee04f638831c
         command: ['sh', '-c']
         args:
          - |