chore(ci): pin the catalog at v6.0.0, drop the removed verify needs_job input
39 catalog pins move v4.0.2 to v6.0.0.
The bump does not compose without dropping needs_job
Catalog v6.0.0 removed verify's needs_job input, so all seven verify includes here fail resolution with unknown input arguments: needs_job. Caught by POST /projects/:id/ci/lint before pushing, not by a red pipeline.
Removing it changes nothing at runtime. The input was declared and never referenced: no v4.x verify template body produced a needs: from it, and the template says so in a comment, "No needs: verify is stage-gated so it runs after the whole build+sign". This project's stages run build before verify, so the ordering the input appeared to provide was always coming from the stage list.
The v6.0.0 release notes do not list that removal as breaking. Fixed separately in the catalog, so the next consumer bumping v4 to v5 does not pay for it twice.
Why this is a manual bump: Renovate cannot push here
Renovate detected this bump and could not deliver it. Every update sits in the Dependency Dashboard under Errored with Error updating branch, and there are zero renovate/* branches. Three push rules reject the bot:
| Rule | Why it is fatal |
|---|---|
reject_unsigned_commits |
Renovate has no signing key configured anywhere in the estate |
commit_committer_check |
the git author is renovate@bot.local, a domain no account can verify |
member_check |
same unverifiable identity |
This project is the only one of 58 in gitlab-com/public-sector/ carrying any of them, and the only one whose updates are all detected-but-errored. Every project that has dependencies and lacks these rules gets branches. branch_name_regex already allows renovate/.+, so the branch names were anticipated; the identity rules are what block it.
Until that is resolved, this project receives no dependency updates at all and every bump is manual. Two ways forward, and the choice is a posture decision rather than a fix: drop the three rules so this project matches its 57 siblings, or provision a signing identity for Renovate (gitPrivateKey plus a verifiable author email) and keep signed commits estate-wide.
Verification
POST /projects/:id/ci/lint against this branch: valid, no new warnings.
Updated to v6.0.0. This originally proposed v5.0.0. That tag shipped container with an image: that resolves to nothing, so every container build fails on buildah: command not found. Fixed in the catalog and released as v6.0.0, whose ci-buildah:v6.0.0 is published. Verified at runtime rather than by lint alone: kaniko's seven container jobs, which were exit 127 on v5.0.0, are green on v6.0.0.