build: refactor Dockerfile

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,18 +1,16 @@
 ## What
 
-## Why
-
-## Notes
-<!-- Add any notes here -->
-
-## Labels
-
-Assign the following labels to the PR:
-
-`security` - to trigger image scanning in CI build
+<!--
+Describe the changes briefly yet comprehensively.
+Link relevant Linear issues, e.g.:
+Closes CF-1234
+-->
 
 ## PR Comments
 
 Add the following comments to the PR:
 
-`/e2e` - to trigger E2E build
+* `/e2e` - to trigger E2E build
+* `/bump patch` - to bump the patch version
+* `/bump minor` - to bump the minor version
+* `/bump major` - to bump the major version

.github/actions/bump-version/action.yml

@@ -0,0 +1,87 @@
+name: Bump version
+description: Compute and apply a semver bump to service.yaml, commit, push, and report on the PR.
+
+inputs:
+  bump:
+    description: Version component to bump (major, minor, or patch)
+    required: true
+  base:
+    description: Base branch name
+    required: true
+  head:
+    description: Head branch name
+    required: true
+  pr:
+    description: Pull request number
+    required: true
+  github-token:
+    description: GitHub token
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Check out PR branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.head }}
+        fetch-depth: 0
+        token: ${{ inputs.github-token }}
+
+    - name: Compute and apply version bump
+      id: bump
+      shell: bash
+      env:
+        BUMP: ${{ inputs.bump }}
+        BASE: ${{ inputs.base }}
+      run: |
+        git fetch origin "$BASE" --depth=1
+        base_version=$(git show "origin/$BASE:service.yaml" | grep '^version:' | awk '{print $2}')
+        echo "Base ($BASE) version: $base_version"
+
+        IFS='.' read -r major minor patch <<< "$base_version"
+        case "$BUMP" in
+          major) major=$((major + 1)); minor=0; patch=0 ;;
+          minor) minor=$((minor + 1)); patch=0 ;;
+          patch) patch=$((patch + 1)) ;;
+        esac
+        new_version="${major}.${minor}.${patch}"
+        echo "New version: $new_version"
+        echo "new_version=$new_version" >> "$GITHUB_OUTPUT"
+        echo "base_version=$base_version" >> "$GITHUB_OUTPUT"
+
+        # Reset to base version first, then apply bump — result depends only on
+        # base branch, never on a previous bump.
+        sed -i "s/^version:.*/version: $new_version/" service.yaml
+
+        if git diff --quiet -- service.yaml; then
+          echo "changed=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Commit and push
+      if: steps.bump.outputs.changed == 'true'
+      shell: bash
+      env:
+        NEW_VERSION: ${{ steps.bump.outputs.new_version }}
+        HEAD: ${{ inputs.head }}
+      run: |
+        git config user.name 'github-actions[bot]'
+        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+        git add service.yaml
+        git commit -m "ci: bump version to ${NEW_VERSION}"
+        git push origin "HEAD:${HEAD}"
+
+    - name: Report result
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        PR: ${{ inputs.pr }}
+      run: |
+        if [ '${{ steps.bump.outputs.changed }}' = 'true' ]; then
+          body="✅ Bumped version to \`${{ steps.bump.outputs.new_version }}\` (\`${{ inputs.bump }}\` from \`${{ steps.bump.outputs.base_version }}\` on \`${{ inputs.base }}\`)."
+        else
+          body="ℹ️ Version is already \`${{ steps.bump.outputs.new_version }}\` (\`${{ inputs.bump }}\` from \`${{ steps.bump.outputs.base_version }}\` on \`${{ inputs.base }}\`). Nothing to do."
+        fi
+        gh pr comment "$PR" --repo "${{ github.repository }}" --body "$body"

.github/dependabot.yml

@@ -0,0 +1,37 @@
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+
+registries:
+  docker-registry:
+    type: docker-registry
+    url: https://registry.hub.docker.com
+    username: ${{ secrets.DOCKERHUB_USERNAME }}
+    password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+multi-ecosystem-groups:
+  docker-weekly:
+    schedule:
+      interval: "weekly"
+
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    registries: "*"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependabot"
+      - "review-required"
+      - "docker"
+    multi-ecosystem-group: "docker-weekly"
+    patterns:
+      - "*"
+    ignore:
+      - dependency-name: "octopusdeploy/dhi-debian-base"
+        update-types:
+          - version-update:semver-major
+      - dependency-name: "docker/compose-bin"
+        update-types:
+          - version-update:semver-major

.github/workflows/version-bump.yml

@@ -0,0 +1,81 @@
+name: Bump version on comment
+
+# Bumps the "version" field in service.yaml when a maintainer comments
+# "/bump major", "/bump minor" or "/bump patch" on a pull request.
+#
+# The new version is always computed relative to the PR's target (base) branch,
+# so commenting several times only ever produces a single bump from the base —
+# it never stacks on top of a previous comment.
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump-version:
+    # Only run on PR comments, only for users that can write to the repo, and
+    # only when the comment is one of the supported /bump commands.
+    if: >
+      github.event.issue.pull_request &&
+      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) &&
+      (startsWith(github.event.comment.body, '/bump major') ||
+       startsWith(github.event.comment.body, '/bump minor') ||
+       startsWith(github.event.comment.body, '/bump patch'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: Acknowledge command
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            --method POST \
+            "/repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" \
+            -f content='eyes'
+
+      - name: Parse command
+        id: parse
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          # Pass the comment via env (never interpolated into the script) to
+          # avoid shell injection from untrusted comment content.
+          # Only parse the first line: integrations (e.g. Linear) may append
+          # extra lines such as "<!-- linear:isThreadRoot -->".
+          bump=$(printf '%s' "$COMMENT_BODY" | awk 'NR==1{print $2}')
+          case "$bump" in
+            major|minor|patch)
+              echo "bump=$bump" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::error::Unsupported version command: '$bump'"
+              exit 1
+              ;;
+          esac
+
+      - name: Resolve PR branches
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr view "${{ github.event.issue.number }}" \
+            --repo "${{ github.repository }}" \
+            --json headRefName,baseRefName \
+            > pr.json
+          echo "head=$(jq -r .headRefName pr.json)" >> "$GITHUB_OUTPUT"
+          echo "base=$(jq -r .baseRefName pr.json)" >> "$GITHUB_OUTPUT"
+
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Bump version
+        uses: ./.github/actions/bump-version
+        with:
+          bump: ${{ steps.parse.outputs.bump }}
+          base: ${{ steps.pr.outputs.base }}
+          head: ${{ steps.pr.outputs.head }}
+          pr: ${{ github.event.issue.number }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -1,6 +1,4 @@
-# CI relies on this ARG. Don't remove or rename it
-ARG COMPOSE_VERSION=v5.2.0
-FROM docker/compose-bin:${COMPOSE_VERSION} AS compose-bin
+FROM docker/compose-bin:v5.2.0@sha256:54c280c16d23289af63a9391626e3d09ddcd1253d4a5eef1f6ed52a531168e91 AS compose-bin
 
 
 # DHI source: https://hub.docker.com/repository/docker/octopusdeploy/dhi-debian-base

service.yaml

@@ -1 +1 @@
-version: 1.6.7
+version: 1.6.8