Repository navigation
ci(deps): bump the published images' bases within their version only - #298
Merged
Merged
Conversation
Dependabot's first docker pull request moved the service-db bases across versions (postgres 16 to 18, python 3.12 to 3.15, pgweb 0.16 to 0.17), and the gateway integration jobs failed on it. The docker entry was meant to bring a base's fixes into the published images: it now ignores major and minor version updates, so it proposes a base's new digest or patch release only, and an upgrade is made by hand with whatever the images run on it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why. #295 is Dependabot's first pull request from the docker entry #283 added. It moves the service-db bases across versions:
integration-local-gatewayandintegration-local-slowfail on it. Postgres 18's official image also moves where it keeps its data. The entry was meant to bring a base's fixes into the published images, not to upgrade them every week.Change
version-update:semver-majorandversion-update:semver-minorfor every base. It still proposes a base's new digest, or a patch release of the version it's on. An upgrade is made by hand, together with whatever the images run on that base.test_dependabot_proposes_a_bases_fixes_and_never_an_upgradekeeps the ignore in place.After merge: close #295. Its version bumps are no longer proposed. Dependabot's next weekly run opens digest or patch refreshes only.
Verified: the release workflow's tests pass (34), and the config parses.
🤖 Generated with Claude Code
The PR appears safe to merge; no actionable issues were found.Summary
Restricts Docker base updates without changing image pins.
Reviews (1) · Last reviewed commit: "ci(deps): bump the published images' bas..." · Reviewed by Greptile