Skip to content

enable dependabot docker ecosystems - #49

Open
UiP9AV6Y wants to merge 1 commit into
NETWAYS:mainfrom
UiP9AV6Y:feature/dependabot-docker
Open

UiP9AV6Y wants to merge 1 commit into
NETWAYS:mainfrom
UiP9AV6Y:feature/dependabot-docker

Conversation

@UiP9AV6Y

Copy link
Copy Markdown
Contributor

update containerfile image references as well as image references in docker-compose files.

the image references in the Dockerfile have been replaced with tags that less volatile, i.e. include version information.

the builder image stage has been downgraded from 1.27 (latest) to 1.26, as this is the same version go.mod declares as base requirement.

update containerfile image references as well as image references
in docker-compose files.

the image references in the Dockerfile have been replaced with
tags that less volatile, i.e. include version information.

the builder image stage has been downgraded from 1.27 (latest)
to 1.26, as this is the same version go.mod declares as base
requirement.
Comment thread .github/dependabot.yml
interval: monthly

- package-ecosystem: docker
directory: "/"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure yet if I want the dependabot to look at everything. I'm already swamped with dependabot PRs. Maybe let's have it look at only the Dockerfile that is used for the main Image

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wdym? the docker ecosystem searches for Dockerfile/Containerfile files; the repository currently only contains one such file: /Dockerfile

what other files are you expecting to be managed by this ecosystem?

Comment thread Dockerfile

# Build Image
FROM docker.io/golang:latest as builder
FROM docker.io/golang:1.26-trixie AS builder

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could bump the go.mod to 1.27 - should be no problem.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i downgraded the compiler in the image as i consider the go.mod file to be the authority over the used golang version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants