Repository navigation
Conversation
Bumps the routine-controller-images group in /controller with 1 update: golang. Updates `golang` from 1.27.2-bookworm to 1.27.3-bookworm --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.3-bookworm dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-controller-images ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Nickfost
changed the title
|
@codex review Please review exact SOURCE Only Local source-scope assertions, all 46 Markdown link checks, whitespace, PR-title/four-commit policy checks and secret scanning of every proposed committed tree passed. Earlier controller tests on e649820 are historical evidence for unchanged controller inputs. The complete exact-head supervised required check remains pending with the execution owner, who retains the already-authorized isolated-native producer, VM and admission control. No duplicate local full suite or VM operation was performed here. No independent review or review request existed on this exact head when checked. Review findings only; SOURCE and BASE are frozen for the owner's single supervised run. Cursor Bugbot is unavailable and is not requested. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Updates the controller's digest-pinned Bookworm build image from Go 1.27.2 to Go 1.27.3. The upstream patch fixes crypto/x509 security issues. The exact reviewed image remains golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5, with Linux amd64 and arm64 manifests.
The prepared change was refreshed by an ordinary merge of actual main. The merge had no conflicts and preserved both prepared change blobs exactly. Against the final base, only controller/Dockerfile and docs/MANAGED-IMAGES.md differ. The runtime Debian image, module language version 1.26.3, scaleset 0.4.0, package pins, build flags, workflows, configuration selections and host state remain unchanged.
Frozen source
SOURCE: 25c5a09
BASE: e61831c
BASE TREE: 7a03ba7376e7e29bb820b168a42bd2a25ad2369f
TREE: f0ceeb0d578c1069224a7662d7786238efb98b5c
Ordered source parents:
No branch, source or base changes will be made during the execution owner's complete supervised required-check run. Later queue entries remain untouched.
Local verification
Earlier preparation on e649820 passed the controller Go tests and module verification with the verified Go 1.27.3 toolchain. That is earlier source evidence for unchanged controller inputs. No new controller test run, local full engine suite, image build or VM preparation is claimed in this refresh.
Review and execution
Independent review is required on the final SOURCE. Its request and result are recorded in the PR conversation. Neutral or unstarted Cursor checks are unavailable and do not supply approval. Cursor Bugbot is not requested.
The execution owner retains the already-authorized isolated-native producer used for #159, including its scoped one-job runners, admission controls, complete validation, export/hash/inventory verification, cleanup and eligible merge. This thread neither enables workflows nor operates the VM. The required Build without registering a runner check from GitHub Actions app 15368 passed on this exact SOURCE in run 41259792143 attempt 1. There is no new producer-authorization blocker or duplicate human approval request.
The owner retains the order #153, private artifact-contract #104, #156, #152, #155. This source freeze does not release a general VM slot or change held operations.
Documentation and rollout
docs/MANAGED-IMAGES.md records the Go version, immutable digest and upstream security notes while preserving the earlier selection's history. No visual experience changes. No configuration-template schema, capability, initializer, evidence format or operator-contract change is required for this routine compiler patch, so no template follow-up issue is needed.
The rebuilt controller binary and final managed-image identities can change. Image production, desired-state pin promotion, template/private adoption and live-host acceptance remain separate from this source PR. None is performed by this refresh.
Admitted native required-check run
The execution owner admitted the single complete supervised required-check run on the frozen SOURCE and BASE above after exact-head independent review. It uses the existing unchanged workflow on scoped one-job validation runners. The trigger changes only this PR description. No additional full local run, source change, pin promotion or host operation is authorized by this entry. The workflow and temporary runner selection returned to their previous settings after the build was assigned. Complete results and cleanup are now exported and verified.
Verified complete result
Required native run 41259792143 attempt 1 passed both jobs on the frozen SOURCE and BASE. The complete suite passed all eight stages, including tests/fixtures, embedded-template checks, image builds and cleanup. The official artifact 13069749872 has SHA256
9354c1bc4d8aa1e56c775e6871929b787ec032f0d9c4a32b8c3f16ae5d6dbe14; all nine safe ZIP members and all eight stage-log hashes were verified. Expected and actual test skips are empty. Complete Actions logs and retained runner diagnostics were exported outside Git. The runner removed its temporary result copy after upload; no independent worker-byte comparison is claimed.Cleanup and fresh disposable-worker admission passed at 2026-11-01T04:45:06Z. Both one-job runners exited and unregistered, validation cgroups and running containers are empty, temporary JIT material and sudo grant are removed, and the supported preparation path restored the accepted executor689. The existing four840 review-image tags and operator access remained unchanged. The required workflow is disabled again and the temporary runner variable is absent. Bugbot supplied no approval and was not requested. This source acceptance performs no image publication, desired-state promotion, live-host action, capacity change or storage recovery.