chore(deps): Bump the docker-images group across 1 directory with 2 updates - #1194
dependabot[bot] wants to merge 1 commit into
Conversation
…pdates Bumps the docker-images group with 2 updates in the /release/docker directory: distroless/cc-debian13 and rust. Updates `distroless/cc-debian13` from `c31ff9a` to `54df941` Updates `rust` from 1.95-trixie to 1.97-trixie --- updated-dependencies: - dependency-name: distroless/cc-debian13 dependency-version: nonroot dependency-type: direct:production dependency-group: docker-images - dependency-name: rust dependency-version: 1.97-trixie dependency-type: direct:production dependency-group: docker-images ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31e79e5f78
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e | ||
|
|
||
| FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder | ||
| FROM rust:1.97-trixie@sha256:b1b3c9c0d921d7fa0a6d1f9ec7e4eab87f8c8ec97644c3d791450f131dec813f AS builder |
There was a problem hiding this comment.
This recipe now builds under the Rust 1.97 base, but .github/workflows/release-candidate.yml:19, release/scripts/build-release-binaries.sh:220, and release/scripts/registry-release:147-150 still require and record the Rust 1.95 image. Consequently check-debian13-images.py fails, and if that check were bypassed the resulting binaries would be stamped with incorrect builder provenance. Update every canonical builder pin and provenance marker together with this base change.
AGENTS.md reference: AGENTS.md:L416-L418
Useful? React with 👍 / 👎.
| && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} + | ||
|
|
||
| FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime | ||
| FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime |
There was a problem hiding this comment.
All five runtime Dockerfiles now use this new Distroless digest, while release/scripts/check-debian13-images.py:67-70 and the five advisory baselines still bind the old base and layer identities. The image-contract command invoked by .github/workflows/ci.yml:131 and .github/workflows/release-candidate.yml:219 therefore fails immediately; after updating the policy constant, advisory verification will also reject the changed base until its security evidence is explicitly reviewed and renewed. Carry those guarded release updates with the digest bump.
AGENTS.md reference: AGENTS.md:L416-L418
Useful? React with 👍 / 👎.
| # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e | ||
|
|
||
| FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder | ||
| FROM rust:1.97-trixie@sha256:b1b3c9c0d921d7fa0a6d1f9ec7e4eab87f8c8ec97644c3d791450f131dec813f AS builder |
There was a problem hiding this comment.
Commit 76289b00032dbfdcee4fe166efbf17aad64da177 has no Signed-off-by: trailer, so it violates the repository's mandatory DCO policy and cannot be accepted as-is; recreate the commit with git commit -s before merging.
AGENTS.md reference: AGENTS.md:L405-L407
Useful? React with 👍 / 👎.
| # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e | ||
|
|
||
| FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder | ||
| FROM rust:1.97-trixie@sha256:b1b3c9c0d921d7fa0a6d1f9ec7e4eab87f8c8ec97644c3d791450f131dec813f AS builder |
There was a problem hiding this comment.
This grouped update changes both shared image identities only under release/docker, leaving docker/Dockerfile:25,60,99 on the old Rust builder and Distroless runtime digests even though check-debian13-images.py explicitly requires that maintained adopter Dockerfile to use the same RUST_BUILDER and DISTROLESS_RUNTIME values. Once the policy constants are updated for these new pins, CI will still fail on the adopter images, and docker/README.md:61-63 will describe stale versions; update that maintained Dockerfile and its version documentation in the same change.
AGENTS.md reference: AGENTS.md:L416-L418
Useful? React with 👍 / 👎.
Warning
Cooldown could not be applied because no publication date was available from the registry.
Bumps the docker-images group with 2 updates in the /release/docker directory: distroless/cc-debian13 and rust.
Updates
distroless/cc-debian13fromc31ff9ato54df941Updates
rustfrom 1.95-trixie to 1.97-trixieDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions