This repository was archived by the owner on Sep 14, 2026. It is now read-only.
chore(deps): bump golang from 1.26.6-alpine to 1.27.0-alpine in /control - #62
Merged
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
haasonsaas
added a commit
that referenced
this pull request
Sep 2, 2026
scripts/update-control-base-images.sh hardcoded `golang:1.26.6-alpine` both as the candidate to resolve and as a literal regex that control/Dockerfile had to match. Any reviewed tag bump therefore aborted the script with `unexpected Go build base reference`, which failed the "License and prose hygiene" and "Build, boot, persist, and scan candidate" jobs on every Docker dependency PR. #62 (golang 1.26.6-alpine -> 1.27.0-alpine) has been blocked on this since 2026-08-24. The script now reads the pinned tags out of control/Dockerfile and re-resolves their digests. The gate is unchanged in strength: the Go base must still be `golang:<version>-alpine` pinned by a canonical sha256 digest, and the runtime base must still be `alpine:<version>` pinned the same way. Unpinned or off-family references still exit 1. scripts/check-image-drift.sh defaulted to the same literal tag, so after a bump it would have reported permanent phantom drift against a tag the repository no longer builds from. Its defaults now come from control/Dockerfile too; the GHOSTLIGHT_*_BASE_CANDIDATE overrides are unchanged. Verified locally on this branch: - `bash scripts/test-image-safety.sh` passes. - `bash scripts/test-browser-update-workflow.sh` passes. - `bash scripts/check-repo-hygiene.sh` passes. - `shellcheck scripts/update-control-base-images.sh scripts/check-image-drift.sh` is clean. - With #62 merged into this branch, `bash scripts/check-image-safety.sh` and `bash scripts/test-image-safety.sh` both pass and the updater resolves `golang:1.27.0-alpine@sha256:4c9fe60...`. - Negative cases still fail: an unpinned `golang:1.27.0-alpine` and an off-family `golang:1.27.0-bookworm@sha256:...` both exit 1. Claude-Session: https://claude.ai/code/session_01XpuXXVrWCZk3Tq5NRXejNP Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
@dependabot rebase Context: #64 just merged. |
Bumps golang from 1.26.6-alpine to 1.27.0-alpine. --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.0-alpine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/docker/control/golang-1.27.0-alpine
branch
from
September 2, 2026 01:43
1ce9ec2 to
f971ff4
Compare
haasonsaas
deleted the
dependabot/docker/control/golang-1.27.0-alpine
branch
September 2, 2026 01:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Cooldown could not be applied because no publication date was available from the registry.
Bumps golang from 1.26.6-alpine to 1.27.0-alpine.