dependabot-cli: 1.41.0 -> 1.57.0, pin image dependencies #352866
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
infinisil
force-pushed
the
update/dependabot
branch
from
6caf319 to
85f6839
Compare
…mages By default, the dependabot CLI fetches the latest versions of two images it depends on, with the underlying assumption that the CLI is also a recent version. This of course causes problems if the CLI is outdated and doesn't support the latest images. This commit introduces a separate wrapper binary that pins these images to the latest version of them at the time of updating.
infinisil
force-pushed
the
update/dependabot
branch
from
85f6839 to
393342a
Compare
infinisil
changed the title
philiptaron
approved these changes
Nov 1, 2024
There was a problem hiding this comment.
nixpkgs-review result
Generated using nixpkgs-review.
Command: nixpkgs-review pr 352866
x86_64-linux
✅ 1 package built:
- dependabot-cli
|
|
@philiptaron Since dependabot requires the docker daemon to run anyways, I think it's fine to not include it, especially also to avoid extra closure size. |
You got the green check. I think I would have made this be a passthru, separate derivation with the extra dependency, but you do you. |
wegank
added
the
12.approvals: 1
|
Ah yeah that's fair, I guess let's merge this as is for now, but consider doing that in the future if this becomes more complex, or people demand smaller closure sizes :) |
|
Requested a review from the maintainer manually because ofborg was apparently too slow. Let us know if you have any input @l0b0, happy to address retroactively! |
l0b0
reviewed
Nov 3, 2024
Comment on lines
+8
to
+9
| dockerTools, | ||
| makeWrapper, |
There was a problem hiding this comment.
Nit: These should be sorted alphabetically with the rest.
Comment on lines
+69
to
+74
| # Create a wrapper that pins the docker images that are depended upon | ||
| makeWrapper $out/bin/dependabot $out/bin/dependabot-pinned \ | ||
| --run "docker load --input ${updateJobProxy}" \ | ||
| --add-flags "--proxy-image=dependabot-update-job-proxy:${tag}" \ | ||
| --run "docker load --input ${updaterGitHubActions}" \ | ||
| --add-flags "--updater-image=dependabot-updater-github-actions:${tag}" |
There was a problem hiding this comment.
Could this be a separate output, or behind a feature flag like withDockerImages?
13 tasks
infinisil
added a commit
to NixOS/nixpkgs-vet
that referenced
this pull request
Nov 7, 2024
The automated GitHub workflow updates have been broken for some time See NixOS/nixpkgs#352866 and NixOS/nixpkgs#354085
infinisil
added a commit
to NixOS/nixpkgs-vet
that referenced
this pull request
Nov 25, 2024
The automated GitHub workflow updates were broken for some time due to dependabot's images fetched at runtime went out of sync with the binary. While updating dependabot fixed it for now, a more permanent fix is to use the version of dependabot that pins the images at build time, introduced in NixOS/nixpkgs#352866 and NixOS/nixpkgs#354085
infinisil
added a commit
to NixOS/nixpkgs-vet
that referenced
this pull request
Nov 25, 2024
The automated GitHub workflow updates were broken for some time due to dependabot's images fetched at runtime went out of sync with the binary. While updating dependabot fixed it for now, a more permanent fix is to use the version of dependabot that pins the images at build time, introduced in NixOS/nixpkgs#352866 and NixOS/nixpkgs#354085
infinisil
added a commit
to NixOS/nixpkgs-vet
that referenced
this pull request
Nov 25, 2024
The automated GitHub workflow updates were broken for some time due to dependabot's images fetched at runtime went out of sync with the binary. While updating dependabot fixed it for now, a more permanent fix is to use the version of dependabot that pins the images at build time, introduced in NixOS/nixpkgs#352866 and NixOS/nixpkgs#354085
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Noticed that the dependabot updates for https://github.com/NixOS/nixpkgs-vet aren't working anymore. Tracked it down to it needing a dependabot CLI update, but to prevent future breakage, this PR also introduces a
dependabot-pinnedwrapper that pins the docker images.Ping @NixOS/nixpkgs-vet
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = trueThis work is sponsored by Antithesis ✨
Add a 👍 reaction to pull requests you find important.