Repository navigation
chore(deps): Bump the docker-images group across 1 directory with 2 updates - #2553
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aada80b6a3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| ARG SOURCE_DATE_EPOCH=0 | ||
|
|
||
| FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root | ||
| FROM docker.io/library/debian:trixie-slim@sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4 AS runtime-root |
There was a problem hiding this comment.
The required CI step in .github/workflows/ci.yml runs release/scripts/check-debian13-images.py, but that checker still defines DEBIAN_PREPARATION and DISTROLESS_RUNTIME with the previous digests. Running the checker on this commit exits nonzero for every changed Dockerfile, so the PR and release-candidate validation remain blocked until the checker constants and their tests are updated together with both image pins.
Useful? React with 👍 / 👎.
| && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} + | ||
|
|
||
| FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime | ||
| FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime |
There was a problem hiding this comment.
When the release-candidate workflow scans these rebuilt images, every release/security/*-advisory-baseline.json still identifies the previous e792ab3d... Distroless image and its ordered layer IDs. check-advisory-baselines.py compares the candidate OCI layers and runtime definition against those reviewed fingerprints and rejects a runtime-base change, so candidates built from this new digest cannot pass advisory acceptance until the baselines are regenerated and reviewed through the renewal workflow.
Useful? React with 👍 / 👎.
…pdates Bumps the docker-images group with 2 updates in the /release/docker directory: library/debian and distroless/cc-debian13. Updates `library/debian` from `a29215f` to `a72b443` Updates `distroless/cc-debian13` from `e792ab3` to `08476c2` --- updated-dependencies: - dependency-name: distroless/cc-debian13 dependency-version: nonroot dependency-type: direct:production dependency-group: docker-images - dependency-name: library/debian dependency-version: trixie-slim dependency-type: direct:production dependency-group: docker-images ... Signed-off-by: dependabot[bot] <support@github.com>
aada80b to
d7cde07
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7cde0759b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| && find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} + | ||
|
|
||
| FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime | ||
| FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime |
There was a problem hiding this comment.
When DISTROLESS_RUNTIME is updated to accept this new pin, the same CI gate iterates ADOPTER_DOCKERFILES and requires every Distroless stage to use that exact base (release/scripts/check-debian13-images.py:561-628). The Evidence and Casework stages in docker/Dockerfile:77,119 still use e792ab3d...; with the checker constants corrected, both are reported as mismatches, so those adopter stages must be updated as part of this bump or the required image-contract check remains failing.
Useful? React with 👍 / 👎.
Warning
Cooldown could not be applied because no publication date was available from the registry.
Bumps the docker-images group with 2 updates in the /release/docker directory: library/debian and distroless/cc-debian13.
Updates
library/debianfroma29215ftoa72b443Updates
distroless/cc-debian13frome792ab3to08476c2