Repository navigation
ci(deps): stop Dependabot bumping qualified server images - #622
Merged
Merged
Conversation
Both server/Dockerfile stages are qualified pins. The SDK image must move together with the runtime provider lock, every CLASSIC_LINUX_IMAGE pin and the workflow contract tests, and the Ubuntu base must be requalified with the locked package closure, so a Dockerfile-only Dependabot bump always fails Check (see #620). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016FyuSKkineBeVKbubYFsqd
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
zoeyrose
marked this pull request as ready for review
October 17, 2026 14:26
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Zoey · project thread
Before: Dependabot's docker updates for
/serveropen PRs that change only oneFROMline inserver/Dockerfile, and they always fail Check. #620 (classic-build 1.18.0 to 1.28.0) failstest_server_runtime_providerandtest_workflow_contracts. Both tests require the Dockerfile's build image to equalruntime-provider.lock.jsonand theCLASSIC_LINUX_IMAGEpins.After: Dependabot ignores
atrinik/classic-buildandubuntuin/server, and a comment independabot.ymlexplains why. New SDK or base images are adopted through a qualification PR, as with #588 and the 1.18 measurement indocs/CARES_PROVIDER.md.Both stages are qualified pins, not routine updates. The SDK image is bound to the runtime provider lock's measured payload and package evidence, and to the pins in eight workflows,
tools/ci/server_benchmark.pyand the AppImage packaging lock.CARES_PROVIDER.mdsays the Ubuntu base "must pass the actual assembly checks below; changing an image digest alone does not qualify its installed package dependencies."How: an
ignorelist on the existing/serverdocker entry. The# syntax=frontend pin and the other ecosystems still update.Generated by Claude Code