ci: pin container images by digest and extend Dependabot to docker-compose#5068
Draft
darccio wants to merge 1 commit into
Draft
ci: pin container images by digest and extend Dependabot to docker-compose#5068darccio wants to merge 1 commit into
darccio wants to merge 1 commit into
Conversation
…mpose GitHub recently made the Dependabot cooldown default 3 days; this makes it explicit at 2 days everywhere, and closes the gaps that let images drift without Dependabot tracking them: - Add docker-compose ecosystems (Dependabot only tracks Dockerfiles under `docker`, not Compose files) for the local dev stack and a new CI-only test-images group, with digest-only ignore rules for intentionally-pinned old test versions. - Pin every trackable image (`contrib/*` and `internal/apps` Dockerfiles, all docker-compose.yaml files) to its @sha256 digest. - Move the CI workflow's native `services:` blocks into .github/testservices/docker-compose.yaml, since GitHub Actions services/container image refs aren't parsed by Dependabot (dependabot-core#5819). - Replace hardcoded Testcontainers image literals across the orchestrion integration suite with a single embedded catalog (instrumentation/testutils/containers/images/docker-compose.yaml + Image() helper), so those digests are Dependabot-tracked too instead of living only in Go string literals synced by hand. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
added
the
apm:ecosystem
Contributor
Config Audit |
darccio
added
the
AI Generated
|
BenchmarksBenchmark execution time: 2026-07-24 20:29:14 Comparing candidate commit cc137b8 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 325 metrics, 1 unstable metrics, 1 flaky benchmarks without significant changes.
|
darccio
commented
Jul 25, 2026
| github.com/testcontainers/testcontainers-go/modules/mongodb v0.42.0 | ||
| github.com/testcontainers/testcontainers-go/modules/redis v0.42.0 | ||
| github.com/testcontainers/testcontainers-go/modules/valkey v0.42.0 | ||
| gopkg.in/yaml.v3 v3.0.1 |
Member
Author
There was a problem hiding this comment.
This needs to be migrated to go.yaml.in/yaml/v3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Hardens the Docker/container supply chain across the repo:
docker-composeecosystem blocks to.github/dependabot.yml(Dependabot only scans Dockerfiles under thedockerecosystem, not Compose files) — one for the local-dev stack, one for CI-only test images (with digest-onlyignorerules so intentionally-pinned old compatibility-matrix versions don't get bumped). Every ecosystem keeps an explicitcooldown: default-days: 2, since GitHub recently made the platform default 3 days.@sha256digest — the 4contrib/*+internal/appsDockerfiles, and alldocker-compose.yamlfiles (root,internal/apps,internal/apps/staleidle-soak).unit-integration-tests.yml's nativeservices:blocks (20 containers) into a new.github/testservices/docker-compose.yaml, since GitHub Actionsservices:/container:image refs aren't parsed by Dependabot (dependabot-core#5819 is still open). The workflow now provisions services viadocker compose up/down, split into a non-blocking start (overlapping with Go/tools setup) followed by a health wait.instrumentation/testutils/containers/images/docker-compose.yaml+ a//go:embed-backedImage()helper), removing the manual "keep these two places in sync" comments and making all of them Dependabot-tracked.orchestrion.yml's image pre-pull step now reads from the same catalog viadocker compose pull.Motivation
.github/dependabot.ymlalready pinned Dockerfile digests via thedockerecosystem, but had no coverage for Compose files, and GitHub Actions' nativeservices:blocks and Go-embedded Testcontainers image strings were entirely outside Dependabot's reach — so a meaningful chunk of the repo's container supply chain wasn't auto-maintained at all, and several base images were still mutable tags. This closes those gaps end-to-end: every container reference the repo uses for building or testing is now either digest-pinned and Dependabot-tracked, or explicitly and intentionally excluded (e.g.internal/setup-smoke-test/Dockerfile, which demos onboarding on stock/variable base images and can't be cleanly pinned without defeating its purpose).Reviewer's Checklist
actionlint,gofmt,goimportsall clean).go build/go vetpass on all touched packages; a live Testcontainers smoke test confirmed the new image catalog resolves and pulls correctly..github/workflows/unit-integration-tests.ymlCompose migration should be watched closely on its first real CI run — GitHub's service-container networking/timing can't be perfectly reproduced locally, so this is the strongest remaining verification step.go.modchange:instrumentation/testutils/containers/go.modpromotesgopkg.in/yaml.v3from indirect to direct (used by the newImage()catalog helper).🤖 Generated with Claude Code