Follow-up from #3005.
The devcontainer config in .devcontainer/devcontainer.json pins GUAC_IMAGE to a specific release tag (currently ghcr.io/guacsec/guac:v1.1.0). This is good for reproducibility but means the file will go stale as new GUAC versions ship, and first-time users who pick up the devcontainer will end up trying an old release.
Options:
- Automate the bump via renovate or dependabot — configure it to watch the
ghcr.io/guacsec/guac image tag and open a bump PR alongside each release.
- Wire into the release process — have the release workflow patch
containerEnv.GUAC_IMAGE to the new tag as part of cutting a release.
- Document expectation — a
<!-- keep in sync with latest release --> comment in the containerEnv block so future maintainers don't miss it (weakest, but zero-config).
(1) or (2) preferred. Filing this so it doesn't get lost after #3005 merges.
Follow-up from #3005.
The devcontainer config in
.devcontainer/devcontainer.jsonpinsGUAC_IMAGEto a specific release tag (currentlyghcr.io/guacsec/guac:v1.1.0). This is good for reproducibility but means the file will go stale as new GUAC versions ship, and first-time users who pick up the devcontainer will end up trying an old release.Options:
ghcr.io/guacsec/guacimage tag and open a bump PR alongside each release.containerEnv.GUAC_IMAGEto the new tag as part of cutting a release.<!-- keep in sync with latest release -->comment in the containerEnv block so future maintainers don't miss it (weakest, but zero-config).(1) or (2) preferred. Filing this so it doesn't get lost after #3005 merges.