mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 21:32:18 +00:00
Marc-André Bombeck
377e0d0d3a
postgresql-client-18 from the PGDG repository brought Perl and Debian's client wrapper scripts into the runner for two binaries the app calls by name. A pgclient stage on postgres:18.6-trixie, pinned by digest, now hands over pg_dump, pg_restore and the libpq they link; the Debian libraries libpq needs (Kerberos, LDAP, SASL) still come from apt so the upgrade and the image scan see them. The runner registers libpq with the loader and fails the build when either binary has an unresolved library; the major 18 version checks stay. The client minor follows the bundled database's: a guard holds the two pins together, and the Dockerfile's Dependabot watch now ignores a PostgreSQL major the same way the compose watch does.
94 lines
4.1 KiB
YAML
94 lines
4.1 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
#
|
|
# The Next.js line travels alone. Its bumps are the ones that move
|
|
# URL state after history traversal (see the note on 16.4 below), and a
|
|
# red Next bump inside the group would hold every harmless update in
|
|
# it red as well.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "next"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "eslint-config-next"
|
|
- "@next/bundle-analyzer"
|
|
# No ignore for the Next.js line any more. 16.4.0 lost URL state after
|
|
# history traversal: with a sheet opened through `?doc=`, Back left it
|
|
# open, and `[` / `]` sometimes did not move `?day=` (3 of 40 repeated
|
|
# runs of three end-to-end journeys, 0 of 80 on 16.3.8). 16.4.2 does the
|
|
# same (the day keys lost a step in 2 of 20 runs locally, the `?doc=`
|
|
# journey failed once in CI). Both were ours to fix: the sheet followed
|
|
# `useSearchParams`, which 16.4 updates after the write it copies, and a
|
|
# day step wrote the URL before Next had adopted the previous step, whose
|
|
# late adoption then put the older URL back. The sheet now follows the
|
|
# address bar and a step waits for the layer. Measured after both fixes:
|
|
# 200 of 200 repeated runs of the three journeys, and another 80 of 80
|
|
# each for the `?doc=` and day-key journeys.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# The Dockerfile's `pgclient` stage carries pg_dump and pg_restore of
|
|
# the bundled database's major. A major bump there is part of the same
|
|
# migration decision as the database itself, and the runner's paths and
|
|
# version checks name major 18, so it arrives by hand, not as a PR.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it. The ignore also
|
|
# keeps `db-upgrade` on 16: it exists to read Postgres 16 data, and a
|
|
# bump to 18 would leave it unable to start on the volume it moves.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|