mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
Marc-André Bombeck
b6b693717c
The runner moves from Wolfi to node:22-trixie-slim, the same image and digest as the dependency and build stages. Wolfi's free repository keeps only its newest Node stream current, so nodejs-22 stayed at 22.23.2 and missed two releases with HIGH fixes; the official image carries 22.23.4. The runner removes npm, npx, corepack and yarn before anything else and fails the build if one is left. The Prisma CLI install moves to its own prisma-cli stage on the same base and is copied over, so npm never runs in the runner. pg_dump and pg_restore 18.6 come from a pgclient stage on postgres:18.6-trixie, pinned by digest, with the libpq they link; the Kerberos, LDAP and SASL libraries come from apt. The PGDG package would bring Perl and the wrapper scripts, and its repository drops a pinned minor once the next one is out. The native ABI and glibc check between builder and runner stays as a guard. runtime-package-pins now holds every stage to a digest, the runner to the builder's image, the runner free of package managers, and the pgclient minor to the bundled database's. Dependabot ignores a PostgreSQL major in the Dockerfile as it does in the compose file.
96 lines
4.3 KiB
YAML
96 lines
4.3 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
#
|
|
# The Next.js line travels alone. Its bumps are the ones that move
|
|
# URL state after history traversal (see the note on 16.4 below), and a
|
|
# red Next bump inside the group would hold every harmless update in
|
|
# it red as well.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "next"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "eslint-config-next"
|
|
- "@next/bundle-analyzer"
|
|
# No ignore for the Next.js line any more. 16.4.0 lost URL state after
|
|
# history traversal: with a sheet opened through `?doc=`, Back left it
|
|
# open, and `[` / `]` sometimes did not move `?day=` (3 of 40 repeated
|
|
# runs of three end-to-end journeys, 0 of 80 on 16.3.8). 16.4.2 does the
|
|
# same (the day keys lost a step in 2 of 20 runs locally, the `?doc=`
|
|
# journey failed once in CI). Both were ours to fix: the sheet followed
|
|
# `useSearchParams`, which 16.4 updates after the write it copies, and a
|
|
# day step wrote the URL before Next had adopted the previous step, whose
|
|
# late adoption then put the older URL back. The sheet now follows the
|
|
# address bar and a step waits for the layer. Measured after both fixes:
|
|
# 200 of 200 repeated runs of the three journeys, and another 80 of 80
|
|
# each for the `?doc=` and day-key journeys.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# The Dockerfile's `pgclient` stage carries pg_dump and pg_restore of
|
|
# the bundled database's major. A major bump there is part of the same
|
|
# migration decision as the database itself, and the runner's paths and
|
|
# version checks name major 18, so it arrives by hand, not as a PR. Its
|
|
# minor moves with the database's in docker-compose.yml
|
|
# (runtime-package-pins.test.ts fails while the two differ).
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it. The ignore also
|
|
# keeps `db-upgrade` on 16: it exists to read Postgres 16 data, and a
|
|
# bump to 18 would leave it unable to start on the volume it moves.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|