diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 7dbfb56..b734ea8 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -8,10 +8,11 @@ FROM mcr.microsoft.com/vscode/devcontainers/base:${VARIANT} ARG SHELLCHECK_VERSION="v0.7.1" SHELL ["/bin/bash", "-o", "pipefail", "-c"] +# hadolint ignore=DL3008 RUN apt-get update \ && export DEBIAN_FRONTEND=noninteractive \ # Install xz-utils to extract tarballs - && apt-get -y install --no-install-recommends xz-utils=5.2.4-1 \ + && apt-get -y install --no-install-recommends xz-utils \ # Install shellcheck (apt-get doesn't install the latest version needed by VS code, so installing from GitHub release, see: # https://askubuntu.com/a/1228181) && mkdir -p /tmp/shellcheck \ diff --git a/.github/DEPENDENCIES.md b/.github/DEPENDENCIES.md index 5e4b63c..3732f55 100644 --- a/.github/DEPENDENCIES.md +++ b/.github/DEPENDENCIES.md @@ -47,13 +47,7 @@ For major version updates, we should test that the remote container works succes ## Dockerfile dependencies -We have [pinned the linux dependencies in the devcontainer Dockerfile](https://github.com/agilepathway/hoverfly-github-action/pull/46/files), but there is no mechanism to automatically update them, currently. It looks like [it's on Dependabot's roadmap](https://github.com/dependabot/dependabot-core/issues/2129#issuecomment-511552345), so we have [an issue automatically created every 6 months](https://github.com/agilepathway/hoverfly-github-action/pull/59) to -1. update the dependencies manually -2. see if Dependabot now offer this functionality - -### Updating the Dockerfile dependencies manually - -1. Temporarily unpin the versions (i.e. remove `=` from each package in the Dockerfile) -2. Execute the Dockerfile (e.g. if it's a remote container Dockerfile build the remote container) -3. Run `apt-cache policy ` for each package, to see the version installed -4. Pin all the versions, replacing any old versions with new ones +We do not pin the linux apt-get dependencies in the devcontainer Dockerfile as +[Dependabot currently does not support this](https://github.com/dependabot/dependabot-core/issues/2129), and also the +risk of side effects due to an updated apt-get dependency in the devcontainer is very small indeed (and there's zero +risk to production, as this is just in the devcontainer). diff --git a/.github/ISSUE_TEMPLATE/scheduled/update-dockerfile-dependencies.md b/.github/ISSUE_TEMPLATE/scheduled/update-dockerfile-dependencies.md deleted file mode 100644 index 9a849be..0000000 --- a/.github/ISSUE_TEMPLATE/scheduled/update-dockerfile-dependencies.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -name: Update dependencies in devcontainer Dockerfile -about: Stay up to date with Dockerfile dependencies -title: Update dependencies in devcontainer Dockerfile -labels: '' -assignees: '' - ---- - - -We have [pinned the linux dependencies in the devcontainer Dockerfile](https://github.com/agilepathway/hoverfly-github-action/pull/46/files), but there is no mechanism to automatically update them, currently. It looks like [it's on Dependabot's roadmap](https://github.com/dependabot/dependabot-core/issues/2129#issuecomment-511552345), so this GitHub Issue gets automatically created every 6 months to: - -- [ ] update the dependencies manually: - 1. Temporarily unpin the versions (i.e. remove `=` from each package in the Dockerfile) - 2. Execute the Dockerfile (e.g. if it's a remote container Dockerfile build the remote container) - 3. Run `apt-cache policy ` for each package, to see the version installed - 4. Pin all the versions, replacing any old versions with new ones -- [ ] see if Dependabot now offer this functionality (in which case we can do it automatically, from then on) diff --git a/.github/workflows/schedule_dockerfile_dependency_updates_issue.yml b/.github/workflows/schedule_dockerfile_dependency_updates_issue.yml deleted file mode 100644 index 4c00d85..0000000 --- a/.github/workflows/schedule_dockerfile_dependency_updates_issue.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -name: Create issue every 6 months to update Dockerfile dependencies -on: # yamllint disable-line rule:truthy - # Scheduled for 4am on 10th March and 10th Sept every year - schedule: - - cron: '0 4 10 3,9 *' # * is a special character in YAML so we have to quote this string - -jobs: - create_issue: - name: Create issue to update Dockerfile dependencies - runs-on: ubuntu-latest - steps: - - # Repo code checkout required if `template` is used - - name: Checkout - uses: actions/checkout@v2 - - - name: issue-bot - uses: imjohnbo/issue-bot@v2 - with: - assignees: "johnboyes" - labels: "dependencies" - pinned: false - close-previous: false - # assignees & labels in the template are overridden by the values specified in this action - template: ".github/ISSUE_TEMPLATE/scheduled/update-dockerfile-dependencies.md" - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}