From 4a120c7cfa189c4bcbc221497a686e7edae3067c Mon Sep 17 00:00:00 2001 From: ChristophShyper <45788587+ChristophShyper@users.noreply.github.com> Date: Mon, 6 Jul 2026 23:01:30 +0200 Subject: [PATCH] ci: update alpine dependency flow and refresh tests Run cron dependency updates on Monday 05:00 UTC and Dependabot on Wednesday 05:00 UTC. Update dependency tasks to refresh Alpine 3.24.1 and matching test expectations before package pins, and bring repository package/test fixtures in line with the current Alpine base. --- .github/dependabot.yml | 4 +- Dockerfile | 2 +- Taskfile.cicd.yml | 2 +- Taskfile.scripts.yml | 76 ++++++++++++++++++++++++++++++++++++ alpine-packages.txt | 4 +- tests/docker/local-image.yml | 2 +- 6 files changed, 83 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d3a0200..956cde9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,7 +4,7 @@ updates: directory: / schedule: interval: weekly - day: monday + day: wednesday time: "05:00" timezone: "UTC" assignees: @@ -18,7 +18,7 @@ updates: directory: / schedule: interval: weekly - day: monday + day: wednesday time: "05:00" timezone: "UTC" assignees: diff --git a/Dockerfile b/Dockerfile index 7472b24..1f9e52f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23.4 +FROM alpine:3.24.1 # Copy all needed files COPY entrypoint.sh / diff --git a/Taskfile.cicd.yml b/Taskfile.cicd.yml index 97d0074..e47d7e8 100644 --- a/Taskfile.cicd.yml +++ b/Taskfile.cicd.yml @@ -46,7 +46,7 @@ tasks: dependency:update: desc: Update repository dependencies not covered by Dependabot cmds: - - task: scripts:packages:update + - task: scripts:dependency:update version:set: desc: Update version in README.md and action.yml diff --git a/Taskfile.scripts.yml b/Taskfile.scripts.yml index 2c3b32f..3f0114a 100644 --- a/Taskfile.scripts.yml +++ b/Taskfile.scripts.yml @@ -77,6 +77,7 @@ tasks: dependency:update: desc: Update dependency metadata for this repository cmds: + - task: alpine:update - task: packages:update version:get: @@ -238,6 +239,81 @@ tasks: - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" + alpine:update: + desc: Update Alpine base image references and VERSION_ID test expectations + cmds: + - | + set -eu + if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then + echo "INFO: Not in a git repository; nothing to update" + exit 0 + fi + + mkdir -p .tmp + tracked_files=".tmp/alpine-update-files.txt" + relevant_files=".tmp/alpine-update-relevant.txt" + git ls-files > "$tracked_files" + grep -E '(^|/)(Dockerfile[^/]*|[^/]+\.sh|\.github/workflows/.*\.ya?ml|tests/.*\.ya?ml)$' "$tracked_files" > "$relevant_files" || true + + if [ ! -s "$relevant_files" ]; then + echo "INFO: No tracked Alpine-related source files found; nothing to update" + exit 0 + fi + + latest_feed="$(curl -fsSL https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/x86_64/latest-releases.yaml)" + latest_alpine="$(printf '%s\n' "$latest_feed" | awk '/^ version:/ {print $2}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)" + if [ -z "$latest_alpine" ]; then + echo "ERROR: Could not resolve latest Alpine release" + exit 1 + fi + escaped_alpine="$(printf '%s' "$latest_alpine" | sed 's/\./\\\\./g')" + + found_refs=0 + while IFS= read -r file; do + [ -n "$file" ] || continue + if grep -Eq 'alpine:[0-9]+\.[0-9]+\.[0-9]+|expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+(\\?\.[0-9]+){2}\]' "$file"; then + found_refs=1 + break + fi + done < "$relevant_files" + + if [ "$found_refs" -eq 0 ]; then + echo "INFO: No Alpine version references found in tracked source files; nothing to update" + exit 0 + fi + + updated=0 + while IFS= read -r file; do + [ -n "$file" ] || continue + before_file=".tmp/alpine-update-before" + cp "$file" "$before_file" + perl -0pi -e 's/alpine:\d+\.\d+\.\d+/alpine:'"$latest_alpine"'/g' "$file" + if printf '%s\n' "$file" | grep -Eq '^tests/.*\.ya?ml$'; then + perl -0pi -e 's/expectedOutput:\s*\[VERSION_ID=\d+(?:\\?\.\d+){2}\]/expectedOutput: [VERSION_ID='"$escaped_alpine"']/g' "$file" + fi + if ! cmp -s "$file" "$before_file"; then + echo "UPDATE: Alpine references in $file -> $latest_alpine" + updated=1 + fi + done < "$relevant_files" + rm -f .tmp/alpine-update-before + + if xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" >/dev/null 2>&1; then + echo "ERROR: Found unescaped VERSION_ID expectations after update" + xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" || true + exit 1 + fi + + if xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" >/dev/null 2>&1; then + echo "ERROR: Found escaped Alpine image tags after update" + xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" || true + exit 1 + fi + + if [ "$updated" -eq 0 ]; then + echo "INFO: Alpine references already up to date" + fi + packages:update: desc: Update Alpine package pins in alpine-packages.txt cmds: diff --git a/alpine-packages.txt b/alpine-packages.txt index 33ca9c1..8d9607f 100644 --- a/alpine-packages.txt +++ b/alpine-packages.txt @@ -1,5 +1,5 @@ bash~=5.3 -git~=2.52 +git~=2.54 git-lfs~=3.7 gnupg~=2.4 -openssh-keygen~=10.2 +openssh-keygen~=10.3 diff --git a/tests/docker/local-image.yml b/tests/docker/local-image.yml index 7e80be2..8efa062 100644 --- a/tests/docker/local-image.yml +++ b/tests/docker/local-image.yml @@ -4,7 +4,7 @@ commandTests: - name: OS version check command: cat args: [/etc/os-release] - expectedOutput: [VERSION_ID=3\.23] + expectedOutput: [VERSION_ID=3\.24\.1] - name: Required tools installed command: bash