ci: update alpine dependency flow and refresh tests

.github/dependabot.yml

@@ -4,7 +4,7 @@ updates:
     directory: /
     schedule:
       interval: weekly
-      day: monday
+      day: wednesday
       time: "05:00"
       timezone: "UTC"
     assignees:
@@ -18,7 +18,7 @@ updates:
     directory: /
     schedule:
       interval: weekly
-      day: monday
+      day: wednesday
       time: "05:00"
       timezone: "UTC"
     assignees:

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.23.4
+FROM alpine:3.24.1
 
 # Copy all needed files
 COPY entrypoint.sh /

Taskfile.cicd.yml

@@ -46,7 +46,7 @@ tasks:
   dependency:update:
     desc: Update repository dependencies not covered by Dependabot
     cmds:
-      - task: scripts:packages:update
+      - task: scripts:dependency:update
 
   version:set:
     desc: Update version in README.md and action.yml

Taskfile.scripts.yml

@@ -77,6 +77,7 @@ tasks:
   dependency:update:
     desc: Update dependency metadata for this repository
     cmds:
+      - task: alpine:update
       - task: packages:update
 
   version:get:
@@ -238,6 +239,81 @@ tasks:
       - git config user.name "github-actions[bot]"
       - git config user.email "github-actions[bot]@users.noreply.github.com"
 
+  alpine:update:
+    desc: Update Alpine base image references and VERSION_ID test expectations
+    cmds:
+      - |
+        set -eu
+        if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+          echo "INFO: Not in a git repository; nothing to update"
+          exit 0
+        fi
+
+        mkdir -p .tmp
+        tracked_files=".tmp/alpine-update-files.txt"
+        relevant_files=".tmp/alpine-update-relevant.txt"
+        git ls-files > "$tracked_files"
+        grep -E '(^|/)(Dockerfile[^/]*|[^/]+\.sh|\.github/workflows/.*\.ya?ml|tests/.*\.ya?ml)$' "$tracked_files" > "$relevant_files" || true
+
+        if [ ! -s "$relevant_files" ]; then
+          echo "INFO: No tracked Alpine-related source files found; nothing to update"
+          exit 0
+        fi
+
+        latest_feed="$(curl -fsSL https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/x86_64/latest-releases.yaml)"
+        latest_alpine="$(printf '%s\n' "$latest_feed" | awk '/^  version:/ {print $2}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)"
+        if [ -z "$latest_alpine" ]; then
+          echo "ERROR: Could not resolve latest Alpine release"
+          exit 1
+        fi
+        escaped_alpine="$(printf '%s' "$latest_alpine" | sed 's/\./\\\\./g')"
+
+        found_refs=0
+        while IFS= read -r file; do
+          [ -n "$file" ] || continue
+          if grep -Eq 'alpine:[0-9]+\.[0-9]+\.[0-9]+|expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+(\\?\.[0-9]+){2}\]' "$file"; then
+            found_refs=1
+            break
+          fi
+        done < "$relevant_files"
+
+        if [ "$found_refs" -eq 0 ]; then
+          echo "INFO: No Alpine version references found in tracked source files; nothing to update"
+          exit 0
+        fi
+
+        updated=0
+        while IFS= read -r file; do
+          [ -n "$file" ] || continue
+          before_file=".tmp/alpine-update-before"
+          cp "$file" "$before_file"
+          perl -0pi -e 's/alpine:\d+\.\d+\.\d+/alpine:'"$latest_alpine"'/g' "$file"
+          if printf '%s\n' "$file" | grep -Eq '^tests/.*\.ya?ml$'; then
+            perl -0pi -e 's/expectedOutput:\s*\[VERSION_ID=\d+(?:\\?\.\d+){2}\]/expectedOutput: [VERSION_ID='"$escaped_alpine"']/g' "$file"
+          fi
+          if ! cmp -s "$file" "$before_file"; then
+            echo "UPDATE: Alpine references in $file -> $latest_alpine"
+            updated=1
+          fi
+        done < "$relevant_files"
+        rm -f .tmp/alpine-update-before
+
+        if xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" >/dev/null 2>&1; then
+          echo "ERROR: Found unescaped VERSION_ID expectations after update"
+          xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" || true
+          exit 1
+        fi
+
+        if xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" >/dev/null 2>&1; then
+          echo "ERROR: Found escaped Alpine image tags after update"
+          xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" || true
+          exit 1
+        fi
+
+        if [ "$updated" -eq 0 ]; then
+          echo "INFO: Alpine references already up to date"
+        fi
+
   packages:update:
     desc: Update Alpine package pins in alpine-packages.txt
     cmds:

alpine-packages.txt

@@ -1,5 +1,5 @@
 bash~=5.3
-git~=2.52
+git~=2.54
 git-lfs~=3.7
 gnupg~=2.4
-openssh-keygen~=10.2
+openssh-keygen~=10.3

tests/docker/local-image.yml

@@ -4,7 +4,7 @@ commandTests:
   - name: OS version check
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.23]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: Required tools installed
     command: bash