ci: ignore chainguard/python in Dependabot docker updates by Aureliolo · Pull Request #575 · Aureliolo/synthorg

Aureliolo · 2026-03-19T09:09:16Z

Summary

Ignore chainguard/python in Dependabot's docker/backend ecosystem entry
Chainguard free-tier images only expose latest/latest-dev tags and use digest pinning from cgr.dev -- Dependabot cannot enumerate versions, causing unknown_error failures on every scheduled run
Digests are updated manually per the Dockerfile comments (docker buildx imagetools inspect)

Test plan

Verify next scheduled Dependabot docker run for docker/backend succeeds (no more chainguard/python unknown_error)
Verify python (official Docker Hub) image updates still work normally

🤖 Generated with Claude Code

Chainguard free-tier images only expose latest/latest-dev tags and use digest pinning from cgr.dev -- Dependabot cannot enumerate versions, causing unknown_error failures. Digests are updated manually. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-19T09:09:28Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

gemini-code-assist · 2026-03-19T09:09:29Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves persistent Dependabot failures by instructing it to disregard chainguard/python images in the Docker backend updates. This change prevents unknown_error messages that arose because Dependabot couldn't properly handle Chainguard's specific image tagging and digest pinning, ensuring smoother CI operations without manual intervention for these specific errors.

Highlights

Dependabot Configuration: Configured Dependabot to ignore chainguard/python images for Docker updates within the docker/backend ecosystem.
Issue Resolution: Addressed recurring unknown_error failures in Dependabot runs caused by Chainguard's free-tier image tagging and digest pinning mechanism, which Dependabot could not enumerate.
Manual Updates: Noted that chainguard/python image digests will now be updated manually, as Dependabot cannot automatically manage their versions.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-03-19T09:09:32Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

autorelease: pending

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c164f354-0552-4504-ae21-6a5803091038

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The pull request adds a Dependabot ignore rule for the chainguard/python dependency within the /docker/backend directory Docker update configuration, preventing automated dependency update pull requests for that specific dependency.

Changes

Cohort / File(s)	Summary
Dependabot Configuration `.github/dependabot.yml`	Added an `ignore` rule to the Docker update entry targeting `/docker/backend` to exclude `chainguard/python` from automated version updates.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

ci: group major dependabot bumps per ecosystem #388: Also modifies .github/dependabot.yml Docker update entries with grouping configuration changes.

Suggested labels

type:chore

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and specifically describes the main change: adding an ignore rule for chainguard/python in Dependabot's docker updates configuration.
Description check	✅ Passed	The description directly relates to the changeset, providing clear rationale for ignoring chainguard/python (version enumeration issues), implementation details, and test verification steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ci/ignore-chainguard-dependabot

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch ci/ignore-chainguard-dependabot

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request aims to fix failing Dependabot runs by ignoring the chainguard/python Docker image, which causes errors because it doesn't have enumerable version tags. The change adds an ignore rule to the dependabot.yml configuration. My review found a potential issue with the dependency-name specified in the ignore rule. It should likely include the full registry path (cgr.dev/chainguard/python) to match the image name in the Dockerfile and ensure the rule is effective.

gemini-code-assist · 2026-03-19T09:10:12Z

.github/dependabot.yml

    reviewers:
      - Aureliolo
+    ignore:
+      - dependency-name: chainguard/python


The dependency-name for the Chainguard image appears to be incomplete. According to the Dockerfile, the full image name is cgr.dev/chainguard/python. For Dependabot to correctly identify and ignore the dependency, the dependency-name should match the full image name specified in the FROM instruction, including the registry part. Using just chainguard/python might not be effective, causing Dependabot runs to continue failing.

- dependency-name: cgr.dev/chainguard/python

🤖 I have created a release *beep* *boop* --- ## [0.3.6](v0.3.5...v0.3.6) (2026-03-19) ### Features * **cli:** add backup subcommands (backup, backup list, backup restore) ([#568](#568)) ([4c06b1d](4c06b1d)) * **engine:** implement execution loop auto-selection based on task complexity ([#567](#567)) ([5bfc2c6](5bfc2c6)) ### Bug Fixes * activate structured logging pipeline -- wire 8-sink system, integrate Uvicorn, suppress spam ([#572](#572)) ([9b6bf33](9b6bf33)) * **cli:** bump grpc-go v1.79.3 -- CVE-2026-33186 auth bypass ([#574](#574)) ([f0171c9](f0171c9)) * resolve OpenAPI schema validation warnings for union/optional fields ([#558](#558)) ([5d96b2b](5d96b2b)) ### CI/CD * bump codecov/codecov-action from 5.5.2 to 5.5.3 in the minor-and-patch group ([#571](#571)) ([267f685](267f685)) * ignore chainguard/python in Dependabot docker updates ([#575](#575)) ([1935eaa](1935eaa)) ### Maintenance * bump the major group across 1 directory with 2 updates ([#570](#570)) ([b98f82c](b98f82c)) * bump the minor-and-patch group across 2 directories with 4 updates ([#569](#569)) ([3295168](3295168)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

gemini-code-assist bot reviewed Mar 19, 2026

View reviewed changes

coderabbitai bot added the type:chore Maintenance, cleanup, dependency updates label Mar 19, 2026

coderabbitai bot approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into ci/ignore-chainguard-dependabot

915a600

Aureliolo merged commit 1935eaa into main Mar 19, 2026
22 of 23 checks passed

Aureliolo deleted the ci/ignore-chainguard-dependabot branch March 19, 2026 09:12

Aureliolo mentioned this pull request Mar 19, 2026

chore(main): release 0.3.6 #573

Merged

coderabbitai bot mentioned this pull request Mar 19, 2026

chore(cli): clean up old container images and stale binaries after update #581

Closed

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: ignore chainguard/python in Dependabot docker updates#575

ci: ignore chainguard/python in Dependabot docker updates#575
Aureliolo merged 2 commits intomainfrom
ci/ignore-chainguard-dependabot

Aureliolo commented Mar 19, 2026

Uh oh!

github-actions bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Mar 19, 2026

Uh oh!

coderabbitai bot commented Mar 19, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Aureliolo commented Mar 19, 2026

Summary

Test plan

Uh oh!

github-actions bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

gemini-code-assist bot commented Mar 19, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Mar 19, 2026 •

edited

Loading

coderabbitai bot commented Mar 19, 2026 •

edited

Loading