Skip to content

ci: add dependabot support for Dockerfile#1761

Merged
shizhMSFT merged 3 commits into
oras-project:mainfrom
tanyabhatnagar:fix/go-version-1.22
Jul 3, 2025
Merged

ci: add dependabot support for Dockerfile#1761
shizhMSFT merged 3 commits into
oras-project:mainfrom
tanyabhatnagar:fix/go-version-1.22

Conversation

@tanyabhatnagar

@tanyabhatnagar tanyabhatnagar commented Jul 1, 2025

Copy link
Copy Markdown
Contributor

This PR updates the Go version in all relevant GitHub Actions workflows to 1.22, as requested in issue #1710. The affected workflows include:

  • build.yml
  • golangci-lint.yml
  • codeql-analysis.yml
  • release-github.yml

Reverted earlier downgrade and restored Go 1.24.2 in all GitHub Actions workflows.

Additionally, this PR updates the dependabot.yml configuration to include support for Dockerfile version updates, enabling Dependabot to track and suggest updates to base images used in the project.

All unit tests were run locally using Go 1.24.3 for compatibility, and the changes are expected to pass CI without issues.

Fixes #1710

Signed-off-by: tanya <tanyabhatnagar119@gmail.com>
Signed-off-by: tanya <tanyabhatnagar119@gmail.com>

@shizhMSFT shizhMSFT left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason to downgrade the go version? #1710 does not request downgrading go to 1.22.

@tanyabhatnagar

Copy link
Copy Markdown
Contributor Author

@shizhMSFT Thanks for the clarification! I had initially interpreted #1710 as a request to align everything to Go 1.22 for consistency, since some workflows were still using 1.21. Happy to update the PR to keep everything on 1.24 instead — will push the changes shortly.

Signed-off-by: tanya <tanyabhatnagar119@gmail.com>
@Wwwsylvia Wwwsylvia requested a review from Copilot July 2, 2025 10:31

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the Go version used in GitHub Actions workflows to 1.22 (restoring 1.24.2) and extends Dependabot to track Dockerfile base image updates.

  • Bump Go version to 1.22 across build, lint, CodeQL, and release workflows
  • Add Docker package-ecosystem to .github/dependabot.yml for weekly updates
Comments suppressed due to low confidence (1)

@codecov

codecov Bot commented Jul 2, 2025

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.29%. Comparing base (130070f) to head (42555ae).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1761      +/-   ##
==========================================
+ Coverage   85.26%   85.29%   +0.03%     
==========================================
  Files         133      133              
  Lines        5882     5882              
==========================================
+ Hits         5015     5017       +2     
+ Misses        618      616       -2     
  Partials      249      249              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@TerryHowe TerryHowe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you update the PR title to reflect this is dependabot for Docker

@tanyabhatnagar tanyabhatnagar changed the title ci: update Go version to 1.22 across workflows FIXES #1710 ci: add dependabot support for Dockerfile FIXES #1710 Jul 2, 2025
@tanyabhatnagar

Copy link
Copy Markdown
Contributor Author

@TerryHowe sure, i've done that.

@TerryHowe TerryHowe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@tanyabhatnagar tanyabhatnagar requested a review from shizhMSFT July 2, 2025 20:19

@shizhMSFT shizhMSFT left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@shizhMSFT shizhMSFT changed the title ci: add dependabot support for Dockerfile FIXES #1710 ci: add dependabot support for Dockerfile Jul 3, 2025
@shizhMSFT shizhMSFT merged commit f3c6ed3 into oras-project:main Jul 3, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Configure dependabot to update Dockerfile

4 participants