bug-2066376: Use version tags without a leading "v" for Docker images. - #230
Conversation
smarnach
changed the title
2360e0c to
396fa44
Compare
There was a problem hiding this comment.
IIUC to unstuck Dependabot, after this merges, you will need to manually upgrade obs-common to this new "v"-less tagged image (updating the image tag and digest) in each gcs-emulator and fakesentry Dockerfile in Socorro, Antenna, Tecken and Eliot. Then future update checks should work?
But if you manually trigger a Dependabot check at that point, it still wouldn't open a PR, but now that's only because you're already up-to-date, not because of the misparsing issue you fixed. 😆
Edit: You can merge a nit fix or dummy PR in obs-common to trigger a new release for testing that the Dependabot updates work at that point as part of verifying the fix.
| GAR_REPO="us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/cavendish-prod" | ||
| FAKESENTRY_TAG="$GAR_REPO/fakesentry:${{ env.RELEASE_TAG }}" | ||
| # Dependabot doesn't understand version numbers starting with a "v", so we remove the v. | ||
| FAKESENTRY_TAG="$GAR_REPO/fakesentry:"${RELEASE_TAG#v}"" |
There was a problem hiding this comment.
TIL: You can remove prefixes in bash with #{pattern}.
TIL: GHA expressions have no substring strip function, but we can do this in the shell since RELEASE_TAG was written to GITHUB_ENV upstream.
There was a problem hiding this comment.
Moreover, using shell interpolation for environment variables is preferred over ${{ env.ENV_VAR }} according to the current GitHub Action guidelines from the security team.
| # Convert version number to PEP 440-conformant version that's treated correctly | ||
| # by Dependabot, see https://mozilla-hub.atlassian.net/browse/CRINGE-24. | ||
| VERSION="${RELEASE_TAG#v}" |
There was a problem hiding this comment.
Looks like we ran into some version of this before with Dependabot, but didn't update RELEASE_TAG.
There was a problem hiding this comment.
That was a different issue. The version numbers we had didn't follow the versioning rules for Python packages. They were actually wrong, independent of Dependabot; uv would have interpreted them exactly the same way Dependabot did.
The issue we have now is about how Dependabot interprets Docker tags. There are no rules for Docker tags similar to what I linked for Python, so Dependabot has to come up with heuristics. These heuristics are encoded in the Ruby file I linked in the description, and our versioning scheme wasn't compatible with these heuristics.
So these are basically two unrelated issues. In the Python version number, we also need to replace the dash with a dot, which I don't think is necessary for Docker.
smarnach
left a comment
smarnach
left a comment
There was a problem hiding this comment.
IIUC to unstuck Dependabot, after this merges, you will need to manually upgrade
obs-commonto this new "v"-less tagged image (updating the image tag and digest) in eachgcs-emulatorandfakesentryDockerfilein Socorro, Antenna, Tecken and Eliot. Then future update checks should work?
Correct, this is the plan, should have stated that in the PR description.
| # Convert version number to PEP 440-conformant version that's treated correctly | ||
| # by Dependabot, see https://mozilla-hub.atlassian.net/browse/CRINGE-24. | ||
| VERSION="${RELEASE_TAG#v}" |
There was a problem hiding this comment.
That was a different issue. The version numbers we had didn't follow the versioning rules for Python packages. They were actually wrong, independent of Dependabot; uv would have interpreted them exactly the same way Dependabot did.
The issue we have now is about how Dependabot interprets Docker tags. There are no rules for Docker tags similar to what I linked for Python, so Dependabot has to come up with heuristics. These heuristics are encoded in the Ruby file I linked in the description, and our versioning scheme wasn't compatible with these heuristics.
So these are basically two unrelated issues. In the Python version number, we also need to replace the dash with a dot, which I don't think is necessary for Docker.
| GAR_REPO="us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/cavendish-prod" | ||
| FAKESENTRY_TAG="$GAR_REPO/fakesentry:${{ env.RELEASE_TAG }}" | ||
| # Dependabot doesn't understand version numbers starting with a "v", so we remove the v. | ||
| FAKESENTRY_TAG="$GAR_REPO/fakesentry:"${RELEASE_TAG#v}"" |
There was a problem hiding this comment.
Moreover, using shell interpolation for environment variables is preferred over ${{ env.ENV_VAR }} according to the current GitHub Action guidelines from the security team.
2 participants
Dependabot has never upgraded the fake-sentry and gcs-emulator images in our projects. It turns out that it doesn't like the leading "v" in the tag (see the Ruby source code for details). Simply removing the leading "v" in the Docker tag should fix the issue.
This PR also includes a small formatting change for the README file that was meant to be included in some earlier PR and was still siiting in my working tree.