From 431aad8b7123d382a0be6ca12e51fd5aa8ddffb6 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 22 Aug 2026 02:21:49 -0700 Subject: [PATCH] Retire the docker ecosystem from Dependabot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The base image tag is a build arg — `ARG RUBY_VERSION` plus `FROM ruby:$RUBY_VERSION-slim` — and Dependabot's docker updater matches literal tags, so this entry has never had anything to propose. It ran green every week and reported nothing, which reads as coverage and isn't. No other repo in the fleet configures a docker ecosystem, and none could: they all either interpolate a variable or pull from the internal registry. Inlining the tag here to buy coverage would make this Dockerfile the outlier instead, against Rails-generated boilerplate. Ruby bumps stay a manual, human-decided step. --- .github/dependabot.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3853c16..8b29de2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,9 +23,9 @@ updates: exclude: - "brakeman" - - package-ecosystem: docker - directory: "/" - schedule: - interval: weekly - cooldown: - default-days: 7 + # No docker ecosystem. Our base image tag is a build arg + # (`FROM ruby:$RUBY_VERSION-slim`), which the updater cannot read, so the + # entry only ever matched nothing — worse than no entry, because it looked + # like coverage. Ruby base image bumps are a manual, reviewed step here, as + # they are across the rest of the fleet. Keep Dockerfile, Dockerfile-export + # and .ruby-version on the same version by hand.