From 431aad8b7123d382a0be6ca12e51fd5aa8ddffb6 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 22 Aug 2026 02:21:49 -0700 Subject: [PATCH 1/3] Retire the docker ecosystem from Dependabot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The base image tag is a build arg — `ARG RUBY_VERSION` plus `FROM ruby:$RUBY_VERSION-slim` — and Dependabot's docker updater matches literal tags, so this entry has never had anything to propose. It ran green every week and reported nothing, which reads as coverage and isn't. No other repo in the fleet configures a docker ecosystem, and none could: they all either interpolate a variable or pull from the internal registry. Inlining the tag here to buy coverage would make this Dockerfile the outlier instead, against Rails-generated boilerplate. Ruby bumps stay a manual, human-decided step. --- .github/dependabot.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3853c16..8b29de2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,9 +23,9 @@ updates: exclude: - "brakeman" - - package-ecosystem: docker - directory: "/" - schedule: - interval: weekly - cooldown: - default-days: 7 + # No docker ecosystem. Our base image tag is a build arg + # (`FROM ruby:$RUBY_VERSION-slim`), which the updater cannot read, so the + # entry only ever matched nothing — worse than no entry, because it looked + # like coverage. Ruby base image bumps are a manual, reviewed step here, as + # they are across the rest of the fleet. Keep Dockerfile, Dockerfile-export + # and .ruby-version on the same version by hand. From 22b6d4bdaf38def0c1a559b9a1bc8f9670f9ca54 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 22 Aug 2026 12:30:43 -0700 Subject: [PATCH 2/3] Bump ruby/setup-ruby to v1.321.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v1.295.0 predates Ruby 3.4.10 — its baked-in version index stops at 3.4.9, so asking for anything newer fails with "Unknown version 3.4.10 for ruby on ubuntu-24.04". The next commit needs 3.4.10, and pinning our Ruby to whatever an old action happens to know is backwards. SHA verified against the v1.321.0 tag. --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index babda7d..650ffd9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: .ruby-version bundler-cache: true @@ -40,7 +40,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: .ruby-version bundler-cache: true @@ -87,7 +87,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 env: REDIS_URL: redis://localhost:6379/0 with: @@ -117,7 +117,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 env: REDIS_URL: redis://localhost:6379/0 with: From b827d7ca9b0537a47047813f791f78b3ea778b94 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 22 Aug 2026 12:30:43 -0700 Subject: [PATCH 3/3] Put every Ruby pin on 3.4.10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three pins, two values: Dockerfile said 3.4.5, Dockerfile-export said 3.4.7, .ruby-version said 3.4.5 — the export image had already been bumped on its own and nobody noticed the other two lagging. Both Dockerfiles carry a comment telling you to keep them in step. 3.4.10 is the current 3.4.x. CI resolves its Ruby from .ruby-version, so this is the version the tests now run under. --- .ruby-version | 2 +- Dockerfile | 2 +- Dockerfile-export | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.ruby-version b/.ruby-version index 4f5e697..84d6c67 100644 --- a/.ruby-version +++ b/.ruby-version @@ -1 +1 @@ -3.4.5 +3.4.10 diff --git a/Dockerfile b/Dockerfile index b65a227..1002a6c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # syntax = docker/dockerfile:1 # Make sure it matches the Ruby version in .ruby-version and Gemfile -ARG RUBY_VERSION=3.4.5 +ARG RUBY_VERSION=3.4.10 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base # Rails app lives here diff --git a/Dockerfile-export b/Dockerfile-export index 7bdd939..d130d17 100644 --- a/Dockerfile-export +++ b/Dockerfile-export @@ -1,7 +1,7 @@ # syntax = docker/dockerfile:1 # Make sure it matches the Ruby version in .ruby-version and Gemfile -ARG RUBY_VERSION=3.4.7 +ARG RUBY_VERSION=3.4.10 FROM ruby:$RUBY_VERSION-slim as base # Install the tools we need