Erich Blume
f6e392b80c
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 1m45s
## Summary Monthly tooling dependency refresh, with a one-time conversion from version-tag pins (`rev = "vX.Y.Z"`, `image:tag`, `>=`) to SHA / digest pins everywhere. ## Changes - **prek hooks**: all `rev = "vX.Y.Z"` → commit SHA + `# vX.Y.Z` comment. Bumped trufflehog (3.94.0→3.95.2), kingfisher (1.91.0→1.97.0), ruff (0.15.7→0.15.12), shfmt (3.13.0→3.13.1), prettier (3.8.1→3.8.3), actionlint (1.7.11→1.7.12). - **fly/Dockerfile**: tag pins → `image@sha256:...` digest pins. Bumped nginx (1.29.6→1.30.0-alpine), tailscale (v1.94.1→v1.94.2 — still inside the safe pre-1.96.5 range), alloy (v1.14.1→v1.16.0). - **mise-tasks**: PEP 723 inline deps converted from `>=` to `==` (PEP 508 doesn't support hashes inline). All scripts pinned to current latest: rich 15.0.0, typer 0.25.0, pyyaml 6.0.3, httpx 0.28.1. - **prek `additional_dependencies`**: ansible-lint==26.4.0, ansible-core==2.20.5. - **taplo-lint**: pass `--no-schema`. Upstream's `--default-schema-catalogs` returns a format taplo v0.9.3 can't parse — we don't validate against TOML schemas anyway, so this turns off the broken catalog fetch. - **docs/update-tooling-dependencies**: documents the SHA-pin convention, `docker buildx imagetools inspect` for digest lookup, and `prek clean` before re-verifying (cache grows to several GiB). Forgejo workflow `actions/checkout@v6.0.2` was already at the latest SHA — no change. ## Test plan - [x] `prek run --all-files` passes after `prek clean` - [x] `deploy-fly` workflow builds and deploys the new fly image on merge - [x] `fly status -a blumeops-proxy` healthy after deploy - [x] Spot-check a few mise tasks (`mise run blumeops-tasks`, `mise run docs-check-links`) to confirm pinned deps resolve cleanly Reviewed-on: #344 |
||
|---|---|---|
| .. | ||
| ai-docs | ||
| ai-sources | ||
| blumeops-tasks | ||
| branch-cleanup | ||
| changelog-check | ||
| container-build-and-release | ||
| container-list | ||
| container-version-check | ||
| dns-acme-cleanup | ||
| dns-preview | ||
| dns-up | ||
| docs-check-frontmatter | ||
| docs-check-links | ||
| docs-mikado | ||
| docs-preview | ||
| docs-review | ||
| docs-review-stale | ||
| docs-review-tags | ||
| ensure-k3s-ringtail-kubectl-config | ||
| ensure-minikube-indri-kubectl-config | ||
| fly-deploy | ||
| fly-reload | ||
| fly-setup | ||
| fly-shutoff | ||
| frigate-export-model | ||
| mikado-branch-invariant-check | ||
| mirror-create | ||
| mirror-update-pats | ||
| op-backup | ||
| pr-comments | ||
| provision-indri | ||
| provision-ringtail | ||
| provision-sifaka | ||
| prune-ringtail-generations | ||
| review-compensating-controls | ||
| review-compliance-reports | ||
| runner-logs | ||
| service-review | ||
| services-check | ||
| spork-create | ||
| tailnet-preview | ||
| tailnet-up | ||
| validate-workflows | ||