mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-26 08:39:06 +02:00
Brad Ison
6cf07caaf6
upload-server/Dockerfile only packaged the goreleaser-built binary, so the image could not be built from a checkout. It is now a multi-stage build on Chainguard static, running as the nonroot user (uid 65532), with a VARIANT=debug build arg that swaps in busybox for a shell. The goreleaser packaging file moves unchanged to Dockerfile.release and .goreleaser.yaml points at it, so the published netbirdio/upload image stays as it was: distroless and root. The bases are pinned by digest, since Chainguard publishes only :latest for free. A Dependabot docker entry for /upload-server moves them weekly, leaving the release base alone and holding golang to patch updates.
71 lines
2.0 KiB
YAML
71 lines
2.0 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- "*"
|
|
ignore:
|
|
# git-town/action v1.3.x crashes on cyclic PR graphs (self-loop main->main
|
|
# fork PRs) via its topological-sort visualization. Pinned to v1.2.1 in
|
|
# git-town.yml; block v1.3.x until upstream tolerates cyclic edges.
|
|
- dependency-name: "git-town/action"
|
|
update-types:
|
|
- "version-update:semver-minor"
|
|
- "version-update:semver-major"
|
|
|
|
- package-ecosystem: "gomod"
|
|
directories:
|
|
- "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 15
|
|
groups:
|
|
golang-x-packages:
|
|
patterns:
|
|
- "golang.org/x/*"
|
|
aws-sdk:
|
|
patterns:
|
|
- "github.com/aws/aws-sdk-go-v2/*"
|
|
pion:
|
|
patterns:
|
|
- "github.com/pion/*"
|
|
gorm:
|
|
patterns:
|
|
- "gorm.io/*"
|
|
otel:
|
|
patterns:
|
|
- "go.opentelemetry.io/*"
|
|
testcontainers:
|
|
patterns:
|
|
- "github.com/testcontainers/testcontainers-go/*"
|
|
wireguard:
|
|
patterns:
|
|
- "golang.zx2c4.com/wireguard*"
|
|
|
|
# Base images of the source-build Dockerfiles, pinned by digest (Chainguard
|
|
# publishes only :latest for free). Dockerfile.release files feed goreleaser
|
|
# and keep the published images as they are, so their bases are left alone.
|
|
- package-ecosystem: "docker"
|
|
directories:
|
|
- "/upload-server"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
base-images:
|
|
patterns:
|
|
- "*"
|
|
ignore:
|
|
- dependency-name: "gcr.io/distroless/base"
|
|
# Go minor and major versions move with the rest of the repository;
|
|
# patch releases and new digests of the pinned tag still come through.
|
|
- dependency-name: "golang"
|
|
update-types:
|
|
- "version-update:semver-minor"
|
|
- "version-update:semver-major"
|