mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-09-24 21:30:26 +01:00
CaliBrain
29ce83e274
PR #1169 (python:3.14.6-slim -> python:3.15.0b3-slim) ran for 6h before GitHub's max job limit killed it, then did it again on re-run. Two independent defects. Dependabot proposed a beta at all: the config already excluded python from the docker digest group for dependabot-core#9496, but the comment claimed ungrouped python updates get their pre-release filtered. They don't. dependabot-core#13815 rewrote the Docker pre-release heuristic to catch PEP 440 tags (its tests cover 3.15.0a2 and 3.5.0b3), yet the suffixed real tag still got through seven months later. CPython spells pre-releases without a separator, so 3.15.0b3 parses as an ordinary version sorting above 3.14.6. Ignore python semver-minor/major instead of trusting the heuristic; patch and digest updates still flow. The run took hours rather than failing: the health wait looked bounded at 60 iterations x 2s, but bare `curl` has no timeout. The 3.15 image booted a container that bound 8084 without ever serving (greenlet has no 3.15 wheel, so the gevent gunicorn worker was wedged), so curl blocked on read forever and the loop never reached iteration 2. Every job's orphan process at cancellation was that curl. Bound each probe and switch to a wall-clock deadline, and add timeout-minutes so a hang can never reach 6h again. Verified against a socket that accepts and never responds: the old loop was still hung at 30s, the new one exits at 120s with HEALTHY=0 into the existing log-dump path, and a responsive endpoint is still detected immediately.
88 lines
3.3 KiB
YAML
88 lines
3.3 KiB
YAML
version: 2
|
|
updates:
|
|
# Python dependencies
|
|
# Dependabot supports uv version updates, but GitHub currently lists uv
|
|
# security updates as "Not applicable"; daily checks keep uv.lock moving
|
|
# while repo-level Dependabot alerts/security updates cover supported ecosystems.
|
|
- package-ecosystem: "uv"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
time: "05:00"
|
|
timezone: "Europe/London"
|
|
cooldown:
|
|
default-days: 3
|
|
open-pull-requests-limit: 10
|
|
groups:
|
|
python-deps:
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
|
|
# Frontend npm dependencies
|
|
- package-ecosystem: "npm"
|
|
directory: "/src/frontend"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
default-days: 3
|
|
open-pull-requests-limit: 10
|
|
groups:
|
|
npm-deps:
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
|
|
# Dockerfile base image digests. When a tag stays the same, Dependabot titles
|
|
# can only show digest prefixes, so keep the group name explicit.
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
default-days: 3
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
docker-base-image-digests:
|
|
# Exclude python from the group on purpose. Dependabot's Docker
|
|
# pre-release filter is bypassed for *grouped* updates
|
|
# (dependabot-core#9496), so a grouped python update proposes pre-release
|
|
# tags like python:3.15.0b2 as if they were a normal stable minor bump.
|
|
# node + uv stay grouped into a single digest PR.
|
|
patterns: ["*"]
|
|
exclude-patterns: ["python"]
|
|
ignore:
|
|
# Node.js: block major-version bumps so dependabot never proposes
|
|
# moving from one LTS line to a non-LTS "Current" release (e.g. 24 -> 25).
|
|
# Node LTS is even-numbered only; major bumps should be deliberate.
|
|
- dependency-name: "node"
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
# Python: block minor/major bumps. Ungrouping python (above) is NOT enough
|
|
# to keep pre-releases out — dependabot-core#13815 rewrote the Docker
|
|
# pre-release heuristic to catch PEP 440 tags like 3.15.0a2 / 3.5.0b3, but
|
|
# the suffixed real tag still slipped through as PR #1169
|
|
# (python:3.14.6-slim -> python:3.15.0b3-slim). CPython spells
|
|
# pre-releases without a separator, so tag parsing reads 3.15.0b3 as an
|
|
# ordinary version that sorts above 3.14.6.
|
|
#
|
|
# A minor-version ignore blocks it regardless of spelling. Patch bumps
|
|
# (3.14.6 -> 3.14.7) and same-tag digest refreshes still land automatically.
|
|
# Moving the runtime to a new Python minor is a manual, deliberate change:
|
|
# bump the tag here and confirm C-extension wheels (greenlet/gevent) exist
|
|
# for it — a source build against a pre-release ABI boots an app that binds
|
|
# its port but never serves, which wedges e2e for the full 6h job limit.
|
|
- dependency-name: "python"
|
|
update-types:
|
|
["version-update:semver-major", "version-update:semver-minor"]
|
|
|
|
# GitHub Actions
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
default-days: 3
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
gh-actions:
|
|
patterns: ["*"]
|