build(deps): bump the docker-base-images group across 4 directories with 2 updates#32
Closed
dependabot[bot] wants to merge 310 commits into
Closed
Conversation
…l P3-ATS-1)
The WARDYN_TEST_PG bootstrap (env-gate, db.Connect, db.Migrate,
t.Cleanup, embedded.New, New(Config{...})) was copy-pasted three times.
pgHarness is now a thin wrapper over pgHarnessWithRunner that overrides
DefaultPolicy, and the inline copy in
TestReconcileFinalize_TeardownErrorAudited calls pgHarnessWithRunner
directly and reads audit via the established srv.cfg.Audit cast.
Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…P3-ATS-2) Five test sites still hand-rolled the verbatim Config preamble baseTestConfig was extracted to eliminate: approved_egress_test.go x3, scanresult_test.go x1, and site_config_test.go's newSiteConfigHarness. Each is now srv := New(baseTestConfig(h, fake)) with any overrides applied on the returned Config, matching the package norm. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…P3-UWZ-1)
guaranteeSentences was a third parallel prose-projection of RunPolicySpec
duplicating canLines/cantLines, with exactly one caller (policies.tsx) and
zero test coverage. Render ComposeQuickReview inline_policy={policy.spec}
in the stored-policy detail sheet instead, and delete guaranteeSentences.
Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…il P3-UWZ-2) The third describe block re-rendered ComposeReview to re-assert the high-risk ack gate and the no-"unrestricted" invariant, both already covered as a strict superset by compose-review.test.tsx. Delete the block, the baseRun fixture, and the now-unused imports. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
run-detail.tsx's ReasonDialog copy had drifted stale: it showed the credential-mint description for every approve, including egress_domain and tool_call kinds where no mint happens. Consolidate to one shared kind-aware ReasonDialog in wardyn/, imported by both run-detail.tsx and approvals.tsx; thread ApprovalRequest.kind through onDecide. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…l P3-ULS-1) workspaces.tsx, policies.tsx, and secrets.tsx each re-rolled a near-verbatim delete-confirm block (state + confirmDelete + destructive AlertDialog). One shared wardyn/DeleteConfirmDialog now owns the busy spinner and toast.success/toast.error(getErrorMessage); each screen keeps only its toDelete state and a short usage. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…ULS-2) approvals.tsx, audit.tsx, and runs.tsx each duplicated the entire fetch+setState body between the foreground load() and the silent background poll. Extract one fetch body per file (fetchAll/fetchEvents/ fetchRuns) shared by both; keeps the deliberate skeleton-vs-silent behavior the comments defend. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
The "StepIndicator regression" describe block tested a StepIndicator x SETUP_STEPS pairing that exists nowhere in prod (SetupScreen renders its own FunnelStepper) plus a PermissionWizard smoke test already covered by wizard.test.tsx. Delete the block and its now-unused imports; un-export SETUP_STEPS/SetupStepId since setup-screen.tsx was their only consumer. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…tail P3-USU-2)
CredentialsStep drilled 10 props from SetupScreen for form state only it
uses, unlike its sibling corp steps which keep local state, and included
a patHost field that was never saved, sent to any API, or read anywhere
("informational only" per its own copy). Move appId/savingAppId state +
saveAppId() into CredentialsStep and drop the do-nothing patHost field.
Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
stepDot(), StepDot, and isFailedStatus() were exported and unit-tested but never rendered — the import rail uses StepIndicator (step-shell.tsx), which derives done/active/todo from the current index and has no failed-dot concept. Delete the dead functions and their tests. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…-ULB-3) tsconfig.node.json is a Vite-template vestige: its only include (vite.config.ts) is already in tsconfig.json's own include, and nothing runs tsc -b or plain tsc on it — only `tsc -p tsconfig.check.json` runs in CI. Delete it, drop the project-references entry from tsconfig.json, and drop the references:[] workaround from tsconfig.check.json. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…nytail P3-ULB-4) package.json declared react/react-dom ONLY as optional peerDependencies in a private:true end-user app (peerDependencies are library semantics; nothing depends ON @wardyn/ui) — installation relied on pnpm's auto-install-peers. Move react/react-dom into dependencies and drop the peerDependencies/peerDependenciesMeta blocks (also covers DEP-1, the identical fix). Delete pnpm-workspace.yaml (packages: ['.'], zero refs anywhere, no parent workspace) — a no-op single-package guard. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…ail P3-STO-1) 194-line hand-rolled memStore + 6 contract tests exercised only the in-file fake (zero prod code). secretstoretest.RunConformance already asserts the identical contract (roundtrip, missing->ErrNotFound, overwrite, delete-idempotent, list) against the real pg backend. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…ail P3-STO-4) TestMigrationsDiscoveredInLexicalOrder and TestMigrationFilenamesUnique are fully subsumed by TestMigrationPrefixesNoGapsOrDupes: with the NNNN prefix regex enforced, lexical order == numeric order (can only fail on a duplicate prefix, already caught), and duplicate filenames from a single ReadDir are unreachable. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
Both tests open-coded the connect+migrate+cleanup harness inline while the same package already has runsPGPool(t) doing exactly this (identical Getenv-skip/db.Connect/db.Migrate/t.Cleanup(pool.Close) steps). Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
… (ponytail P3-STO-2) The PG adapter's 38 one-line delegation methods existed only because every query was a free function taking an explicit *pgxpool.Pool. Make the free functions methods on PG directly (drop the pool param, bodies unchanged) and delete the delegation block; Store interface, NewPG, and the SQLite-seam story are unchanged. Updates all callers: cmd/wardynd/adapters.go, internal/api test helpers, test/apie2e harness, and the *_pg_test.go suite. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…ytail P3-STO-3) pgx.Rows structurally satisfies pgx.Row (both declare Scan(dest ...any) error), so the 5 *Row twin scanners (scanPolicyRow, scanGrantRow, scanApprovalRow, scanAuditEventRow, scanWorkspaceRow) that duplicated scanPolicy/scanGrant/scanApproval/scanAuditEvent/scanWorkspace line-for-line are gone: collectRuns and every List* loop now pass rows straight to the Row-variant scanner. wsScanDest/fillWorkspace (existed only to share code between the workspace twins) are folded back into scanWorkspace. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…ytail P3-TYP-1) internal/identity/identity_test.go was 273 lines asserting the Provider contract against a hand-rolled fakeProvider, exercising zero production code (package identity holds only interfaces + registry). Same invariants are covered against the REAL provider by identitytest.RunConformance (wired via embedded_conformance_test.go) and embedded/embedded_test.go (expired token, sponsor defaults, CloudSTS refusal, revoke). Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
Provider.Keys() exported the verification key as a JWKS 'for the API to serve', but no route/sidecar/script/doc ever serves or fetches it — verification is in-process on the same Provider. Delete Keys() and its TestKeysJWKS twin, plus the jose/encoding-json imports that became unused. keyID()/kid stay; still stamped into the signer header. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…imeout knob (ponytail P3-TYP-3) Config.Clock had one prod impl (realClock) and a 19-line test fakeClock whose Advance() was never called; StopTimeout had zero setters anywhere (prod or test). Replace Clock with Now func() time.Time, the same 'now func() time.Time // overridable in tests' idiom already used by embedded.Provider. Drop StopTimeout and use defaultStopTimeout directly in Tick; the 2-min per-stop bound is preserved as a constant. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…3-SCM-1) selectConfig mirrored main()'s config-source switch and mostly re-tested the owning-package loader (internal/egress/proxy). Delete the file; fold the non-duplicated cases (control_plane_url/run_token required, malformed JSON, explicit Listen/DecisionBufferSize overrides) into TestLoadConfigDefaultsAndValidation, which exercises the real LoadConfig. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…tail P3-SCM-2) buildLocalURL hand-rolled URL joining that url.JoinPath (Go 1.19+) does in one line; both callers (callMint, pollApproval) only ever pass host:port bases with no path, so output is unchanged. Delete TestBuildLocalURL, which only asserted stdlib behavior. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…M-3) heartbeatLoop/refreshLoop/statsLoop were three copies of identical ticker+ctx-select boilerplate around a one-line body, each called exactly once. Replace with a single every(ctx, ival, fn) helper plus three closures; heartbeat's immediate first beat stays inside its own goroutine so startup never blocks on a control-plane POST. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
audit_test.go was 156 lines asserting hand-rolled fakes (fakeRecorder/ fakeSink) satisfy interfaces already compile-checked by real impls (store/recorder.go:16, adapters.go:173/199/234) and covered by sinks/* tests. No production code path exercised. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
ListCasts had zero production callers (no list-recordings endpoint anywhere). Drop it from the Store interface, FSStore, the conformance list subtest, TestFSStore_ListCasts, and the forced fake impl in recording_upload_test.go. Re-add when a listing feature ships. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…P3-AUX-2) TestFSStore_Roundtrip and TestFSStore_OpenCast_NotFound (+ isNotFound helper) are strict subsets of TestFSStore_Conformance's save_open_roundtrip and open_missing_returns_ErrNotFound, run against the same NewFSStore(t.TempDir()). TestFSStore_TraversalRejection (security) and the handler tests are untouched. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
Replace 14 near-identical error-path tests (one-status server -> call -> assertAPIError) across client_test.go and client_more_test.go with a single table-driven TestAPIErrorPaths. assertAPIError now returns *client.APIError so callers can chain Body/Error() assertions; the duplicate assertAsAPIError helper is deleted. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…nytail P3-SDK-2) Replace 7 hand-rolled slice-membership/index loops across 5 apie2e test files with stdlib slices.Contains/ContainsFunc/IndexFunc, and rewrite equalStringSets as slices.Equal over slices.Sorted(slices.Values(...)) (preserves multiset equality). actionsOf stays (it's a transform, not a membership check). Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…-SDK-4) doAdmin, getJSON, and putRaw each hand-rolled the same build-request/ set-bearer/Do/read-body skeleton. Extract one shared doRaw(t, method, url, bearer, body) in harness_test.go; the three become 1-line wrappers. doRaw sends Content-Type/Accept: application/json unconditionally — neither is enforced server-side (recording upload ignores Content-Type; only an SSE Accept is special-cased), so this is safe for putRaw's raw asciicast body too. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…onytail P3-SDK-3) RecordingOptions embeds Options instead of re-declaring SandboxImage/Timeout/ExitArgv and copying timeout()/image() verbatim; this changes neither Run's signature nor behaviour, only the 4 RecordingOptions literal call sites in none_test.go (now nest their fields under Options:). Weakened per skeptic verify_note: only the 3 preambles that share the same no-classes-handling KIND (Skipf) — testL0StructuralEgress, testWaitExitCode, testInteractiveAttach — are folded into a new createStrongestSandbox helper. testCapabilities (Logf) and CheckRecordingCapability (fail-closed Errorf) keep their own preambles; forcing them into one helper was flagged as a misfit. Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…tion disclosed, indexes for the run-scoped audit sort (U048/U049/U070/U071)
… with honest package-doc claims (U047)
…U053); one shared finalizeRunTail for watcher+reconciler (U145); terminal lifecycle split to runs_lifecycle.go
…o llmcred.go — pure relocation (U051)
…ence; storage posture documented honestly (U098)
…reads AND stale doc rows fail); typed helpers on remaining parseable reads (U084 + codequal)
…al mux+auth (U079)
…rridable so it passes locally and on ubuntu-latest (U064)
…mmands in RELEASING, R4 changelog entries
…label uses RUN_MODE copy, CLI 401 carries a token hint, OIDC discovery bounded by bootCtx, compose.go/store.go leave the size allowlist
… tabindex + arrow keys), pinned by test
… 18 blind re-assessments), residuals; Fable-audited (two prose corrections applied)
…dual-daemon socket fix - Demos become a funnel phase before Your Work: four demos as sidebar sub-steps, each with overview + policy YAML + UI-setup steps, an inline audit panel, and a launched-checkmark. Corporate phase moved earlier with one-click skip; SCM stays in Your Work. - Harness container-login: auto-launch the login sandbox, auto-type 'claude setup-token', auto-open the OAuth URL, add a paste-the-code field, and auto-capture the sk-ant-oat token. - attach-terminal: own paste end-to-end (raw send + preventDefault + coalescing) and expose a sendText handle; denied demo curls use -sSI so the 403 is visible. - scripts/lib/common.sh derives WARDYN_DOCKER_SOCK from DOCKER_HOST (dual-daemon tier fix); ci-run.sh drops its duplicate derivation.
A new wardyn-proxy local route (/wardyn/gh/<org>/<repo>) reverse-proxies git-smart-HTTP to github.com: it enforces a per-repo allowlist in cleartext, mints the repo-scoped GitHub App token proxy-side (never into the sandbox), and re-originates upstream. agent-run rewrites granted github URLs to the broker via url.insteadOf; github.com is dropped from run egress. Repo is the unit of trust — an un-granted github repo is denied. - Per-grant token cache (correctness-critical: a clone is >=2 requests and approval-gated grants are single-use, so no cache would 409 on the second). - GitGrants threaded run-create -> ProxyConfig -> proxy.Config; built from grant scope.repos plus the declared clone set (run.Repo + WorkspaceRepos), since example grants carry empty repos. - scanEgressDomains drops the github bundle (keeps ssh-over-443 for ssh_key repos); record-egress never promotes github hosts; example policies drop github. - Clone + push (git-receive-pack) brokered, repo-scoped. v1 github-HTTPS only; LFS / GHES / ADO-GitLab / in-repo branch confinement deferred. - Tests: handler (Basic x-access-token auth, sandbox-cred strip, path/service/Git-Protocol preserved, single-mint cache, traversal/ungranted 403s) + wiring helpers; CI/TRY-IT/sdk docs updated.
…d internal markers Untrack (kept out of the repo) maintainer-local process/design artifacts: review notes, design-tool exports, contributor-campaign results, and the design-system-sync tooling. Genericize a company name in test fixtures. Strip internal review-tracking markers and stray development-mode annotations from code comments. Rename the fat toolchain agent image to a neutral name. No behavior change; build/test/typecheck green. History is intentionally not rewritten; this cleans the current tree only.
Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…der the complexity gate) Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
Signed-off-by: cjohnstoniv <cjohnstoniv@users.noreply.github.com>
…ith 2 updates Bumps the docker-base-images group with 2 updates in the /deploy/compose directory: alpine and node. Bumps the docker-base-images group with 1 update in the /deploy/images/claude-code directory: node. Bumps the docker-base-images group with 1 update in the /deploy/images/codex-cli directory: node. Bumps the docker-base-images group with 1 update in the /deploy/images/oracle directory: alpine. Updates `alpine` from 3.20 to 3.24 Updates `node` from 22-bookworm-slim to 26-bookworm-slim Updates `node` from 22-bookworm-slim to 26-bookworm-slim Updates `node` from 22-bookworm-slim to 26-bookworm-slim Updates `alpine` from 3.20 to 3.24 --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-base-images - dependency-name: node dependency-version: 26-bookworm-slim dependency-type: direct:production dependency-group: docker-base-images - dependency-name: node dependency-version: 26-bookworm-slim dependency-type: direct:production dependency-group: docker-base-images - dependency-name: node dependency-version: 26-bookworm-slim dependency-type: direct:production dependency-group: docker-base-images - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-base-images ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/docker/deploy/compose/docker-base-images-dd86ba6c95
branch
July 20, 2026 02:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the docker-base-images group with 2 updates in the /deploy/compose directory: alpine and node.
Bumps the docker-base-images group with 1 update in the /deploy/images/claude-code directory: node.
Bumps the docker-base-images group with 1 update in the /deploy/images/codex-cli directory: node.
Bumps the docker-base-images group with 1 update in the /deploy/images/oracle directory: alpine.
Updates
alpinefrom 3.20 to 3.24Updates
nodefrom 22-bookworm-slim to 26-bookworm-slimUpdates
nodefrom 22-bookworm-slim to 26-bookworm-slimUpdates
nodefrom 22-bookworm-slim to 26-bookworm-slimUpdates
alpinefrom 3.20 to 3.24Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions