Bump the actions group across 1 directory with 4 updates - #8
Closed
dependabot[bot] wants to merge 18 commits into
Closed
Bump the actions group across 1 directory with 4 updates#8dependabot[bot] wants to merge 18 commits into
dependabot[bot] wants to merge 18 commits into
Conversation
Two-stage build: a throwaway Alpine stage fetches the release tarball and
verifies its SHA-256, and only the unpacked tool is copied into a Temurin 25
JRE runtime, so curl and the 275 MB archive never reach the final image.
Three things needed care:
- The launcher derives its classpath from `dirname "${BASH_SOURCE[0]}"`, which
does not follow symlinks, so the install directory goes on PATH rather than
a symlink in /usr/local/bin.
- Upstream pins -Xmx2048m and appends it after $JAVA_OPTS, leaving the heap
stuck at 2 GB with no way for a caller to raise it. Replacing it with
MaxRAMPercentage makes the heap follow the container limit and restores
JAVA_OPTS overrides, since an explicit -Xmx takes precedence again.
- BioJava caches chemical component definitions under /tmp, which fails for any
non-root user unless the directory is pre-created world-writable and left
empty.
No ENTRYPOINT, so workflow engines that invoke the image as
`docker run <image> /bin/bash -c ...` work unchanged.
…tests Three separate failures on the first run: - The bind-mount test ran the image without --user, so it only passed where the host uid happens to be 1000. GitHub runners use 1001, where the container could not write its own temp directory. The test now passes --user like the README instructs, and the README gains a troubleshooting entry, since any user whose uid is not 1000 meets the same error. - hadolint-action pins hadolint 2.12, which cannot see the pinned default of the ARG used in FROM and reports DL3006; 2.15 locally does not. Ignored explicitly. - aquasecurity/trivy-action has no 0.28.0 tag, and SARIF upload needs Advanced Security, which private repositories lack. Pinned to v0.36.0 and switched to a table report that fails only on fixable HIGH/CRITICAL findings.
The scan found five fixable HIGH findings, all in jars shipped inside the P2Rank tarball: jackson-core, jackson-databind (PolymorphicTypeValidator bypass, arbitrary code execution) and msgpack-core. Packaging cannot fix them; the dependency bump has to happen in rdk/p2rank. Rather than let the build stay red or drop the gate entirely, they are listed in .trivyignore with expiry dates, so anything new still fails CI while these get re-reviewed instead of silently rotting.
Plain .trivyignore takes bare identifiers only; the `exp:` suffix belongs to .trivyignore.yaml, so every line parsed as an unmatched id and all five findings still failed the build. The YAML form also carries a statement per entry, which makes the reason visible in the scan output. Verified locally against the built image: trivy now exits 0.
Packaging this image is only half of what downstream pipelines need; the other half is a process definition that calls it sensibly. The module batches structures through a P2Rank dataset file so one JVM start covers many structures, and merges the per-structure CSVs into one table with a structure column, since P2Rank records the structure name only in the output filename. Verified by running it under Nextflow over the six mmCIF examples from the sibling protein-structure-annotation pipeline: 28 pockets across all six, identical results on 2.5.1 and 2.6-alpha. The README block is the same file, so the two cannot drift. The merge is awk rather than Python on purpose: the image ships a JRE and no interpreter.
Three related bits of cleanup on the way to a first release.
The packaged version lived in three places: the Dockerfile ARG, the
Makefile, and the EXPECTED_VERSION default in the test script. CI passed
only IMAGE, so the suite asserted its own default rather than what the
image contained. The Dockerfile ARG is now the only copy; the Makefile,
the test script and the release tags all derive from it.
The release tags no longer go through type=semver. Only 2.5.1 of
upstream's versions is valid semver — 2.5, 2.4, 2.6-alpha and every
prerelease are not — and procSemver emits no tag at all for those, so
packaging any of them would have published an untagged image. Tags are
now set literally from the Dockerfile version, with latest coming from a
single explicit line that prereleases never trigger. Drops the 2.5 alias,
which we are not publishing, and the dead
enable={{is_default_branch}} line, which cannot fire on a tag push.
ADD --checksum replaces the apk add / curl / sha256sum -c sequence.
BuildKit verifies the hash before creating the layer, busybox tar does
the extraction, and the fetch stage now installs nothing — which also
retires the DL3018 hadolint exception.
Finally, ci.yml triggers on pushes to main and pull requests, and a tag
push matches neither, so tagging would have published a multi-arch public
image the behavioural suite had never run against. The build-and-test job
moves to a reusable workflow that both ci.yml and release.yml call, with
publish gated on it. The gate is amd64 only: load: true cannot load a
multi-platform image into the daemon.
hadolint-action v3.1.0 bundles hadolint 2.12, which predates the flag and fails with "invalid flag: --checksum", so the lint job went red the moment the fetch stage switched to ADD. Locally hadolint is 2.15.1, which is why this passed before the push. v3.5.0 bundles 2.15.1 behind a digest pin. That version also parses the ARG default in FROM, so the DL3006 exception is no longer needed either — and with the DL3018 one already gone, .hadolint.yaml had nothing left in it but a comment that was now false about which version we run. Verified against the exact image the action pins.
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps alpine from 3.21 to 3.24. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v3...v4) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6...v7) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Five separate PRs for five action bumps, each needing its own rebase and its own CI run. Grouping them means one PR a week to review instead.
dependabot
Bot
added
dependencies
release.yml has never executed: the repo has no tags, so its first ever run would also be the one that publishes a public package that cannot be made private again. A dry run builds both platforms, computes the tags and runs the in-image smoke prediction under arm64 emulation, and publishes nothing. arm64 is the only claim in the README's spec table not backed by a real build.
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-adca9f62d7
branch
from
August 28, 2026 12:28
f64782e to
af115a7
Compare
Removes an editing habit that had crept through the prose: the em dash as an appositive, 34 of them across README, Dockerfile, workflows and the module. They are rewritten rather than substituted, since swapping the character keeps the tic. TODO.md is gone. It had become a mix of stale and done, its P0 heading claimed the image had never been published, and internal working notes are not what a visitor should meet first. The nine items still worth doing are now issues #9 to #18. The README no longer inlines the whole of modules/p2rank/main.nf. The module ships in the repo, so 62 lines of duplicate code bought nothing but a drift risk; it links instead, and drops from 314 lines to 252. Fixes found while checking the result: - The README's include example fed the structure list file itself into the module, so a copy-paste run produced a header-only pockets.csv while Nextflow reported success. It now takes a glob and is verified to give 28 pockets over the six sibling-pipeline mmCIF examples. - The fetch stage comment still claimed to keep curl out of the runtime image, which stopped being true when ADD --checksum replaced it. - tests/run-tests.sh says why it sets -uo pipefail without -e. .gitignore no longer names a local assistant notes file.
The first two lines were pitching rather than describing: 'Ready-to-run', bolded product name, and a three-part 'no X, no Y, no Z' followed by 'one command, and you get pockets'. States what the image is and what it needs instead.
The upstream release check told the reader to bump EXPECTED_VERSION in CI if it is pinned. It is not pinned any more, so whoever picks up the next P2Rank release would have gone looking for something that does not exist. It now says the ARG is the only place to change. Its version lookup also used grep -oP where the other two use sed; all three read the same way now. The Makefile no longer needs VERSION at all: it existed to pass EXPECTED_VERSION to the test suite, which derives the same value itself. make lint pinned hadolint to whatever :latest happened to be while CI pins 2.15.1. That gap is what let ADD --checksum pass locally and fail CI, so the Makefile now names the same version. The Trivy scan moves into the reusable build-and-test workflow and reuses the image the tests just ran against, instead of a second job building its own copy. One build per CI run rather than two. It also means the release path is now scanned, since it calls the same workflow. The arm64 comment invited dropping the platform if emulation got slow. It is about five minutes for both, so it records that instead.
Bumps the actions group with 4 updates in the / directory: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/login-action](https://github.com/docker/login-action), [docker/metadata-action](https://github.com/docker/metadata-action) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance). Updates `docker/setup-qemu-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@v5...v6) Updates `actions/attest-build-provenance` from 2 to 4 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@v2...v4) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-adca9f62d7
branch
from
August 28, 2026 13:51
af115a7 to
3f268c8
Compare
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/actions-adca9f62d7
branch
August 28, 2026 14:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 4 updates in the / directory: docker/setup-qemu-action, docker/login-action, docker/metadata-action and actions/attest-build-provenance.
Updates
docker/setup-qemu-actionfrom 3 to 4Release notes
Sourced from docker/setup-qemu-action's releases.
... (truncated)
Commits
96fe6efMerge pull request #315 from docker/dependabot/npm_and_yarn/docker/actions-to...31f08d3[dependabot skip] chore: update generated content4e7017abuild(deps): bump@docker/actions-toolkitfrom 0.91.0 to 0.92.00eca235Merge pull request #314 from crazy-max/fix-yarn-preapprove-actions-toolkitea66a41chore: allow actions-toolkit to bypass yarn age gate451542bMerge pull request #308 from docker/dependabot/npm_and_yarn/undici-6.27.0532ae00[dependabot skip] chore: update generated contentb6f5af6build(deps): bump undici from 6.26.0 to 6.27.0cf96b86Merge pull request #304 from docker/dependabot/npm_and_yarn/tmp-0.2.7f0ba643[dependabot skip] chore: update generated contentUpdates
docker/login-actionfrom 3 to 4Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
dbcb813Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...5bcb015[dependabot skip] chore: update generated contentb30b2f2build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...9087f1eMerge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.20009830[dependabot skip] chore: update generated content2325523build(deps): bump js-yaml from 5.2.1 to 5.2.24ec1d4aMerge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.225fc99baMerge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...e512bd5Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...a146c91Merge pull request #1059 from crazy-max/harden-buildx-scope-pathsUpdates
docker/metadata-actionfrom 5 to 6Release notes
Sourced from docker/metadata-action's releases.
... (truncated)
Commits
dc80280Merge pull request #696 from docker/dependabot/npm_and_yarn/docker/actions-to...2b9fe83[dependabot skip] chore: update generated content8128ce3chore(deps): Bump@docker/actions-toolkitfrom 0.91.0 to 0.92.01d1c895Merge pull request #695 from docker/dependabot/npm_and_yarn/semver-7.8.57f0c2ddMerge pull request #694 from docker/dependabot/npm_and_yarn/sigstore-4.1.1025f8c5[dependabot skip] chore: update generated contente98d63cchore(deps): Bump semver from 7.8.1 to 7.8.537d9379chore(deps): Bump sigstore from 4.1.0 to 4.1.1a1b8072Merge pull request #690 from docker/dependabot/npm_and_yarn/sigstore/core-3.2.1e0e3381[dependabot skip] chore: update generated contentUpdates
actions/attest-build-provenancefrom 2 to 4Release notes
Sourced from actions/attest-build-provenance's releases.
... (truncated)
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)a2bbfa2bump actions/attest from 4.0.0 to 4.1.0 (#838)0856891update RELEASE.md docs (#836)