mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-11-08 04:18:06 +00:00
Tiger Kaovilai
6ed67c01a0
* Add Dependabot docker updates for run-jammy-tiny on supported release branches The runtime base image is pinned on each release branch and was only bumped by hand during CVE patch releases, so it goes stale between releases (release-1.18 pinned 0.2.177, release-1.17 pins 0.2.90). Add docker ecosystem entries targeting the supported release branches (the current minor and N-1), limited to the paketobuildpacks/run-jammy-tiny image and to patch updates. Dependabot cannot compute target-branch, so add hack/update-dependabot-release-branches.sh, which regenerates those entries from the two newest minors with a GA vX.Y.0 tag, and a workflow that runs it when a release is published (plus weekly and on demand) and opens a pull request if dependabot.yml changed. Pre-release tags do not count, so release-1.19 is only picked up once 1.19.0 is out. Related to https://github.com/velero-io/velero/issues/10681 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Address review feedback on Dependabot release-branch automation - Replace head with sed in the tag pipeline: with pipefail set, head closing early can SIGPIPE the upstream sort and fail the script. - Allow minor version updates for the runtime base image (only semver-major stays ignored), per Paketo's stack bump policy: minors are maintainer-selected feature additions that should surface as PRs for review. Regenerated dependabot.yml. - Update development.md wording to match (patch or minor). Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Scope Dependabot automation workflow commit to dependabot.yml Commit only .github/dependabot.yml instead of all modified files when the automation workflow pushes its branch. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>