Bump golang from 1.19-alpine to 1.20-alpine by dependabot[bot] · Pull Request #2380 · oxsecurity/megalinter

dependabot · 2023-02-20T16:10:25Z

Bumps golang from 1.19-alpine to 1.20-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

bdovaz · 2023-02-20T19:58:46Z

@echoix in PR #2318 why didn't you choose this tag?

https://hub.docker.com/layers/library/golang/1-alpine/images/sha256-18da4399cedd9e383beb6b104d43aa1d48bd41167e312bb5306d72c51bd11548?context=explore

It is less prone to change (only in major versions) by dependabot.

Otherwise we will have a new PR every few days/weeks....

echoix · 2023-02-20T22:48:25Z

At that time, I didn't know if a newer Go compiler could be used on older code. It seems that it should work, as the go 1.19 in revive's go.mod file (https://github.com/mgechev/revive/blob/4981346ff97e22e439bbe27dba11524d44c17af5/go.mod#L3) means the minimum go version, as explained in
https://go.dev/doc/modules/gomod-ref#go-syntax

It's only later that I knew about it.
The change that we could do is as you say, pin to go major version 1, and any alpine, since the produced executable doesn't depend on the os it was built on (go produces static binaries that work as long as cpu arch is compatible, and os type is the same).

echoix · 2023-02-20T22:51:01Z

I'll do the pr on my cellphone tonight, and use the /build command as a little test :)

echoix · 2023-02-20T23:19:48Z

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.
Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.

nvuillam · 2023-02-20T23:23:09Z

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ BASH	bash-exec	6		0	0.01s
✅ BASH	shellcheck	6		0	0.16s
✅ BASH	shfmt	6	0	0	0.42s
✅ COPYPASTE	jscpd	yes		no	3.57s
✅ DOCKERFILE	hadolint	114		0	19.52s
✅ JSON	eslint-plugin-jsonc	21	0	0	2.58s
✅ JSON	jsonlint	19		0	0.34s
✅ JSON	v8r	21		0	14.36s
⚠️ MARKDOWN	markdownlint	309	0	230	8.11s
✅ MARKDOWN	markdown-link-check	309		0	6.2s
✅ MARKDOWN	markdown-table-formatter	309	0	0	21.56s
✅ OPENAPI	spectral	1		0	2.24s
⚠️ PYTHON	bandit	183		47	2.51s
✅ PYTHON	black	183	0	0	4.77s
✅ PYTHON	flake8	183		0	2.16s
✅ PYTHON	isort	183	0	0	1.62s
✅ PYTHON	mypy	183		0	8.99s
✅ PYTHON	pylint	183		0	14.12s
⚠️ PYTHON	pyright	183		254	20.45s
✅ REPOSITORY	checkov	yes		no	34.42s
✅ REPOSITORY	git_diff	yes		no	0.41s
✅ REPOSITORY	secretlint	yes		no	15.46s
✅ REPOSITORY	trivy	yes		no	33.84s
✅ SPELL	cspell	745		0	28.71s
✅ SPELL	misspell	566	0	0	1.15s
✅ XML	xmllint	3	0	0	0.5s
✅ YAML	prettier	81	0	0	3.57s
✅ YAML	v8r	23		0	70.91s
✅ YAML	yamllint	82		0	1.38s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by

echoix · 2023-02-21T02:20:59Z

/build ref=1d9bec75a7db74169e8940c037a4e4b17ff3cd90

No ref found for: 1d9bec7

echoix · 2023-02-21T02:21:50Z

/build ref=echoix:fix/build-sh-changes

No ref found for: echoix:fix/build-sh-changes

echoix · 2023-02-21T04:34:15Z

Once #2381 merged, call @dependabot rebase, then /build

echoix · 2023-02-26T20:33:37Z

@dependabot rebase

dependabot · 2023-02-26T20:33:39Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

echoix · 2023-02-26T20:34:25Z

@dependabot recreate

Bumps golang from 1.19-alpine to 1.20-alpine. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

echoix · 2023-02-26T20:38:50Z

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.

echoix · 2023-02-26T22:39:34Z

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.

echoix · 2023-03-02T18:14:28Z

/build ref=pull/2406/merge

No ref found for: pull/2406/merge

echoix · 2023-03-02T18:16:20Z

/build ref=dependabot/docker/golang-1.20-alpine

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed updating files.

echoix · 2023-03-02T18:31:34Z

@dependabot rebase

dependabot · 2023-03-02T18:31:36Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

nvuillam · 2023-03-02T19:18:07Z

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ BASH	bash-exec	6		0	0.02s
✅ BASH	shellcheck	6		0	0.14s
✅ BASH	shfmt	6	0	0	0.05s
✅ COPYPASTE	jscpd	yes		no	2.85s
✅ DOCKERFILE	hadolint	114		0	17.14s
✅ JSON	eslint-plugin-jsonc	21	0	0	1.81s
✅ JSON	jsonlint	19		0	0.29s
✅ JSON	npm-package-json-lint	yes		no	0.64s
✅ JSON	v8r	21		0	12.41s
⚠️ MARKDOWN	markdownlint	309	2	230	6.33s
✅ MARKDOWN	markdown-link-check	309		0	5.53s
✅ MARKDOWN	markdown-table-formatter	309	2	0	17.94s
✅ OPENAPI	spectral	1		0	1.68s
⚠️ PYTHON	bandit	183		47	2.2s
✅ PYTHON	black	183	0	0	3.6s
✅ PYTHON	flake8	183		0	1.8s
✅ PYTHON	isort	183	0	0	0.43s
✅ PYTHON	mypy	183		0	7.55s
✅ PYTHON	pylint	183		0	12.21s
⚠️ PYTHON	pyright	183		251	17.51s
✅ REPOSITORY	checkov	yes		no	30.91s
⚠️ REPOSITORY	devskim	yes		61	1.41s
✅ REPOSITORY	dustilock	yes		no	1.43s
✅ REPOSITORY	git_diff	yes		no	0.05s
✅ REPOSITORY	secretlint	yes		no	8.55s
✅ REPOSITORY	syft	yes		no	0.98s
✅ REPOSITORY	trivy	yes		no	23.32s
✅ SPELL	cspell	745		0	19.53s
✅ SPELL	misspell	566	2	0	0.6s
✅ XML	xmllint	3	0	0	0.03s
✅ YAML	prettier	81	0	0	2.78s
✅ YAML	v8r	23		0	60.71s
✅ YAML	yamllint	82		0	1.08s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

Click here to request the new flavor

MegaLinter is graciously provided by

echoix · 2023-03-04T23:13:09Z

Did it need to have a different title for the change log, since it doesn't use the solution proposed by dependabot? @nvuillam

nvuillam · 2023-03-04T23:16:55Z

It could be another PR, but as it's a dependency update, if we forget it's not the end of the world ^^

dependabot Bot requested a review from nvuillam as a code owner February 20, 2023 16:10

dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update Docker code labels Feb 20, 2023

Bump golang from 1.19-alpine to 1.20-alpine

eb04a10

Bumps golang from 1.19-alpine to 1.20-alpine. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot force-pushed the dependabot/docker/golang-1.20-alpine branch from cb03cc9 to eb04a10 Compare February 26, 2023 20:35

Update descriptor for revive (in go) to use a more general build image

9045161

echoix mentioned this pull request Feb 26, 2023

Fixup changes/no changes exit codes for build-command #2381

Merged

4 tasks

[build-command] Update generated files

c1274a2

nvuillam approved these changes Mar 4, 2023

View reviewed changes

nvuillam merged commit 9c6f020 into main Mar 4, 2023

nvuillam deleted the dependabot/docker/golang-1.20-alpine branch March 4, 2023 22:56

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bdovaz commented Feb 20, 2023

Uh oh!

echoix commented Feb 20, 2023

Uh oh!

echoix commented Feb 20, 2023

Uh oh!

echoix commented Feb 20, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nvuillam commented Feb 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦙 MegaLinter status: ⚠️ WARNING

Uh oh!

echoix commented Feb 21, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Feb 21, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Feb 21, 2023

Uh oh!

echoix commented Feb 26, 2023

Uh oh!

dependabot Bot commented on behalf of github Feb 26, 2023

Uh oh!

echoix commented Feb 26, 2023

Uh oh!

echoix commented Feb 26, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Feb 26, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Mar 2, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Mar 2, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Mar 2, 2023

Uh oh!

dependabot Bot commented on behalf of github Mar 2, 2023

Uh oh!

nvuillam commented Mar 2, 2023

🦙 MegaLinter status: ⚠️ WARNING

Uh oh!

echoix commented Mar 4, 2023

Uh oh!

nvuillam commented Mar 4, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Feb 20, 2023 •

edited

Loading

echoix commented Feb 20, 2023 •

edited by github-actions Bot

Loading

nvuillam commented Feb 20, 2023 •

edited

Loading

echoix commented Feb 21, 2023 •

edited by github-actions Bot

Loading

echoix commented Feb 21, 2023 •

edited by github-actions Bot

Loading

echoix commented Feb 26, 2023 •

edited by github-actions Bot

Loading

echoix commented Feb 26, 2023 •

edited by github-actions Bot

Loading

echoix commented Mar 2, 2023 •

edited by github-actions Bot

Loading

echoix commented Mar 2, 2023 •

edited by github-actions Bot

Loading