From ff8f091ed63969f0008fc5d97b33a16381f9c0be Mon Sep 17 00:00:00 2001 From: xnoto Date: Thu, 13 Aug 2026 17:57:27 -0600 Subject: [PATCH] chore: upgrade image toolchain dependencies --- .github/workflows/buildah.yml | 14 +++++++------- .pre-commit-config.yaml | 2 +- AGENTS.md | 2 +- README.md | 4 ++-- gh-cli/Containerfile | 2 +- tfroot-runner/Containerfile | 23 +++++++++++++---------- tfroot-runner/pre-commit-config.yaml | 2 +- 7 files changed, 26 insertions(+), 23 deletions(-) diff --git a/.github/workflows/buildah.yml b/.github/workflows/buildah.yml index 9416bc8..ea526c7 100644 --- a/.github/workflows/buildah.yml +++ b/.github/workflows/buildah.yml @@ -27,18 +27,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install hadolint run: | mkdir -p "$HOME/.local/bin" curl -sSL -o "$HOME/.local/bin/hadolint" \ - https://github.com/hadolint/hadolint/releases/download/v2.14.0/hadolint-Linux-x86_64 + https://github.com/hadolint/hadolint/releases/download/v2.15.1/hadolint-linux-x86_64 chmod +x "$HOME/.local/bin/hadolint" echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: '3.12' @@ -53,7 +53,7 @@ jobs: images: ${{ steps.find.outputs.images }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 2 @@ -87,7 +87,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install buildah and podman run: | @@ -95,7 +95,7 @@ jobs: sudo apt-get install -y buildah podman - name: Build image - uses: redhat-actions/buildah-build@v2 + uses: redhat-actions/buildah-build@v3 with: context: ${{ matrix.image }} containerfiles: ${{ matrix.image }}/Containerfile @@ -109,7 +109,7 @@ jobs: if: | (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && inputs.mode == 'build & push') - uses: redhat-actions/push-to-registry@v2 + uses: redhat-actions/push-to-registry@v3 with: image: ${{ matrix.image }} tags: latest ${{ github.sha }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 8911517..c8bcbd5 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -21,7 +21,7 @@ repos: entry: gitleaks dir --redact --verbose . pass_filenames: false - repo: https://github.com/hadolint/hadolint - rev: v2.14.0 + rev: v2.15.1 hooks: - id: hadolint args: [--failure-threshold=error] diff --git a/AGENTS.md b/AGENTS.md index 28c35ff..414c028 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -35,7 +35,7 @@ Single workflow, three jobs, all on `ubuntu-latest`. - push/PR → only directories changed since the previous commit (`make changed-images`) 3. **build** — after checks pass, fan out over the detected image matrix: - install buildah and podman - - `redhat-actions/buildah-build@v2` with `--squash` + - `redhat-actions/buildah-build@v3` with `--squash` - on `push` to `main`, or `workflow_dispatch` with `mode=build & push`, push to GHCR with tags `latest` and `${{ github.sha }}` PRs and `workflow_dispatch` with `mode=build` build but do not push. diff --git a/README.md b/README.md index bd674a5..7c8708e 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,8 @@ Container image monorepo. Each subdirectory containing a `Containerfile` is buil | Directory | Base | Purpose | |---|---|---| -| `tfroot-runner/` | `ghcr.io/actions/actions-runner` (Ubuntu) | gha-runner-scale-set runner with the OpenTofu IaC toolchain (kubectl, kustomize, sops, ansible, pre-commit, tflint, terraform-docs, infracost, checkov) | -| `gh-cli/` | `alpine:3.21` | Minimal `gh` image for automation Jobs | +| `tfroot-runner/` | `ghcr.io/actions/actions-runner:2.336.0` (Ubuntu) | gha-runner-scale-set runner with the OpenTofu IaC toolchain (kubectl, kustomize, sops, ansible, pre-commit, tflint, terraform-docs, infracost, checkov) | +| `gh-cli/` | `alpine:3.24` | Minimal `gh` image for automation Jobs | ## How It Works diff --git a/gh-cli/Containerfile b/gh-cli/Containerfile index 70a73ff..30da9c6 100644 --- a/gh-cli/Containerfile +++ b/gh-cli/Containerfile @@ -1,5 +1,5 @@ # Minimal GitHub CLI image for automation tasks -FROM alpine:3.21 +FROM alpine:3.24 LABEL description="Minimal Alpine image with GitHub CLI for automation tasks" LABEL org.opencontainers.image.source="https://github.com/makeitworkcloud/images" diff --git a/tfroot-runner/Containerfile b/tfroot-runner/Containerfile index f5a2314..912c90b 100644 --- a/tfroot-runner/Containerfile +++ b/tfroot-runner/Containerfile @@ -9,18 +9,20 @@ ############################## # Pinned versions — update here ############################## -ARG OPENTOFU_VERSION=1.12.3 -ARG SOPS_VERSION=3.13.1 +ARG OPENTOFU_VERSION=1.12.5 +ARG SOPS_VERSION=3.13.3 ARG TERRAFORM_DOCS_VERSION=0.24.0 -ARG TFUPDATE_VERSION=0.9.4 +ARG TFUPDATE_VERSION=0.10.2 ARG HCLEDIT_VERSION=0.2.18 -ARG TFLINT_VERSION=0.63.1 -ARG INFRACOST_VERSION=0.10.44 -ARG KUBECTL_VERSION=1.36.2 +ARG TFLINT_VERSION=0.64.0 +ARG INFRACOST_VERSION=0.10.45 +ARG KUBECTL_VERSION=1.36.3 ARG KUSTOMIZE_VERSION=5.8.1 -ARG CHECKOV_VERSION=3.3.1 -ARG PRECOMMIT_VERSION=4.6.0 +ARG CHECKOV_VERSION=3.3.11 +ARG PRECOMMIT_VERSION=4.6.2 ARG PYTHON_VERSION=3.14 +ARG YQ_VERSION=4.53.3 +ARG ACTIONS_RUNNER_VERSION=2.336.0 ############################## # Stage 1: Build/download tools @@ -103,9 +105,10 @@ RUN set -eux; \ ############################## # Stage 2: Final runner image ############################## -FROM --platform=linux/amd64 ghcr.io/actions/actions-runner:latest +FROM --platform=linux/amd64 ghcr.io/actions/actions-runner:${ACTIONS_RUNNER_VERSION} ARG PYTHON_VERSION +ARG YQ_VERSION LABEL org.opencontainers.image.title="tfroot-runner" \ org.opencontainers.image.description="GitHub ARC runner with OpenTofu, kubectl, kustomize, sops, ansible, pre-commit, and friends." \ @@ -127,7 +130,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ ansible-core openssh-client \ jq genisoimage gnupg make shellcheck libatomic1 \ && update-alternatives --install /usr/bin/python3 python3 /usr/bin/python${PYTHON_VERSION} 1 \ - && curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \ + && curl -fsSL "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64" \ -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /usr/share/doc/* /usr/share/man/* diff --git a/tfroot-runner/pre-commit-config.yaml b/tfroot-runner/pre-commit-config.yaml index 0a13db2..4c43d26 100644 --- a/tfroot-runner/pre-commit-config.yaml +++ b/tfroot-runner/pre-commit-config.yaml @@ -10,7 +10,7 @@ repos: - id: conventional-pre-commit stages: [commit-msg] - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.107.0 + rev: v1.108.1 hooks: - id: terraform_validate args: