devcontainer-cli/versions.yaml at main · spin-stack/devcontainer-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# Every input this repository pins, written once: `versions check` says what is behind,
# `versions bump <name>` moves one (go-tools' commands, on the PATH of `go tool task`), and internal/devtools/versions_gate_test.go fails on a
# pin written anywhere else. GitHub Actions are pinned by commit in the workflows; Dependabot
# moves those, as go.sum is Go's.

- name: golangci-lint
  kind: image
  source: golangci/golangci-lint
  version: v2.15.0
  pin: sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481
  track: github-release https://github.com/golangci/golangci-lint
  note: >-
    task lint, with this repository's .golangci.yml. go-tools' version, so the spin-stack
    repositories are measured by the same linter; the image's Go must be at least go.mod's.

- name: node
  kind: image
  source: node
  version: 24-bookworm-slim
  pin: sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205
  track: digest
  note: >-
    The Node.js the ts-oracle runs the reference's functions in (task testdata:ts-oracle,
    TestTSOracleGoldensMatchTheReference), so a golden does not depend on the host's Node: URL
    parsing, IDNA and JSON.parse messages change between Node releases. A bump that changes an
    answer fails the oracle gate until the goldens are refreshed and the Go ports follow.

- name: distroless
  kind: image
  source: gcr.io/distroless/static
  version: nonroot
  pin: sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99
  track: digest
  note: >-
    The released image's base (Dockerfile's DISTROLESS_IMAGE, handed to GoReleaser by task
    release:env). A bump is checked by task release --snapshot and task release:smoke.

- name: task
  kind: download
  source: https://github.com/go-task/task/releases/download/v{version}/task_{os}_{arch}.tar.gz
  version: 3.54.0
  pins:
    linux/amd64: 680859dbb4d881a9c72d4d9a8f510825450849af8567deacd7302c01124416fb
    linux/arm64: d7189d439d4a6058e39e1b2acd7c8b27acd4856691b408f23b242e4294e1df5b
    darwin/amd64: 0543b0844a725814c0412d3f4bed12873ce9ed0da207b15775f63a97d734aac0
    darwin/arm64: 12a69fcf37bb8d5bc9150c44f9a936775b73e59ff044c2c245232f198c135637
  track: github-release https://github.com/go-task/task
  note: >-
    The Task `go tool task` runs (go-tools' cmd/task), for every platform a person or a runner
    works on: no repository compiles it.