Update depot/setup-action digest to 91bc849 - #4753
Conversation
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
75e660d to
a4d69bb
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
Blocker: Go 1.27.0 breaks the flow module build.
github.com/cockroachdb/swiss deliberately gates its runtime-introspection file on an explicit Go version range. At the pinned pseudo-version v0.0.0-20251224182025-b0f6560f979b (indirect, via github.com/cockroachdb/pebble/v2 v2.1.6), runtime_go1.20.go carries:
//go:build (go1.20 && !go1.27) || untested_go_versionUnder Go 1.27 that file is excluded from the build, so hashFn, getRuntimeHasher and fastrand64 become undefined and the swiss -> pebble/v2 -> flow/connectors/utils/cdc_store.go chain fails to typecheck.
The lint check on this PR already reproduces it:
flow/connectors/utils/cdc_store.go:15:2: could not import github.com/cockroachdb/pebble/v2
(... could not import github.com/cockroachdb/swiss (-: # github.com/cockroachdb/swiss
swiss@v0.0.0-20251224182025-b0f6560f979b/map.go:286:7: undefined: hashFn
swiss@.../map.go:337:14: undefined: getRuntimeHasher
swiss@.../map.go:338:22: undefined: fastrand64 ...)
flow/connectors/utils/cdc_store.go:39:29: undefined: pebble (typecheck)
This is not lint-specific — it is a plain compile failure, so go build/go test of flow fail identically on Go 1.27.
Options:
- Hold this bump at
1.26.7(also released in this range per the PR body) and land 1.27 once the dependency is ready. - Bump
swisspastcockroachdb/swiss@aa852fb3c14e("Enable go 1.27 support", 2026-08-20), whose tag is now(go1.20 && !go1.28). It has no release tag yet, so this needs an explicitrequire/replaceinflow/go.mod, or waiting for apebblerelease that pulls it in.
Note the docker-build check is green here only because stacks/flow.Dockerfile still builds on golang:1.26-alpine — it is not evidence that Go 1.27 works. That skew is worth a thought independently: after this PR, tests/lint run on Go 1.27 while the shipped image compiles on Go 1.26, and Go 1.27 makes encoding/json v2-backed by default (GOEXPERIMENT=nojsonv2 to opt out) and changes compress/flate output — so CI would validate different stdlib behavior than what ships.
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
Same blocker as in golang-lint.yml: this job compiles and runs go test on the host with this toolchain, so it hits the identical cockroachdb/swiss build-tag failure (//go:build (go1.20 && !go1.27)) via pebble/v2 in flow/connectors/utils/cdc_store.go. The flow_test matrix jobs will not get past compiling the flow module.
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | ||
| with: | ||
| version: v2.12.2 | ||
| version: v2.13.1 |
There was a problem hiding this comment.
The golangci-lint v2.12.2 -> v2.13.1 bump itself looks fine, and is in fact a prerequisite for Go 1.27 (v2.13.0 added go1.27 support). I checked flow/.golangci.yml against the changelog and found no config-breaking changes: exhaustruct is deprecated but not enabled here, and the removed/renamed govet-modernize analyzers (fmtappendf removed, waitgroup -> waitgroupgo) are not named explicitly.
One caveat: because the run aborts at typecheck (see the Go version comment above), none of the new analyzer output has actually been exercised. Once the toolchain issue is resolved, expect possible new findings from:
staticcheck0.8.0-rc.1 -> 0.8.0 GA, understaticcheck.checks: [all, ...]errcheck1.10.0 -> 1.20.0 (default-enabled linter)govet-modernize0.44.0 -> 0.49.0 — this config setsgovet.enable-all: true, so the newatomictypes,embedlit,errorsastype,importcomment,reflecttypeassert,slicesclipandslicesbackwardanalyzers are auto-enabledgofumpt0.9.2 -> 0.11.0 formatting drift
Worth a clean re-run before merging rather than assuming green.
| uses: ./.github/actions/genprotos | ||
|
|
||
| - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1 | ||
| - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 |
There was a problem hiding this comment.
Checked this digest bump — no findings, noting it here so the audit is on record.
15c09a5...91bc849 is 11 commits: adds a configure-docker input (default: 'false', and the only code change is a guarded depot configure-docker exec), a dist-verification CI job, a dependency/toolchain refresh, and a README fix. runs: using: node24 was already in place, so no runner requirement change. The rebuilt dist/index.js still references only depot.dev/github.com hosts. Behavior for this repo is unchanged since configure-docker is not set anywhere.
Same digest is applied consistently across customer-docker.yml, dev-docker.yml, stable-docker.yml and mysql-debug-docker.yml, with no stragglers left in .github/.
a4d69bb to
0dd21a4
Compare
❌ Test FailureAnalysis: Not flaky: the PR bumps the CI Go toolchain to 1.27.0 (main pins 1.26.6), and the indirect dependency github.com/cockroachdb/swiss has version-gated build tags that exclude go1.27, causing a deterministic compile failure (undefined: hashFn / getRuntimeHasher / fastrand64) before any test ran — the other two matrix jobs were merely cancelled by concurrency. |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
Blocking: Go 1.27.0 does not compile this tree — cockroachdb/swiss has no go1.27 support at the pinned version.
The lint job on this PR already failed on exactly this (run 33422860609):
flow/connectors/utils/cdc_store.go:15:2: could not import github.com/cockroachdb/pebble/v2
(... could not import github.com/cockroachdb/swiss (-:
swiss@v0.0.0-20251224182025-b0f6560f979b/map.go:286:7: undefined: hashFn
swiss@.../map.go:337:14: undefined: getRuntimeHasher
swiss@.../map.go:338:22: undefined: fastrand64
Root cause: swiss/runtime_go1.20.go — the only file defining fastrand64, hashFn and getRuntimeHasher (via //go:linkname into runtime internals) — is guarded by
//go:build (go1.20 && !go1.27) || untested_go_versionUnder Go 1.27 that file is excluded and the symbols vanish. swiss does this deliberately, requiring a manual build-tag bump per Go release. flow pulls it in transitively: flow/connectors/utils/cdc_store.go → cockroachdb/pebble/v2 v2.1.6 → cockroachdb/swiss. This is a hard compile failure, not merely a lint failure — a plain go build ./... in flow/ fails the same way under 1.27.
The upstream fix already exists: swiss commit aa852fb (Enable go 1.27 support, 2026-08-20), pulled in by cockroachdb/pebble v2.1.7 (2026-08-24), whose go.mod requires github.com/cockroachdb/swiss v0.0.0-20260820225851-333444432258. So github.com/cockroachdb/pebble/v2 needs bumping to v2.1.7 in flow/go.mod (or the indirect swiss pin bumped directly) before or together with this Go bump — otherwise this PR cannot go green.
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
The same Go 1.27 blocker described on golang-lint.yml hits here too: the flow test binaries link pebble/v2 → cockroachdb/swiss, which does not compile under go1.27 at the currently pinned version, so flow_test will fail at build time rather than on any test assertion.
Separately, worth an explicit decision: this bump puts the CI toolchain (1.27.0) ahead of the toolchain that builds shipped binaries — stacks/flow.Dockerfile:3 still pins golang:1.26-alpine, and flow/go.mod declares go 1.26.0. That divergence is precisely why docker-build stayed green on this PR while lint failed: the image build never saw 1.27. Once the swiss/pebble blocker is cleared, e2e tests would be validating against a stdlib that differs from what actually ships — Go 1.27 backs encoding/json with the v2 implementation (marshal/unmarshal behavior preserved, but error text may differ), HTTP/1 Response.Body now auto-drains unread content on close, go test runs the stdversion vet check by default, and several GODEBUGs (asynctimerchan, tlsrsakex, tls3des, tls10server, ...) were permanently removed. Bumping the Dockerfile base image in the same change keeps CI and release on one toolchain.
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | ||
| with: | ||
| version: v2.12.2 | ||
| version: v2.13.1 |
There was a problem hiding this comment.
The golangci-lint v2.12.2 → v2.13.1 move is the correct pairing for the Go bump (v2.13.0 is the release that adds go1.27 support), and I did not find anything config-breaking in flow/.golangci.yml: exhaustruct was deprecated in favour of exhaustruct_v5 but is not enabled here; the fmtappendf removal and waitgroup → waitgroupgo rename in govet-modernize only bite when analyzers are named individually, and this config only disables shadow; ifaces new analyzer is unusedmethod, so the existing identical/unused/opaque selection stays valid.
What this CI run did not validate is behavioural, because golangci-lint flow aborted at typecheck before any linter got to report:
govetis set toenable-all: true, so the seven analyzers new in govet-modernize 0.49.0 (atomictypes,embedlit,errorsastype,importcomment,reflecttypeassert,slicesclip,slicesbackward) will run against this codebase for the first time.errcheckjumps 1.10.0 → 1.20.0 (on by default in v2), and thegofumptformatter jumps 0.9.2 → 0.11.0.
So expect a fresh batch of findings on the first run that actually type-checks — the current red is not necessarily only the Go bump. Renovate also flags v2.13.2 as pending, so another bump follows shortly.
| uses: ./.github/actions/genprotos | ||
|
|
||
| - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1 | ||
| - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 |
There was a problem hiding this comment.
Checked this digest move (15c09a5 → 91bc849, 11 commits) against the upstream commit log — no regression risk here. The only functional change is a new configure-docker input that defaults to false, so behaviour is unchanged for every call site in this repo (none pass it). The rest is dependency/toolchain housekeeping, README wording, and CI additions in the action repo; the runtime was already node24 before this bump, so there is no runner-side change either. Same conclusion applies to the identical bumps in dev-docker.yml, stable-docker.yml and mysql-debug-docker.yml.
❌ Test FailureAnalysis: Not flaky: the Renovate PR bumps the CI Go toolchain to 1.27.0, which breaks the build-tag-gated linkname shims in the indirect dependency github.com/cockroachdb/swiss (undefined: hashFn/getRuntimeHasher/fastrand64), causing a deterministic compile failure of every flow package on all matrix legs and both retries, so no tests ran at all. |
0dd21a4 to
6cfeae8
Compare
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | ||
| with: | ||
| version: v2.12.2 | ||
| version: v2.13.1 |
There was a problem hiding this comment.
Regression: this bump breaks the lint job. The golangci-lint flow step failed on this PR (job) with 5 issues in unchanged code that v2.12.2 did not report:
gofumpt 0.9.2 → 0.11.0 (3 × File is not properly formatted) — all three flagged lines contain redundant parentheses that the newer gofumpt now rewrites:
flow/connectors/clickhouse/staging_validate_test.go:164—&& (strings.Contains(r.URL.Path, "/b/my-bucket/o"))flow/connectors/mysql/qvalue_convert.go:431—(extraBits)^borrowedBitsMaskflow/connectors/postgres/cdc.go:755—logger.Info(("standby deadline reached, ..."))
staticcheck 0.8.0-rc.1 → 0.8.0 (updated deprecation database):
flow/connectors/snowflake/snowflake.go:101—SA1019: (gosnowflake/v2.Config).RequestTimeout is deprecated
unparam 5beb8c8 → 3f964bc:
flow/connectors/utils/avro_writer.go:197—(*peerDBOCFWriter).getAvroFieldNamesFromSchema - result 1 (error) is always nil
The golangci-lint flow/pkg and golangci-lint e2e_cleanup steps were skipped after the flow step failed, so more issues may surface in those two modules once flow is clean. These source fixes need to land (here or in a preceding PR) before this can automerge.
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | ||
| with: | ||
| version: v2.12.2 | ||
| version: v2.13.1 |
There was a problem hiding this comment.
Since the source has to be touched for this bump anyway, consider going straight to v2.13.2 rather than v2.13.1. Renovate already lists it in the Pending column (released 2026-08-28; clears this repo's 7-day minimumReleaseAge on 2026-09-04), and it fixes bugs in three linters that flow/.golangci.yml enables:
canonicalheader(enabled atflow/.golangci.yml:7) — v1.1.2 hits a nil-pointer dereference panic on certain method-receiver code shapes (golangci-lint#6753). v2.13.2 swaps in a golangci-maintained fork because upstream was unresponsive (#6761). v2.13.0 and v2.13.1 both carry the panicking version.staticcheck0.8.0 → 0.8.1 — fixes two SA4023 false positives introduced in 0.8.0: unconstrained generics treated as never-nil (go-tools#1736) and firing in situations that do not involve typed nils (#1737). This config runs staticcheck withchecks: [all, ...], so both are live here.iface1.5.0 → 1.5.1 — fixes in theunusedandunexportedanalyzers' type tracking;ifaceis enabled here withunused.
Pinning v2.13.1 means running for a week on a release with a known linter panic. (iface 1.5.0 also adds a new unusedmethod analyzer, but this config enumerates identical/unused/opaque explicitly, so that one will not auto-enable.)
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
Go 1.26 → 1.27 is a minor bump, not a patch. Three things from the 1.27 release notes worth being aware of — none blocking, but they are the regression surface for this repo:
encoding/jsonis now backed by the v2 implementation (opt-out isGOEXPERIMENT=nojsonv2at build time, expected to be removed in a later release). The release notes state v1 marshal/unmarshal behavior is preserved and only error message text may differ — the stricter v2 defaults (rejecting invalid UTF-8 and duplicate object names) apply to theencoding/json/v2API, not v1. 36 files underflow/ande2e_cleanup/importencoding/json; I found no tests asserting on json error strings, so this looks safe, but it is the largest behavioral change in the range for a system that marshals JSON on every connector path.- Other 1.27 changes touching this codebase's surface: HTTP/1 response bodies are now auto-drained on
Close(affects connection reuse in the HTTP-based connectors),net.UnixConnreads return bareio.EOFinstead of wrapping it in*net.OpError, andgo testnow runs thestdversionvet check by default. - Toolchain skew: the release image still builds from
golang:1.26-alpine(stacks/flow.Dockerfile); the 1.27 builder bump lives in Update lukemathwalker/cargo-chef Docker tag to latest-rust-1.98.0-alpine #4756. Both PRs automerge independently, so between merges CI/e2e exercises 1.27 while shipped binaries are still 1.26. Given theencoding/jsonswap, worth landing the two together so the e2e matrix validates the same toolchain that ships.
All three go.mod files stay at go 1.26.0, so the language version is unchanged — this only moves the toolchain.
6cfeae8 to
2bfb170
Compare
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | ||
| with: | ||
| version: v2.12.2 | ||
| version: v2.13.1 |
There was a problem hiding this comment.
Regression: this bump breaks the lint job. The golangci-lint flow step failed on this PR (run 33428752341) with 5 issues that v2.12.2 did not report:
flow/connectors/clickhouse/staging_validate_test.go:164:1: File is not properly formatted (gofumpt)
case r.Method == http.MethodPost && (strings.Contains(r.URL.Path, "/b/my-bucket/o")):
flow/connectors/mysql/qvalue_convert.go:431:1: File is not properly formatted (gofumpt)
return int(lowerMetaByte) | (int((extraBits)^borrowedBitsMask) << 4)
flow/connectors/postgres/cdc.go:755:1: File is not properly formatted (gofumpt)
logger.Info(("standby deadline reached, no records accumulated, continuing to wait"))
flow/connectors/snowflake/snowflake.go:101:3: SA1019: (gosnowflake/v2.Config).RequestTimeout is deprecated (staticcheck)
flow/connectors/utils/avro_writer.go:197:68: (*peerDBOCFWriter).getAvroFieldNamesFromSchema - result 1 (error) is always nil (unparam)
Tracing each finding back to the bumped range:
- gofumpt (3 files) — v2.13.0 bumps
gofumpt0.9.2 to 0.11.0. gofumpt v0.10.0 added a new default-on rule that drops unnecessary parentheses around expressions which are unambiguous on their own (#44). All three hits are exactly that shape:(strings.Contains(...)),(extraBits),("standby deadline..."). v0.10.0 also added a multi-line function call rule, but that one proved controversial and was demoted to the opt-inbalance_callsextra in v0.11.0, so it is not a factor here. The fix is mechanical: rungofumpt -won those three files. - staticcheck SA1019 — v2.13.1 bumps
staticcheck0.8.0-rc.1 to 0.8.0, which now flags the deprecatedConfig.RequestTimeoutin the Snowflake connector. - unparam — v2.13.0 bumps
unparam5beb8c8to3f964bc, which now detects the always-nil error return.
These all look like genuine findings rather than false positives, so the cleanest path is to fix them here (or in a companion PR that lands first). Note the flow step fails fast, so flow/pkg and e2e_cleanup were never linted on this run — more issues may surface once flow is clean.
On the rest of the v2.13.0 changelog: exhaustruct is deprecated in favor of exhaustruct_v5, govet-modernize renames waitgroup to waitgroupgo and drops fmtappendf, and iface 1.5.0 adds unusedmethod. None of these affect us — flow/.golangci.yml enables neither exhaustruct nor the standalone modernize linter, its govet block only names shadow (govet has its own separate waitgroup analyzer, unrelated to the modernize rename), and its iface.enable list is explicit: identical, unused, opaque. golangci-lint config verify passed on this run, so the failure is purely new findings and not a config break.
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
Non-blocking note on the Go bump. golangci-lint v2.13.0 is what adds go1.27 support, so pairing these two bumps in a single PR is correct and in fact necessary — v2.12.2 could not have linted a 1.27 toolchain. actions/setup-go resolved 1.27.0 successfully in CI.
Two things worth flagging:
- Toolchain skew with the shipped image. All three CI pins move to 1.27.0 (this file,
cleanup.yml:17,tilt-flow.yml:235), butstacks/flow.Dockerfile:3still builds ongolang:1.26-alpine. Sincedockerfileis a separate Renovate manager group, that bump arrives in its own PR, so the skew is transient by design — but until it lands, the host-run e2e tests intilt-flow.ymlcompile with 1.27 while theflowimage under test is built with 1.26. Previously both sat on the same minor. Worth confirming the companion dockerfile PR lands close behind. - Renovate skipped 1.26.7 and went straight to 1.27.0, the first release of a new Go minor.
renovate/stability-daysis currently pending (minimumReleaseAge: 7 days), so automerge is held regardless.
|
Reviewed per Secrets/PII: clean. The diff only moves action pins and tool versions; no new stdout/stderr/log output is introduced. Regression check per bump:
Two inline comments posted on |
2bfb170 to
62da669
Compare
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | ||
| with: | ||
| version: v2.12.2 | ||
| version: v2.13.1 |
There was a problem hiding this comment.
Regression: golangci-lint v2.12.2 → v2.13.1 fails the lint job with 5 new findings.
The lint check on this PR is red (job). None of these come from code changes — they are all new-linter-version findings:
connectors/clickhouse/staging_validate_test.go:164:1: File is not properly formatted (gofumpt)
connectors/mysql/qvalue_convert.go:431:1: File is not properly formatted (gofumpt)
connectors/postgres/cdc.go:755:1: File is not properly formatted (gofumpt)
connectors/snowflake/snowflake.go:101:3: SA1019: (gosnowflake/v2.Config).RequestTimeout is deprecated (staticcheck)
connectors/utils/avro_writer.go:197:68: (*peerDBOCFWriter).getAvroFieldNamesFromSchema - result 1 (error) is always nil (unparam)
Mapped to the v2.13.0 changelog:
gofumpt0.9.2 → 0.11.0 — all three hits are redundant parentheses ((strings.Contains(...)),(extraBits),(("standby deadline reached..."))). Mechanical; runninggofumpt -won those files clears it.staticcheck0.8.0-rc.1 → 0.8.0 — SA1019 now flags the deprecatedgosnowflake/v2.Config.RequestTimeout. This one needs a decision (migrate off the field, or//nolint:staticcheckwith a justification), not just a reformat.unparam5beb8c8→3f964bc—getAvroFieldNamesFromSchemashould drop its always-nilerrorreturn.
Since the tree has to be touched anyway, consider going straight to v2.13.2 instead of v2.13.1 (Renovate lists it as Pending under minimumReleaseAge). v2.13.2 carries bug fixes for three linters enabled in flow/.golangci.yml: canonicalheader (moved to a temporary fork), staticcheck 0.8.0 → 0.8.1, and iface 1.5.0 → 1.5.1 — otherwise this config gets a second round of churn in a week.
For the record, the rest of the v2.13.0 changelog is a no-op for flow/.golangci.yml: the modernize linter is not enabled, so the govet-modernize analyzer additions and the waitgroup → waitgroupgo rename do not apply; iface is pinned to [identical, unused, opaque], so the new unusedmethod analyzer stays off; exhaustruct is not enabled, so its deprecation in favor of exhaustruct_v5 costs nothing; and recvcheck 0.3.0 only adds default exclusions.
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | ||
| with: | ||
| go-version: '1.26.6' | ||
| go-version: '1.27.0' |
There was a problem hiding this comment.
Go 1.26.6 → 1.27.0 splits the CI toolchain from the one that builds the shipped image.
All three setup-go pins move to 1.27.0 (here, golang-lint.yml:27, cleanup.yml:17), but stacks/flow.Dockerfile:3 still builds on golang:1.26-alpine. Before this PR both sides were on 1.26.x; after it, e2e and lint run on a different minor toolchain than the artifact that actually ships — a 1.27-only breakage gets caught by CI but never shipped, and a 1.26-only breakage ships without CI ever seeing it.
This matters more than usual for 1.27 specifically: encoding/json is now backed by the v2 implementation, and that switch is a build-time GOEXPERIMENT, not a GODEBUG derived from the go 1.26.0 directive in flow/go.mod — so the go line does not hold it back, and GOEXPERIMENT=nojsonv2 is the only opt-out. The e2e suite would therefore exercise a different JSON implementation than the released binary, which is relevant for a system that round-trips arbitrary customer json/jsonb payloads.
Risk from the JSON change itself looks low: the release notes state v1 marshal/unmarshal behavior is preserved (only error text may differ — the stricter invalid-UTF-8 and duplicate-key rejection applies to encoding/json/v2, not the v1 API), and I found no test asserting on encoding/json error strings. Other 1.27 behavior changes I checked are not applicable either: no compress/flate / compress/gzip / archive/zip use in flow (1.27 changes their exact encoded output), and asynctimerchan has been off by default since 1.23.
Suggest bumping stacks/flow.Dockerfile to golang:1.27-alpine in this PR, or landing the dockerfile dependencies Renovate PR together with this one, so the tested and shipped toolchains stay in step. Positive signal that 1.27 builds the tree fine: the Analyze (go) CodeQL job passed.
62da669 to
1c5fe21
Compare
renovate
Bot
changed the title
|
Re-reviewed per Secrets/PII in output: clean. No new stdout/stderr/log statements. The only new log line upstream is Regression check —
Nothing blocking. |
1c5fe21 to
2c65b5f
Compare
|
Reviewed this dependency bump per What changed upstream
Regression / risk assessment
Verified in CI
Non-blocking note: |
2 participants
This PR contains the following updates:
15c09a5→91bc849Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.