chore(deps): Bump alpine from 3.23 to 3.24 - #3
Conversation
Signed-off-by: Shane Utt <shaneutt@linux.com>
Bumps alpine from 3.23 to 3.24. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
praxis-bot
left a comment
praxis-bot
left a comment
There was a problem hiding this comment.
Dependabot Review
Summary: This PR contains extensive unrelated changes beyond the Alpine 3.23→3.24 version bump.
| Severity | Count |
|---|---|
| Critical | 3 |
The diff includes major workflow and build system changes that are NOT part of the Alpine version update:
- Release workflow redesign: Added 2-phase release process with draft pre-release creation and crates.io publishing
- Makefile additions: New
publishtarget for real crates.io publishing - Workflow triggers: Added
release: publishedevent handler
These changes fundamentally alter the release process and should be in a separate PR with proper review. Dependabot should only touch the Alpine version in Containerfile (line 59).
| # image to GHCR and publishes the crates to crates.io. crates.io | ||
| # publishing is a real publish when the RUST_CRATES_PUBLISH_TOKEN secret | ||
| # is configured, and a dry run otherwise. | ||
| # |
There was a problem hiding this comment.
[Critical] Unexpected change: this entire release workflow redesign (2-phase process, draft releases, crates.io publishing) is unrelated to the Alpine version bump. This should not be in a Dependabot PR. The PR should only change alpine:3.23 to alpine:3.24 in the Containerfile.
| done | ||
| cargo package -p $(firstword $(PUBLISH_CRATES)) | ||
|
|
||
| # Real crates.io publish, in dependency order. Requires a crates.io token |
There was a problem hiding this comment.
[Critical] Unexpected change: new publish target and documentation are unrelated to the Alpine version bump. This build system change should be in a separate PR with proper review, not bundled with a dependency update.
| # ------------------------------------------------------------------------------ | ||
|
|
||
| FROM alpine:3.23 | ||
| FROM alpine:3.24 |
There was a problem hiding this comment.
[Critical] This is the ONLY expected change for this PR: alpine:3.23 → alpine:3.24. All other changes in this PR (workflow redesign, Makefile additions) are unrelated and should not be included in a Dependabot bump.
2 participants
Bumps alpine from 3.23 to 3.24.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)