From b8d9bdc9f3a35cbdd9b08d6e508fb9fb2e3392d8 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 1 Nov 2024 14:03:52 +0100 Subject: [PATCH 1/4] dependabot-cli: 1.41.0 -> 1.57.0 --- pkgs/by-name/de/dependabot-cli/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix index 98bcbf46e663..ef60519b180c 100644 --- a/pkgs/by-name/de/dependabot-cli/package.nix +++ b/pkgs/by-name/de/dependabot-cli/package.nix @@ -7,7 +7,7 @@ }: let pname = "dependabot-cli"; - version = "1.41.0"; + version = "1.57.0"; in buildGoModule { inherit pname version; @@ -16,10 +16,10 @@ buildGoModule { owner = "dependabot"; repo = "cli"; rev = "v${version}"; - hash = "sha256-CnSDvLcLupWKBp1Wr6E9BScA8VsBlfmmfPwh8cyERZg="; + hash = "sha256-ZT1fwDT19uUjp5iG0NLSrc/6PLW/sukAd0w66mLdFVg="; }; - vendorHash = "sha256-vN5r1OtHT16LeJ6iPmHmXTx9Oo+WALhV4PWqzMiUwSA="; + vendorHash = "sha256-jSINiETadd0ixzFBilgphi1vJNsRYeDkbaVNk5stTp4="; ldflags = [ "-s" @@ -37,7 +37,7 @@ buildGoModule { ''; checkFlags = [ - "-skip=TestIntegration|TestNewProxy_customCert|TestRun" + "-skip=TestDependabot" ]; doInstallCheck = true; From 4f02423384f9b180f1135f6d7667f1a2462bcbf4 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 1 Nov 2024 14:04:11 +0100 Subject: [PATCH 2/4] dependabot-cli: format --- pkgs/by-name/de/dependabot-cli/package.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix index ef60519b180c..55f741dd54ea 100644 --- a/pkgs/by-name/de/dependabot-cli/package.nix +++ b/pkgs/by-name/de/dependabot-cli/package.nix @@ -1,9 +1,10 @@ -{ buildGoModule -, dependabot-cli -, fetchFromGitHub -, installShellFiles -, lib -, testers +{ + buildGoModule, + dependabot-cli, + fetchFromGitHub, + installShellFiles, + lib, + testers, }: let pname = "dependabot-cli"; From 3345d7d01021af7de84a83f2ba9ff65fdc9cbd18 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 1 Nov 2024 15:03:14 +0100 Subject: [PATCH 3/4] dependabot-cli: Create dependabot-pinned wrapper with pinned docker images By default, the dependabot CLI fetches the latest versions of two images it depends on, with the underlying assumption that the CLI is also a recent version. This of course causes problems if the CLI is outdated and doesn't support the latest images. This commit introduces a separate wrapper binary that pins these images to the latest version of them at the time of updating. --- pkgs/by-name/de/dependabot-cli/package.nix | 39 +++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix index 55f741dd54ea..6823e6154201 100644 --- a/pkgs/by-name/de/dependabot-cli/package.nix +++ b/pkgs/by-name/de/dependabot-cli/package.nix @@ -5,10 +5,37 @@ installShellFiles, lib, testers, + dockerTools, + makeWrapper, }: let pname = "dependabot-cli"; version = "1.57.0"; + + # vv Also update this vv + tag = "nixpkgs-dependabot-cli-${version}"; + updateJobProxy = dockerTools.pullImage { + imageName = "ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy"; + # Get these hashes from + # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag} + imageDigest = "sha256:cc4a9b7db8ddf3924b6c25cc8a74d9937bf803e64733035809862a1c0a6df984"; + sha256 = "0wkr0rac7dp1080s4zik5yzi5967gkfylly2148ipgw50sp0sq8s"; + + # Don't update this, it's used to refer to the imported image later + finalImageName = "dependabot-update-job-proxy"; + finalImageTag = tag; + }; + updaterGitHubActions = dockerTools.pullImage { + imageName = "ghcr.io/dependabot/dependabot-updater-github-actions"; + # Get these hashes from + # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag} + imageDigest = "sha256:6665b3e26ef97577e83f2dfd0007a73c02b003126e72c0b4b196fe570088ed93"; + sha256 = "0q7w3yp49wb70gkjjl2syvs75hm1jkva2qslzckwxh73z0kq2z0q"; + + # Don't update this, it's used to refer to the imported image later + finalImageName = "dependabot-updater-github-actions"; + finalImageTag = tag; + }; in buildGoModule { inherit pname version; @@ -28,13 +55,23 @@ buildGoModule { "-X github.com/dependabot/cli/cmd/dependabot/internal/cmd.version=v${version}" ]; - nativeBuildInputs = [ installShellFiles ]; + nativeBuildInputs = [ + makeWrapper + installShellFiles + ]; postInstall = '' installShellCompletion --cmd dependabot \ --bash <($out/bin/dependabot completion bash) \ --fish <($out/bin/dependabot completion fish) \ --zsh <($out/bin/dependabot completion zsh) + + # Create a wrapper that pins the docker images that are depended upon + makeWrapper $out/bin/dependabot $out/bin/dependabot-pinned \ + --run "docker load --input ${updateJobProxy}" \ + --add-flags "--proxy-image=dependabot-update-job-proxy:${tag}" \ + --run "docker load --input ${updaterGitHubActions}" \ + --add-flags "--updater-image=dependabot-updater-github-actions:${tag}" ''; checkFlags = [ From 393342adfe7b27b922c35914a92f3a3f95522b77 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 1 Nov 2024 15:07:35 +0100 Subject: [PATCH 4/4] dependabot-cli: add infinisil as maintainer --- pkgs/by-name/de/dependabot-cli/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix index 6823e6154201..193d5964df24 100644 --- a/pkgs/by-name/de/dependabot-cli/package.nix +++ b/pkgs/by-name/de/dependabot-cli/package.nix @@ -95,6 +95,9 @@ buildGoModule { mainProgram = "dependabot"; homepage = "https://github.com/dependabot/cli"; license = licenses.mit; - maintainers = with maintainers; [ l0b0 ]; + maintainers = with maintainers; [ + l0b0 + infinisil + ]; }; }