Fix Dependabot CI Pipeline
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Quiet
- Tech stack
- docker, github-actions, typescript
- Domain
- build-system, ci-cd, devops
Research direction
Start with the Dependabot-created branch job logs and the CI pipeline steps that build and push images to the registry. Determine which publishing behavior is intended for Dependabot branches, then verify that the selected approach lets build and test jobs complete without exposing registry credentials or leaving expected pipelines faulty.
Written by the indexing model from the issue text.
Description
The Branches that Dependabot creates dont succeed. According to the job logs, they cant authenticate to the registry where the images should be pushed. This seems to be related to dependabot requiring credentials to be allowed to push, which currently are not provided to dependabot to restrict malicious dependencies of reading the registry credentials on automatic updates by dependabot.
We have several options now:
- Ignore publishes and just merge on success of build & test steps, leaving the pipeline as-is and always creating faulty pipelines
- Restrict docker push to non-dependabot authored branches only
- Use renovate instead of dependabot, although renovate will suffer the same problem when trying to push
- Use pnpm instead of npm when building images. pnpm by default ships with version 11 (current, stable) a minimumReleaseAge that only allows builds of an application that is at least 24hours old. (this can be configured to whatever is needed. specified in minutes). https://pnpm.io/settings#minimumreleaseage
- provide dependabot with credentials to push to the registry. -> Do we ever need to have an image available of a patch/minor/major release in a seperate image?
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- Avg merge
- 22h 6m
- Merged PRs (30d)
- 12
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/cockpit
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
stackabletech/cockpit#312 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
stackabletech/cockpit#224 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
stackabletech/cockpit#101 ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
stackabletech/cockpit#313 ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
stackabletech/cockpit#310 ·
All issues in stackabletech/cockpit
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
safetrustcr/dApp-SafeTrust#426 ·
-
area:workflow bug ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
fil-donadoni/tolaria#4409 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Fission-AI/OpenSpec#1960 ·
-
Add dependabot Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
corsairdev/corsair#1764 ·