webgrip/infrastructure
5
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases 102 Packages Wiki Activity Actions

fix(ci-runner): annotate CLAUDE_CODE_VERSION for Renovate, and bump it #94

Merged
ryangr0 merged 1 commit from fix/ci-runner-claude-code-and-renovate-annotation into main 2026-08-06 19:58:02 +00:00
Conversation 0 Commits 1 Files changed 1 +9 -3
ryangr0 commented 2026-08-06 19:56:05 +00:00
Owner
Copy link

Merging this cuts ci-runner 1.2.3 — which is what unblocks the rest of the queue.

The bug

The comment above this ARG said "Renovate bumps this ARG". It did not, and could not.

renovate.json's Dockerfile custom manager matches a # renovate: annotation immediately followed by the ARG line. CLAUDE_CODE_VERSION had no annotation — so it was invisible, pinned at 2.1.214 while upstream reached 2.1.223. Nine patch releases, silently, on a pin everyone believed was automated. The comment was the only thing maintaining it, and comments don't open PRs.

Verified, not assumed

I ran renovate.json's own regex over the Dockerfile. Seven ARGs are now visible to it:

ARG depName current
CLAUDE_CODE_VERSION @anthropic-ai/claude-code 2.1.223
COSIGN_VERSION sigstore/cosign 2.6.4
CVE_GATE_VERSION harbor.webgrip.dev/webgrip/cve-gate 0.3.2@sha256:…
EXTERNAL_NODE20_VERSION node 20.19.5
HELM_VERSION helm/helm 3.21.3
SYFT_VERSION anchore/syft 1.50.0
YQ_VERSION mikefarah/yq 4.53.3

Three remain unannotated, deliberately: DOTNET_CHANNEL=9.0, PHP_VERSION=8.3, NODE_MAJOR=24 are major-channel selectors. Moving those is a migration with a blast radius, not a patch bump — they should stay under human control.

Still open, and worth your attention

yq carries a correct annotation and was nine minor versions stale anyway (4.44.3 vs 4.53.3, fixed by hand in #88). Renovate can see it, so something else is dropping it — a schedule, the shared webgrip/renovate-config preset, or a PR that was closed unnoticed.

That needs the Renovate dashboard rather than another guess from here, and it matters more than yq: the same mechanism is what's supposed to be moving cosign, syft and the cve-gate digest — all three security-relevant.

Why this PR exists at all

Run 240's release died on Harbor 502s. No tag was cut, and determine-changed-directories is push-diff, so a failed release never retries itself — it needs either a re-run click or a new ops/docker commit. This is a real change that also happens to be that commit.

The companion PR adds a manual trigger so the next failure doesn't need one.

**Merging this cuts ci-runner 1.2.3** — which is what unblocks the rest of the queue. ## The bug The comment above this ARG said *"Renovate bumps this ARG"*. **It did not, and could not.** `renovate.json`'s Dockerfile custom manager matches a `# renovate:` annotation *immediately* followed by the ARG line. `CLAUDE_CODE_VERSION` had **no annotation** — so it was invisible, pinned at `2.1.214` while upstream reached `2.1.223`. Nine patch releases, silently, on a pin everyone believed was automated. The comment was the only thing maintaining it, and comments don't open PRs. ## Verified, not assumed I ran `renovate.json`'s own regex over the Dockerfile. Seven ARGs are now visible to it: | ARG | depName | current | |---|---|---| | `CLAUDE_CODE_VERSION` | `@anthropic-ai/claude-code` | 2.1.223 | | `COSIGN_VERSION` | `sigstore/cosign` | 2.6.4 | | `CVE_GATE_VERSION` | `harbor.webgrip.dev/webgrip/cve-gate` | 0.3.2@sha256:… | | `EXTERNAL_NODE20_VERSION` | `node` | 20.19.5 | | `HELM_VERSION` | `helm/helm` | 3.21.3 | | `SYFT_VERSION` | `anchore/syft` | 1.50.0 | | `YQ_VERSION` | `mikefarah/yq` | 4.53.3 | Three remain unannotated, **deliberately**: `DOTNET_CHANNEL=9.0`, `PHP_VERSION=8.3`, `NODE_MAJOR=24` are major-channel selectors. Moving those is a migration with a blast radius, not a patch bump — they should stay under human control. ## Still open, and worth your attention **yq carries a correct annotation and was nine *minor* versions stale anyway** (4.44.3 vs 4.53.3, fixed by hand in #88). Renovate can see it, so something else is dropping it — a schedule, the shared `webgrip/renovate-config` preset, or a PR that was closed unnoticed. That needs the Renovate dashboard rather than another guess from here, and it matters more than yq: **the same mechanism is what's supposed to be moving `cosign`, `syft` and the `cve-gate` digest** — all three security-relevant. ## Why this PR exists at all Run 240's release died on Harbor 502s. **No tag was cut**, and `determine-changed-directories` is push-diff, so a failed release never retries itself — it needs either a re-run click or a new `ops/docker` commit. This is a real change that also happens to be that commit. The companion PR adds a manual trigger so the *next* failure doesn't need one.
fix(ci-runner): annotate CLAUDE_CODE_VERSION for Renovate, and bump it
Some checks failed
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 3s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 1m7s
Details
[Workflow] On Source Change / Determine changed images (push) Successful in 0s
Details
[Workflow] On Source Change / Release (ci-runner, ops/docker/ci-runner) (push) Has been skipped
Details
[Workflow] On Source Change / Build check (ci-runner, ops/docker/ci-runner) (push) Has been cancelled
Details
f86e8b687b 
The comment above this ARG said "Renovate bumps this ARG". It did not, and could not.

renovate.json's Dockerfile custom manager matches a `# renovate:` annotation IMMEDIATELY followed
by the ARG line. CLAUDE_CODE_VERSION had no annotation, so it was invisible: pinned at 2.1.214 while
upstream reached 2.1.223. Nine patch releases, silently, on a pin everyone believed was automated —
the comment was the only thing maintaining it, and comments do not open PRs.

Annotated with datasource=npm and bumped. Verified by running renovate.json's own regex over the
Dockerfile: seven ARGs are now visible to it (CLAUDE_CODE_VERSION, COSIGN_VERSION, CVE_GATE_VERSION,
EXTERNAL_NODE20_VERSION, HELM_VERSION, SYFT_VERSION, YQ_VERSION).

Three ARGs remain unannotated and that is deliberate, not an oversight: DOTNET_CHANNEL=9.0,
PHP_VERSION=8.3 and NODE_MAJOR=24 are major-channel selectors. Moving those is a migration with a
blast radius, not a patch bump, so they should stay under human control.

STILL OPEN: yq carries a correct annotation and was nine MINOR versions stale anyway (4.44.3 while
upstream was 4.53.3, fixed by hand in #88). Renovate can see it, so something else is dropping it —
schedule, the shared webgrip/renovate-config preset, or a closed PR nobody noticed. That needs the
Renovate dashboard rather than another guess from here, and it matters because the same mechanism
is what is supposed to be moving cosign, syft and the cve-gate digest.

This also exists to cut ci-runner 1.2.3. Run 240's release died on Harbor 502s, no tag was cut, and
`determine-changed-directories` is push-diff — so a failed release never retries itself. The
companion change adds a manual trigger so the next one does not need a commit to recover.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

  
released
No labels
pull-request
released
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/infrastructure!94
No description provided.