docker: bump alpine from 3.21 to 3.24#3
Closed
dependabot[bot] wants to merge 2 commits into
Closed
Conversation
* Migrate from glide/GOPATH vendoring to Go modules Replace the abandoned glide + libbeat-Makefile vendoring with a standard Go module targeting Go 1.26 and Elastic libbeat v7.17.29 (the last maintained v7 line, keeping the libbeat/... import paths). Dependency notes: - Mirror elastic/beats' own replace directives into go.mod; Go modules do not apply a dependency's replaces transitively, so consumers of libbeat must copy them (Shopify/sarama, fsnotify, gopacket, etc.). - Pin txn2/rxtx to v1.3.2 (the exact prod revision) to preserve the rtq.MessageBatch wire format. Pin its 2018-era transitive deps coreos/bbolt and satori/go.uuid to the commits prod ran, since the newer tags renamed the bbolt package and changed uuid.NewV4's signature, breaking rtq's source under modern MVS. libbeat v7.17 API drift: - beat.ClientConfig.ACKCount removed; use acker.RawCounting. - cmd.GenRootCmd removed; use GenRootCmdWithSettings + instance.Settings. - logp.Error removed; route the unmarshal error to the zap logger. Housekeeping in the same pass: - io/ioutil -> io, fix the lost context cancel in shutdown. - Guard main_test.go flag lookups against nil (test flags register lazily on modern Go, which panicked at init()). Build, vet, and tests pass; binary reports libbeat 7.17.29. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add modern SDLC and project hygiene Bring rtbeat in line with the txn2/kubefwd and mcp-data-platform conventions, replacing the abandoned beats/Travis tooling. CI/CD (GitHub Actions, all action refs SHA-pinned): - ci.yml: lint (golangci-lint v2.12.1), test matrix (ubuntu+macos, -race + coverage to Codecov), build + goreleaser check. - release.yml: GoReleaser v2 on tag push — Cosign keyless signing, SBOMs, multi-arch Docker, SLSA provenance. - codeql.yml, scorecard.yml, docs.yml (MkDocs to GitHub Pages), dependabot.yml. Tooling/config: - .golangci.yml (v2) with a clean lint baseline; fixed the findings in beater/rtbeat.go (errcheck, gocritic, ineffassign, revive, staticcheck). - Makefile: `make verify` mirrors CI (go-version + tidy-check + lint + test + validate-actions); auto-installs the pinned linter to .tools/. - scripts/validate-action-shas.sh enforces SHA-pinned actions. - .goreleaser.yml rewritten to v2 (static CGO-free builds, version stamped into libbeat/version); modern multi-arch Dockerfile replaces the per-arch dockerfiles/. - codecov.yml, .gitignore updates; stop tracking the libbeat runtime data/meta.json. Docs & community: - SECURITY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, CHANGELOG.md, CLAUDE.md, CODEOWNERS, issue/PR templates. - MkDocs site (mkdocs.yml + docs/) and a modernized README. Retired: .travis.yml, the libbeat-generated Makefile, glide-era and per-arch Docker tooling. make verify passes; mkdocs build --strict passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Harden deps from adversarial review Two fixes surfaced by an adversarial review of the modernization: - go.mod: mirror the full 15-directive replace block from elastic/beats/v7@v7.17.29 (previously only 7). We import few libbeat packages today, but keeping the complete upstream set means a future dependency bump that pulls in more of beats won't break against a fork-expecting package (e.g. docker/docker => docker/engine). - .goreleaser.yml: document that `brews:` is valid on the CI-pinned goreleaser line (~> v2.13) but deprecated as of v2.16, so the key must be migrated before bumping the goreleaser-action pin. make verify passes; binary still reports libbeat 7.17.29. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps alpine from 3.21 to 3.24. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Contributor
Author
|
Looks like alpine is up-to-date now, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps alpine from 3.21 to 3.24.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)