From 50307fe748a662a34293f09d78f3409b2ce57fae Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 2 Nov 2026 03:01:57 +0000 Subject: [PATCH] chore(deps): update ci non-major --- .woodpecker/build-ci-images.yml | 32 ++++++++++---------- .woodpecker/ci-claude-refresh.yml | 2 +- .woodpecker/ci-manifests-test.yml | 2 +- .woodpecker/ci-scripts-test.yml | 2 +- .woodpecker/hermes-image.yml | 2 +- .woodpecker/review-bot-test.yml | 2 +- ci/images/authentik-gate-sync/Containerfile | 4 +-- ci/images/claude/Containerfile | 2 +- ci/images/cloudflare-lb-sync/Containerfile | 4 +-- ci/images/heating-can/Containerfile | 4 +-- ci/images/kuma-sync/Containerfile | 4 +-- ci/images/netbird-service-sync/Containerfile | 2 +- 12 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.woodpecker/build-ci-images.yml b/.woodpecker/build-ci-images.yml index 9892a3af..4855adc2 100644 --- a/.woodpecker/build-ci-images.yml +++ b/.woodpecker/build-ci-images.yml @@ -47,7 +47,7 @@ when: steps: - name: build-ansible - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/ansible # Only rebuild when THIS image's source (or the pipeline file) changed, or # on a manual run. Without this every step ran on any matching push, so a @@ -74,7 +74,7 @@ steps: --destination gitea.renner.uno/gitea_admin/ci-ansible:latest - name: build-k8s - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/k8s when: - event: deployment @@ -97,7 +97,7 @@ steps: --destination gitea.renner.uno/gitea_admin/ci-k8s:latest - name: build-vmtest - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/vmtest when: - event: deployment @@ -120,7 +120,7 @@ steps: --destination gitea.renner.uno/gitea_admin/ci-vmtest:latest - name: build-tofu - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/tofu when: - event: deployment @@ -150,7 +150,7 @@ steps: # Runtime image, not CI tooling: a static musl binary in a FROM-scratch image, # used as the base for secret-rotation CronJobs. Replaces per-job inline Python. - name: build-secret-rotator - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: secret-rotator when: - event: deployment @@ -175,7 +175,7 @@ steps: # review-bot: the Go service that reviews pull requests with a Mistral agent (webhook plus sweep). # Runs after Gitea is up, so no ghcr mirror. - name: build-review-bot - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: review-bot when: - event: deployment @@ -225,7 +225,7 @@ steps: # # The gitea_admin/ copy stays until nothing references it any more. - name: build-alpine-jq - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/alpine-jq when: - event: deployment @@ -276,7 +276,7 @@ steps: # note on build-alpine-jq. Anything an app needs while the cluster is still # being built cannot live only in that cluster's own registry. - name: build-cni-plugins - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/cni-plugins when: - event: deployment @@ -316,7 +316,7 @@ steps: # gitea.renner.uno is not there to serve it. A cold-rebuild rehearsal left # paperless in Init:ErrImagePull on exactly this image. - name: build-alpine-openssl - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/alpine-openssl when: - event: deployment @@ -351,7 +351,7 @@ steps: # Ansible converge. Not a ci-* image -- it is a runtime artifact -- but it # builds the same way and lands in the same registry so the audit sees it. - name: build-heating-can - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/heating-can when: - event: deployment @@ -377,7 +377,7 @@ steps: # services (public Ingress hosts -> TLS passthrough -> Traefik ClusterIP). # Runtime artifact like heating-can; same registry so the audit tracks it. - name: build-netbird-service-sync - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/netbird-service-sync when: - event: deployment @@ -402,7 +402,7 @@ steps: # authentik-gate-sync: the authentik-gate ingress class (Ingress -> Authentik # proxy gate + Traefik route). Its unit tests run as a stage of the image build. - name: build-authentik-gate-sync - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/authentik-gate-sync when: - event: deployment @@ -428,7 +428,7 @@ steps: # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. Its unit # tests run as a stage of the image build. - name: build-kuma-sync - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/kuma-sync when: - event: deployment @@ -454,7 +454,7 @@ steps: # cloudflare-lb-sync: reconciles CloudflareLoadBalancer resources into # Cloudflare. Its unit tests run as a stage of the image build. - name: build-cloudflare-lb-sync - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/cloudflare-lb-sync when: - event: deployment @@ -480,7 +480,7 @@ steps: # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime # artifact like heating-can; same registry so the audit tracks it. - name: build-bird - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/bird when: - event: deployment @@ -504,7 +504,7 @@ steps: # Orchestrator for the monthly backup-verify CronJob (velero ns). - name: build-backup-verify - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/backup-verify when: - event: deployment diff --git a/.woodpecker/ci-claude-refresh.yml b/.woodpecker/ci-claude-refresh.yml index cd459a0a..95fbd403 100644 --- a/.woodpecker/ci-claude-refresh.yml +++ b/.woodpecker/ci-claude-refresh.yml @@ -131,7 +131,7 @@ steps: # --build-arg to the resolved version (not "latest") guarantees the tag and # the image content agree even if a new release lands mid-run. - name: build - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/claude depends_on: [decide] environment: diff --git a/.woodpecker/ci-manifests-test.yml b/.woodpecker/ci-manifests-test.yml index 51b82d8d..ad8eff93 100644 --- a/.woodpecker/ci-manifests-test.yml +++ b/.woodpecker/ci-manifests-test.yml @@ -172,7 +172,7 @@ steps: # whenever it trails the deployed server. If you bump the server, bump here. - name: woodpecker-lint depends_on: [] # see note above `steps:` - image: woodpeckerci/woodpecker-cli:v3.19.0-alpine@sha256:27a77117e38d7bbdc380f0e90ff3ee4871ab1eefa78b5d9136a2c969fbecd9f4 + image: woodpeckerci/woodpecker-cli:v3.20.1-alpine@sha256:74c576faf49cce699825d11c7d7bd38ab5f007dd4f57cdbdd55099d2c0f2621a commands: - | set -eu diff --git a/.woodpecker/ci-scripts-test.yml b/.woodpecker/ci-scripts-test.yml index 3154a340..03a33ce3 100644 --- a/.woodpecker/ci-scripts-test.yml +++ b/.woodpecker/ci-scripts-test.yml @@ -63,7 +63,7 @@ steps: # bridge, and the secret guard. - name: hermes-skill-tests depends_on: [] - image: python:3.15-alpine@sha256:d44b1254cb92329418d164b22b20d86bbd3869d48e80e09e476531a409a728bb + image: python:3.15-alpine@sha256:20a82dbc2783112ddb91d1534603f802d222a3e63e593cd002eb2ac534e70211 environment: PYTHONDONTWRITEBYTECODE: "1" commands: diff --git a/.woodpecker/hermes-image.yml b/.woodpecker/hermes-image.yml index 7fa6ca82..e9e0b8cb 100644 --- a/.woodpecker/hermes-image.yml +++ b/.woodpecker/hermes-image.yml @@ -10,7 +10,7 @@ when: steps: - name: build - image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8 + image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7 directory: ci/images/hermes environment: # registry-bot write:package PAT (konairius org secret). diff --git a/.woodpecker/review-bot-test.yml b/.woodpecker/review-bot-test.yml index 69187f8c..e65ddcb8 100644 --- a/.woodpecker/review-bot-test.yml +++ b/.woodpecker/review-bot-test.yml @@ -6,7 +6,7 @@ when: steps: - name: go-test - image: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 + image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 commands: - test -z "$(gofmt -l review-bot)" - go -C review-bot vet ./... diff --git a/ci/images/authentik-gate-sync/Containerfile b/ci/images/authentik-gate-sync/Containerfile index a70f46d1..6f7fe891 100644 --- a/ci/images/authentik-gate-sync/Containerfile +++ b/ci/images/authentik-gate-sync/Containerfile @@ -5,12 +5,12 @@ # The unit tests gate the image: the final stage copies the controller out of # this stage, so a failing test fails the build. -FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS test +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS test WORKDIR /src COPY controller.py test_controller.py ./ RUN python3 -B -m unittest -v -FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller COPY --from=test /src/controller.py /opt/controller.py diff --git a/ci/images/claude/Containerfile b/ci/images/claude/Containerfile index 28e27c00..ea681422 100644 --- a/ci/images/claude/Containerfile +++ b/ci/images/claude/Containerfile @@ -1,4 +1,4 @@ -FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 +FROM node:24-alpine@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85 # Default to the latest Claude Code. Pinning a fixed version is the wrong # default here: old releases eventually stop working against the API, so a diff --git a/ci/images/cloudflare-lb-sync/Containerfile b/ci/images/cloudflare-lb-sync/Containerfile index 87921346..1a466537 100644 --- a/ci/images/cloudflare-lb-sync/Containerfile +++ b/ci/images/cloudflare-lb-sync/Containerfile @@ -2,7 +2,7 @@ # Cloudflare. The unit tests (no tags, so no envtest) gate the image: the # final stage copies the binary out of this stage, so a failing test fails the # build. -FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build +FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS build WORKDIR /src COPY go.mod go.sum ./ RUN go mod download @@ -10,7 +10,7 @@ COPY . . RUN go test ./... RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/cloudflare-lb-sync ./cmd/cloudflare-lb-sync -FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99 +FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329 COPY --from=build /out/cloudflare-lb-sync /cloudflare-lb-sync USER 65532 ENTRYPOINT ["/cloudflare-lb-sync"] diff --git a/ci/images/heating-can/Containerfile b/ci/images/heating-can/Containerfile index bc237136..811c05bf 100644 --- a/ci/images/heating-can/Containerfile +++ b/ci/images/heating-can/Containerfile @@ -23,7 +23,7 @@ # namespace, so can0 is only reachable with network_mode: host. That is also # how the local MQTT broker on 127.0.0.1:1883 is reached. CAN_RAW sockets need # no capabilities, so both run unprivileged. -FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 AS build +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 AS build # Pins live here, in the artifact, rather than in Ansible variables. # @@ -56,7 +56,7 @@ RUN git clone --quiet https://github.com/MyHomeMyData/E3onCAN.git /opt/e3oncan \ && rm -rf /opt/e3oncan/.git -FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 ARG OPEN3E_REF=6553c10453a6bae1210908f38a5af2481a46a3e5 ARG E3ONCAN_REF=461dcbdf97e8d72d2edb9929c63b39382af6c3a1 diff --git a/ci/images/kuma-sync/Containerfile b/ci/images/kuma-sync/Containerfile index 103aa0b1..4207d2fc 100644 --- a/ci/images/kuma-sync/Containerfile +++ b/ci/images/kuma-sync/Containerfile @@ -1,7 +1,7 @@ # kuma-sync: reconciles KumaMonitor resources into Uptime Kuma. The unit tests # (no tags, so no Docker and no envtest) gate the image: the final stage copies # the binary out of this stage, so a failing test fails the build. -FROM golang:1.27@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc AS build +FROM golang:1.27@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095b AS build WORKDIR /src COPY go.mod go.sum ./ RUN go mod download @@ -9,7 +9,7 @@ COPY . . RUN go test ./... RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/kuma-sync ./cmd/kuma-sync -FROM gcr.io/distroless/static:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99 +FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329 COPY --from=build /out/kuma-sync /kuma-sync USER 65532 ENTRYPOINT ["/kuma-sync"] diff --git a/ci/images/netbird-service-sync/Containerfile b/ci/images/netbird-service-sync/Containerfile index 0eb708ac..55ff043f 100644 --- a/ci/images/netbird-service-sync/Containerfile +++ b/ci/images/netbird-service-sync/Containerfile @@ -2,7 +2,7 @@ # domains -> TLS passthrough -> Traefik ClusterIP) from Ingresses carrying the # public label. Standard library only, so the image is the interpreter plus one # file; runs unprivileged as its own user. -FROM python:3.15-slim@sha256:533b0b2f9b5d46fd097091cf826f27902f1d6c3bca714b6dc74551356aa97a51 +FROM python:3.15-slim@sha256:94d3426f1def7db4a106a232ac121bfd975393e5dfd40a619b955fae45fe7913 RUN useradd --system --no-create-home --shell /usr/sbin/nologin controller COPY controller.py /opt/controller.py -- 2.54.0