kevinveenbirkenbachandClaude Opus 4.7
98457f98fd
Folds the parallel Docker-image and git-ref version-update plumbing
into a single subsystem so the auto-update workflow, the external
freshness tests, and the unit tests all share one module layout.
utils/
update/
base.py # semver primitives shared by both backends
docker.py # OCI registry lookups + version: line rewriter
repository.py # git ls-remote walker + ref: line rewriter
cli/contributing/update/
docker/ # python -m cli.contributing.update.docker
repository/ # python -m cli.contributing.update.repository
scripts/github/update/
image_versions.sh
repository_refs.sh
Tests mirror the same shape under tests/{unit,external}/update/{docker,repository}/.
Also widens the Docker bump scope to all roles (previously gated on
`web-*`) so non-web roles like sys-svc-container get bumped too;
pins Bookwyrm's python image at 3.11-bookworm via
`# nocheck: docker-version` with a TODO until upstream supports
Python >= 3.12.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.3 KiB
Automated Update Helpers 🔄
This directory contains shell shims that the scheduled Update: Versions workflow at update.yml invokes once per day to bump pinned upstream versions.
Each script is a thin wrapper around a Python CLI under cli/contributing/.
The CLI does the actual scanning, version comparison, and in-place rewrite of roles/*/meta/services.yml; the workflow then checks for a diff and, if any file changed, opens or refreshes a pull request against main via open_update_pr.sh.
Scripts 📄
image_versions.sh 🐳
Bumps semver-based OCI image versions declared as image: + version: pairs under roles/*/meta/services.yml.
Delegates to docker, which queries Docker Hub and GHCR for newer tags that share the current tag's depth and flavor.
Tags that carry a # nocheck: docker-version marker above their version: key are skipped.
repository_refs.sh 🌿
Bumps semver-based git refs declared as repository: + ref: pairs under roles/*/meta/services.yml, at any nesting depth (top-level entity, sub-entity, plugin map).
Delegates to repository, which resolves upstream tags via git ls-remote --tags <repository>.
Non-semver refs (branches like master, main, stable, commit SHAs) are skipped automatically.
Refs that carry a # nocheck: repository-version marker above their ref: key are skipped.
Conventions 📐
Each shim MUST:
- Resolve the repository root relative to its own location so it can run from any working directory.
- Forward every argument it receives to the underlying CLI so
--dry-runand--repo-rootkeep working from the shell. - Exit non-zero on CLI failure so the workflow surfaces the error.
Local smoke-test before changing a shim:
bash scripts/github/update/image_versions.sh --dry-run
bash scripts/github/update/repository_refs.sh --dry-run
Related 🔗
- README.md for the broader inventory of GitHub workflow helpers.
- open_update_pr.sh for the shared PR-open/refresh logic both update jobs share.
- check_git_changes.sh for the diff probe that gates the PR step.