mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
66be8f6a0a
A codename carries no ordering, so 'bookworm' and 'trixie' are two opaque strings and no updater can tell that one supersedes the other. A pin that names its Debian release that way is frozen on that release for as long as it stands, and the freeze is invisible because the tag keeps resolving. Numeric tags are comparable and stay inside the freshness pipeline, so the rule is worth holding for the whole repository rather than fixing case by case. The check reads two shapes, because a codename reaches the tree in two spellings. A 'name:tag' reference is recognised by the absence of a space after the colon, which is what separates 'debian:bookworm' from the YAML 'image: python' and covers Dockerfile FROM lines and heredocs without a second parser. A 'version:' value is read as a key, because '3.11-bookworm' carries no colon at all. False positives are kept out by two independent gates: a word-boundary prefilter, so 'residual' and 'inside' are not read as 'sid', and a split of the tag on '-', '.' and '_' that requires a whole component to be a codename. That is what lets 'cache buster', '.stretched-link', 'fa-bullseye' and a tags list containing 'stretch' through. Every codename occurrence in the repository was checked against the matcher by hand, and the check was negative-controlled in both shapes, including an untracked file. Four references had to move for the rule to hold. meta/distros.yml takes 'debian:13' rather than '13.6': at depth 1 the updater can raise it across a major, while depth 2 pins it inside the 13.x line forever. The whole 'make install' path was run in a debian:13 container to back that: all twenty-four Depends and Recommends resolve on trixie, the docker repository bootstrap derives the right suite and installs docker-ce-cli, and the package builds and installs. The workspace DiD probe moves to 'debian:13-slim'. An earlier version of this change carried a suppression claiming the probe had to follow the suite the apt proxy mirrors. That was wrong twice over: it cited a function that has nothing to do with the probe, and the coupling does not exist, because the cache frontend rewrites by path prefix and the suite never enters a routing decision. Replaying the probe verbatim against debian:13-slim fetches all three trixie suites through the bookworm-configured proxies, so the suppression is gone rather than reworded. The rule ships with an escape hatch and no uses of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>