mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 04:06:42 +00:00
kevinveenbirkenbachandClaude Opus 5
8adf6fd3d1
A version written into a RUN pip install line is read by nothing: dependabot's pip ecosystem scans requirements*.txt and pyproject.toml, and the repository's own pip updater scans the package_name: key of an Ansible task. Neither opens a build recipe, so a pin set there ages until somebody edits the Dockerfile by hand. The rule is hard-failing and covers every tracked file under roles/ named Dockerfile or Dockerfile.<something>, template variants included. A pin counts only inside the pip install command itself: the scan follows backslash continuations, stops at the next shell separator, skips whole-line comments, and ignores a version supplied by an ARG or a Jinja expression. Suppress with # nocheck: dockerfile-pip-pin, catalogued in suppression.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Documentation 📝
This directory contains the repository documentation published for Infinito.Nexus. Its scope is contributor guidance, agent instructions, operational guides, requirements, and security guidance across the project.