mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 04:06:42 +00:00
kevinveenbirkenbachandClaude Opus 5
8adf6fd3d1
A version written into a RUN pip install line is read by nothing: dependabot's pip ecosystem scans requirements*.txt and pyproject.toml, and the repository's own pip updater scans the package_name: key of an Ansible task. Neither opens a build recipe, so a pin set there ages until somebody edits the Dockerfile by hand. The rule is hard-failing and covers every tracked file under roles/ named Dockerfile or Dockerfile.<something>, template variants included. A pin counts only inside the pip install command itself: the scan follows backslash continuations, stops at the next shell separator, skips whole-line comments, and ignores a version supplied by an ARG or a Jinja expression. Suppress with # nocheck: dockerfile-pip-pin, catalogued in suppression.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contribution documentation 🤝
This directory contains contributor-facing repository rules and workflows. Its scope is how humans and agents set up the environment, write documentation, communicate, define requirements, and contribute safely through the project lifecycle.