mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 04:06:42 +00:00
kevinveenbirkenbachandClaude Opus 5
8adf6fd3d1
A version written into a RUN pip install line is read by nothing: dependabot's pip ecosystem scans requirements*.txt and pyproject.toml, and the repository's own pip updater scans the package_name: key of an Ansible task. Neither opens a build recipe, so a pin set there ages until somebody edits the Dockerfile by hand. The rule is hard-failing and covers every tracked file under roles/ named Dockerfile or Dockerfile.<something>, template variants included. A pin counts only inside the pip install command itself: the scan follows backslash continuations, stops at the next shell separator, skips whole-line comments, and ignores a version supplied by an ARG or a Jinja expression. Suppress with # nocheck: dockerfile-pip-pin, catalogued in suppression.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Actions 🚀
This directory contains contributor workflow guidance. Its scope is branch strategy, commits, testing, local deploys, CI, review, pull requests, releases, and the end-to-end path from local change to merged contribution.