docs: add troubleshooting section for Docker build and runtime issues - #951
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a Docker troubleshooting runbook to help developers debug local builds vs published GHCR images, and links to it from the deployment docs.
Changes:
- Add a new
docs/docker-debugging.mdrunbook with step-by-step commands for building/running locally and comparing with GHCR. - Add a “Troubleshooting Docker Build and Runtime Issues” section to
docs/deploy.mdlinking to the new runbook.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| docs/docker-debugging.md | New debugging runbook covering local build/run, GHCR pull/run, and common failure patterns. |
| docs/deploy.md | Adds a troubleshooting pointer to the new Docker debugging runbook. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| --env-file ./.env \ | ||
| --env NODE_ENV=development \ | ||
| --env HOST=0.0.0.0 \ | ||
| -p 3000:3000 \ | ||
| -it safe-settings:local |
There was a problem hiding this comment.
The command examples use tab characters for indentation (e.g., the --env-file / --env / -p lines). This repo’s .editorconfig specifies indent_style = space, and tabs often paste inconsistently across shells/editors. Replace the leading tabs with spaces throughout the code blocks to keep formatting consistent and copy/paste-friendly.
| --env-file ./.env \ | |
| --env NODE_ENV=development \ | |
| --env HOST=0.0.0.0 \ | |
| -p 3000:3000 \ | |
| -it safe-settings:local | |
| --env-file ./.env \ | |
| --env NODE_ENV=development \ | |
| --env HOST=0.0.0.0 \ | |
| -p 3000:3000 \ | |
| -it safe-settings:local |
| ```bash | ||
| docker pull ghcr.io/github/safe-settings:2.1.19 | ||
| ``` |
There was a problem hiding this comment.
The GHCR image tag is hard-coded to 2.1.19 in multiple commands. Other docs in this repo reference different tags (e.g., deploy.md mentions 2.1.13, awslambda.md mentions 2.1.17), so this is likely to become stale/confusing. Consider using a placeholder (e.g., $SAFE_SETTINGS_TAG) and/or pointing readers to where to find the current recommended tag, then reuse that consistently across docs.
* Handle multiple config changes in a PR or Push event and process them as a batch (#888) * handle multiple changes as a batch * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * depup files in a push * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * moved the dedup logic * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * build(deps): bump undici from 7.7.0 to 7.16.0 (#881) Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.7.0...v7.16.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865) Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1. - [Release notes](https://github.com/merencia/node-cron/releases) - [Commits](node-cron/node-cron@v3.0.3...v4.2.1) --- updated-dependencies: - dependency-name: node-cron dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump @apidevtools/json-schema-ref-parser (#882) Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1. - [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases) - [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1) --- updated-dependencies: - dependency-name: "@apidevtools/json-schema-ref-parser" dependency-version: 14.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883) Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.0.1...v10.0.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 10.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884) Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0. - [Release notes](https://github.com/import-js/eslint-plugin-import/releases) - [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md) - [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0) --- updated-dependencies: - dependency-name: eslint-plugin-import dependency-version: 2.32.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@184bdaa...5e57cd1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump actions/setup-node from 4 to 6 (#890) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894) Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897) Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@c1e5197...c299e40) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump actions/checkout from 4 to 6 (#898) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@2910929...c7c5346) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904) Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js). Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `validator` from 13.11.0 to 13.15.26 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.11.0...13.15.26) --- updated-dependencies: - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.26 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump qs in the npm_and_yarn group across 1 directory (#912) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump qs in the npm_and_yarn group across 1 directory (#913) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump octokit from 5.0.3 to 5.0.5 (#905) Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5. - [Release notes](https://github.com/octokit/octokit.js/releases) - [Commits](octokit/octokit.js@v5.0.3...v5.0.5) --- updated-dependencies: - dependency-name: octokit dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906) Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0. - [Release notes](https://github.com/probot/smee-client/releases) - [Commits](probot/smee-client@v4.3.1...v5.0.0) --- updated-dependencies: - dependency-name: smee-client dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908) Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3. - [Release notes](https://github.com/eslint/eslintrc/releases) - [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md) - [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3) --- updated-dependencies: - dependency-name: "@eslint/eslintrc" dependency-version: 3.3.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@e468171...8d2750c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump undici in the npm_and_yarn group across 1 directory (#921) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.16.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) --- updated-dependencies: - dependency-name: undici dependency-version: 7.18.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927) Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion. Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * [WIP] Upgrade project to support Node.js 22 and 24 (#939) * Initial plan * Upgrade Node.js to 22 and 24 (last 2 LTS versions) Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940) * Initial plan * Initial plan for fixing CI workflow test Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix Dependabot actor check in node-ci.yml workflow The `if` condition used `'dependabot'` but Dependabot's actual GitHub actor username is `'dependabot[bot]'`. This caused the test job to run for Dependabot PRs when it should be skipped, resulting in npm install failures due to ESLint 10 peer dependency conflicts. Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Refactor advanced CodeQL workflow steps (#941) * Added support for proxy servers in all execution environments (#917) * Added support for proxy servers in all execution environments * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * build(deps): bump probot from 13.4.4 to 14.2.4 (#907) * build(deps): bump probot from 13.4.4 to 14.2.4 Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4. - [Release notes](https://github.com/probot/probot/releases) - [Commits](probot/probot@v13.4.4...v14.2.4) --- updated-dependencies: - dependency-name: probot dependency-version: 14.2.4 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938) * Initial plan * Initial plan for fixing failing test suites Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix failing test suites caused by ESM-only dependencies Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Update minimatch dependency version to 10.2.1 * Fix devcontainer configuration and update dependencies (#942) * fix devcontainer * Update .devcontainer/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .devcontainer/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .devcontainer/devcontainer.json Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: prevent race conditions by creating new objects for repository configurations (#943) * fix: prevent race conditions by creating new objects for repository configurations Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> * Update lib/plugins/repository.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Change helm defaults to be more newcomer friendly (#919) * Updated container port to match the port exposed by the application inside the container * Added examples for common environment variables * Changed validators to be examples in comments to avoid needing to override * Changed min replica count to 1 for more cost effective defaults * Updated min replica default in docs * Updated service port default in docs * Updated validator defaults in docs * Updated restricted repos include default in docs * Update helm/safe-settings/values.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update helm/safe-settings/values.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Updated README to match the new default value Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948) Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949) * fix: override NODE_ENV=development in functional test and add retry logic Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176 * fix: add --fail to curl and || true to docker logs in functional test Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176 * fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9 * Update lib/plugins/repository.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add HOST environment variable to Dockerfile (#950) * docs: add troubleshooting section for Docker build and runtime issues (#951) * build(deps): bump undici in the npm_and_yarn group across 1 directory (#947) Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.22.0 to 7.24.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.22.0...v7.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 7.24.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps-dev): bump brace-expansion Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934) Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0. - [Release notes](https://github.com/Rob--W/proxy-from-env/releases) - [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0) --- updated-dependencies: - dependency-name: proxy-from-env dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@2634353...10e90e3) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 6.19.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * build(deps): bump path-to-regexp (#953) Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp). Updates `path-to-regexp` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 8.4.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954) Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml). Updates `path-to-regexp` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 8.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956) * Initial plan * Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Fix typo in devcontainer Dockerfile comment (Intall -> Install) Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Pin Dockerfile base image to SHA256 digest (#957) * Initial plan * Pin Docker base image to SHA256 digest to fix alert #128 Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Use `npm ci` instead of `npm install` in CI workflow (#958) * Initial plan * Replace npm install with npm ci in node-ci.yml workflow Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58 Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com> * Replace npm install with npm ci in workflow (#960) * Replace npm install with npm ci in workflow * Replace npm install with npm ci in workflow * Bug/issue 465 (#970) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * Update api endpoint version * Add JSON schemas for safe-settings configuration at repo, org, and suborg levels - Introduced `repos.json` schema for repository-level safe-settings overrides. - Updated `settings.json` schema to include additional properties for org-level configurations. - Created `suborgs.json` schema for suborg-level safe-settings configuration. - Enhanced the build script to dereference all schemas and handle errors during the process. * chores: fix branches tests * fix(build-schema): enhance schema dereferencing with GitHub API spec * Update docs/github-settings/5. branch-protection.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update index.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix(schema): simplify description for force_create property --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Bug/issue 842 (#928) * fix: apply org-level settings before loading repository configurations * fix: enhance descriptions and add new properties for security features in settings.json * fix: update description for deprecated squash-merge commit title property in settings.json * test: update branch protection tests to handle null restrictions and enforce_admins * fix: normalize branch protection restrictions and preserve existing settings * fix: update GitHub API calls to use the correct namespace for branch protection methods --------- Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com> * Fix custom_properties diffing when config uses `property_name` (#978) * Initial plan * Handle alternate custom property name shapes in normalize * Add explicit object guard in custom property normalization * Support property_name in custom_properties config entries * Polish custom properties test descriptions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * fix(variables): add noop mode support (#926) * feat(variables): add noop mode support - Add noop mode support to Variables plugin add/remove/update methods - Return NopCommand instead of making API calls when nop=true - Add comprehensive tests for noop mode behavior Signed-off-by: Kyle Harding <kyle@balena.io> * refactor(variables): align with Diffable contract pattern Refactor Variables plugin to match the single-item Diffable contract used by labels, milestones, and other plugins. The previous update() reimplemented sync() logic internally; now each method handles one item and lets Diffable.sync() orchestrate iteration. - Simplify update() from 90-line array-diffing to single-item PATCH - Simplify changed() from JSON.stringify comparison to value check - Remove getChanged(), lodash dependency, .then(res=>res) no-ops - Match labels.js nop return pattern: Promise.resolve([NopCommand]) - Fix inconsistent toUpperCase() between add/remove/update - Let errors propagate to Diffable.sync() instead of swallowing - Normalize find() to strip API metadata fields (created_at, etc.) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Kyle Harding <kyle@balena.io> --------- Signed-off-by: Kyle Harding <kyle@balena.io> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992) Resolve Dependabot alert #116 - lodash vulnerable to Code Injection via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Jan Bronicki <janbronicki@microsoft.com> Signed-off-by: Kyle Harding <kyle@balena.io> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com> Co-authored-by: Jan Bronicki <janbronicki@microsoft.com> Co-authored-by: Brett Logan <lindluni@github.com> Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev> Co-authored-by: Kyle Harding <kyle@balena.io> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
No description provided.