Add Dependabot Docker update coverage for container image supply chain - #49528
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
✅ Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR. Test Quality Sentinel skipped. |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (0 additions detected in default business logic directories). |
|
✅ PR Code Quality Reviewer completed the code quality review. |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
There was a problem hiding this comment.
Pull request overview
Adds weekly Dependabot Docker configuration for the repository’s three Dockerfile directories.
Changes:
- Adds Docker ecosystem entries for
/,/actions/setup/js, and/.devcontainer. - Aligns schedules with existing weekly updates.
- Does not provide the upstream firewall/MCP image coverage required by #49168.
Show a summary per file
| File | Description |
|---|---|
.github/dependabot.yml |
Adds weekly Docker dependency update entries. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Balanced
| - package-ecosystem: docker | ||
| directory: / | ||
| schedule: | ||
| interval: weekly |
| - package-ecosystem: docker | ||
| directory: /actions/setup/js | ||
| schedule: | ||
| interval: weekly |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 22.5 AIC · ⌖ 9.18 AIC · ⊞ 5.4K
| schedule: | ||
| interval: weekly | ||
| - package-ecosystem: docker | ||
| directory: /actions/setup/js |
There was a problem hiding this comment.
The directory: /actions/setup/js entry targets a directory that contains only Dockerfile.safe-outputs-mcp, not a file named Dockerfile. Dependabot's Docker ecosystem scanner looks for files named exactly Dockerfile by default — a non-standard name like Dockerfile.safe-outputs-mcp will not be picked up, so this entry will either produce a Dependabot config error or silently yield no updates.
Consider one of:
- Rename
Dockerfile.safe-outputs-mcptoDockerfileif it is the only Docker artifact in that directory. - Remove this entry until a standard
Dockerfileexists in/actions/setup/js.
@copilot please address this.
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /codebase-design — requesting one change before merge.
📋 Key Findings
Issue
- Non-standard Dockerfile name:
/actions/setup/js/Dockerfile.safe-outputs-mcpuses a custom filename. Dependabot's Docker ecosystem scanner looks for standard names (Dockerfile,docker-compose.yml, etc.) by default. If the scanner silently skips this directory, the supply-chain CVE coverage goal for that container image is not achieved, despite the config entry being present.
Positive Highlights
- ✅ Clean, minimal change — only adds what is needed
- ✅ Consistent
weeklyschedule aligned with existing policy - ✅ Covers all three Dockerfile-backed directories in the repo
- ✅ Good PR description with clear rationale
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 25.1 AIC · ⌖ 10.7 AIC · ⊞ 7.1K
Comment /matt to run again
| schedule: | ||
| interval: weekly | ||
| - package-ecosystem: docker | ||
| directory: /actions/setup/js |
There was a problem hiding this comment.
[/codebase-design] The Dockerfile in /actions/setup/js is named Dockerfile.safe-outputs-mcp, not Dockerfile. Dependabot Docker scanning defaults to standard filenames; a non-standard name may silently produce no update PRs, leaving this entry ineffective.
💡 Verification options
- After merge, check Dependabot logs to confirm the directory triggers Docker update PRs.
- Rename
Dockerfile.safe-outputs-mcp→Dockerfileand update references in any build scripts. - If renaming is undesirable, verify Dependabot's documentation for custom Dockerfile name support.
If this directory is silently skipped, the supply-chain coverage goal for that image is unmet.
@copilot please address this.
There was a problem hiding this comment.
Verdict: minor config gap found, non-blocking
Good intent (closing docker CVE-remediation gap for #49168), but one of the three new Dependabot docker entries appears to be a no-op due to a non-standard Dockerfile name.
💡 Themes
.github/dependabot.yml: entries for/and/.devcontainerare correct — both directories contain a file literally namedDockerfile. The/actions/setup/jsentry is suspect since the only Docker file there isDockerfile.safe-outputs-mcp, which Dependabot's docker ecosystem does not detect by default..github/workflows/daily-byok-ollama-test.lock.yml: the diff also regenerates an unrelated compiled lock file (newdefaultAiCreditsPricing/modelsfields in the firewall config JSON). This is very likely stalemake recompiledrift picked up incidentally rather than a manual change, so not flagging as blocking, but worth confirming it's expected/harmless before merge.
🔎 Code quality review by PR Code Quality Reviewer · auto · 62.4 AIC · ⌖ 13.4 AIC · ⊞ 7.8K
Comment /review to run again
| schedule: | ||
| interval: weekly | ||
| - package-ecosystem: docker | ||
| directory: /actions/setup/js |
There was a problem hiding this comment.
This entry likely produces zero update coverage: Dependabot's docker ecosystem only detects files literally named Dockerfile/dockerfile (or docker-compose.yml) in the target directory, but /actions/setup/js only contains Dockerfile.safe-outputs-mcp.
💡 Dependabot docker-ecosystem file detection
Dependabot's docker-ecosystem scanner does not glob or pattern-match arbitrary Dockerfile names — it looks for an exact Dockerfile/dockerfile or docker-compose.yml in the configured directory. The only Docker-related file in actions/setup/js/ is Dockerfile.safe-outputs-mcp, which will not be picked up.
Impact: this new entry silently produces no update PRs, defeating the PR's stated goal (closing the docker CVE-remediation gap from #49168) for this specific directory.
Fix: rename the file to Dockerfile (with the multi-stage/target distinguished via build args or a separate directory), or drop this entry until Dependabot supports custom names, and verify post-merge that a PR is actually opened for this ecosystem/directory pair.
|
🎉 This pull request is included in a new release. Release: |
Dependabot was not configured to track Docker base image updates for containerized surfaces tied to firewall/MCP tooling, so CVE remediation relied on manual scan triage instead of automated update PRs. This change adds the missing Docker ecosystem coverage on the same weekly cadence as existing ecosystems.
What changed
package-ecosystem: dockerentries in.github/dependabot.ymlfor Dockerfile-backed directories used in this repo’s container pipeline.weekly) to maintain uniform update behavior.Dependabot config additions
directory: /directory: /actions/setup/jsdirectory: /.devcontainer