chore(deps): atlantis-base: Update gosu and git-lfs

[Teko012]

what

• Updates gosu, git-lfs to the latest version, along with curl, bash in alpine, and the debian base image.

why

• gosu and git-lfs contains many CVEs, and haven't been update in a while. The other changes are more house keeping to keep them up to date as well.

references

• gosu releases
• git-lfs releases
• https://hub.docker.com/r/amd64/debian/
• Relates to gcp (and snyk) container scan output #2883 (comment)

[nitrocode]

Hi @Teko012. Thank you for the PR. Please build both the alpine and debian bases locally to ensure they work. After those build successfully then please change this PR to ready-to-review.

The reason why the image is failing is because we pin dependencies to specific versions to keep the image repeatable. However, the package repos will update packages to smaller versions and remove previous versions which cause the base to fail.

We may want to use semver tilde ranges e.g. package~=version instead of package=version-suffix format.

Ref

• https://superuser.com/questions/1055060/how-to-install-a-specific-package-version-in-alpine
• https://medium.com/@devalias/i-dont-believe-they-delete-the-old-versions-so-much-as-the-newer-version-of-alpine-eg-63d18daae710

In the future, it would be good to add these images to be managed by renovatebot so I created a separate ticket for it #2890.

[Teko012]

Hey @nitrocode, sorry about that, I actually checked all the alpine packages, but I managed to miss the r2-r3 change. It should be fixed now. git-lfs also changed how they package their archives, but it should be fixed as well.

[nitrocode]

Thank you @Teko012 for your contribution!

[nitrocode]

@Teko012 seems like after the base was built and we built our new atlantis image based on the new base (#2892), our e2e tests are now failing.

https://github.com/runatlantis/atlantis/runs/10354247221
https://app.circleci.com/pipelines/github/runatlantis/atlantis/3582/workflows/151fa56e-60d4-4f3c-9c80-17b4bba57e89/jobs/13297

{"level":"error","ts":"2022-12-29T18:33:32.310Z","caller":"events/instrumented_project_command_runner.go:78","msg":"Failure running plan operation: This project is currently locked by an unapplied plan from pull #4462. To continue, delete the lock from #4462 or apply that plan and merge the pull request.\n\nOnce the lock is released, comment atlantis plan here to re-plan.","json":{"repo":"runatlantis/atlantis-tests","pull":"4463"}

Stack trace

github.com/runatlantis/atlantis/server/events.RunAndEmitStats
	/home/circleci/project/server/events/instrumented_project_command_runner.go:78
github.com/runatlantis/atlantis/server/events.(*InstrumentedProjectCommandRunner).Plan
	/home/circleci/project/server/events/instrumented_project_command_runner.go:37
github.com/runatlantis/atlantis/server/events.runProjectCmds
	/home/circleci/project/server/events/project_command_pool_executor.go:48
github.com/runatlantis/atlantis/server/events.(*PlanCommandRunner).runAutoplan
	/home/circleci/project/server/events/plan_command_runner.go:127
github.com/runatlantis/atlantis/server/events.(*PlanCommandRunner).Run
	/home/circleci/project/server/events/plan_command_runner.go:249
github.com/runatlantis/atlantis/server/events.(*DefaultCommandRunner).RunAutoplanCommand
	/home/circleci/project/server/events/command_runner.go:174

I reran the tests here

https://github.com/runatlantis/atlantis/runs/10354526807
https://circleci.com/gh/runatlantis/atlantis/13301?utm_campaign=vcs-integration-link&utm_medium=referral&utm_source=github-checks-link&utm_content=summary

Edit: odd, the second run worked.

[Teko012]

@nitrocode I see two commits almost at the same, time, I'm not sure how tests are setup, but is it possible it is some kind of race condition in the https://github.com/runatlantis/atlantis-tests repo? Maybe the tests share some common resources?

[Teko012]

@nitrocode Both runs passed now, and based on the error message This project is currently locked by an unapplied plan from pull #4462 it might worth to look into if it shares one tfstate or something similar that survives every run.

[nitrocode]

Yep, seems like a race condition when running multiple e2e tests. Thank you. All resolved now.