From 78ba0d8a93970113fd83e39056c46e2359394fa9 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Wed, 4 Nov 2026 16:52:48 +0100
Subject: [PATCH] ci: update docker to 29.9.3 and automate version updates

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/ci.yml          | 26 +++----------------
 .github/workflows/update-deps.yml | 42 +++++++++++++++++++++++--------
 2 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2a0e873..d14d6de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ on:
   pull_request:
 
 env:
-  DOCKER_VERSION: v27.3.1
+  DOCKER_VERSION: v29.9.3
   DOCKER_BUILD_SUMMARY: false
 
 jobs:
@@ -36,8 +36,8 @@ jobs:
           - windows-latest
         version:
           - ""
-          - v27.3.1
-          - type=image,tag=27.3.1
+          - v29.9.3
+          - type=image,tag=29.9.3
     steps:
       -
         name: Checkout
@@ -325,23 +325,3 @@ jobs:
         env:
           UNDOCK_VERSION: ${{ matrix.undock_version }}
           REGCTL_VERSION: ${{ matrix.regctl_version }}
-
-  docker-29:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - macos-26-large
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Set up Docker
-        uses: ./
-        with:
-          version: v29.0.0-rc.1
-          channel: test
diff --git a/.github/workflows/update-deps.yml b/.github/workflows/update-deps.yml
index f436e6f..0c24c56 100644
--- a/.github/workflows/update-deps.yml
+++ b/.github/workflows/update-deps.yml
@@ -27,6 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         dep:
+          - docker
           - regctl
           - undock
     steps:
@@ -91,6 +92,12 @@ jobs:
             }
 
             const dependencyConfigs = {
+              docker: {
+                name: 'Docker version',
+                branch: 'deps/docker-version',
+                sourcePath: '.github/docker-releases.json',
+                sourceUrl: 'https://github.com/docker/actions-toolkit/blob/main/.github/docker-releases.json'
+              },
               regctl: {
                 name: 'Regctl version',
                 branch: 'deps/regctl-version',
@@ -113,22 +120,32 @@ jobs:
               return;
             }
 
-            const version = await readLatestTag(config.sourcePath);
-            const targetPath = 'src/main.ts';
+            const tag = await readLatestTag(config.sourcePath);
+            const version = dep === 'docker' ? tag.replace(/^docker-/, '') : tag;
+            const targetPath = dep === 'docker' ? '.github/workflows/ci.yml' : 'src/main.ts';
             const absolutePath = path.join(process.env.GITHUB_WORKSPACE, targetPath);
             const content = fs.readFileSync(absolutePath, 'utf8');
-            const pattern = tsConstStringPattern(config.key);
-            const match = content.match(pattern);
-            if (!match) {
-              throw new Error(`Missing ${config.key} in ${targetPath}`);
+            const replacements = dep === 'docker' ? [
+              {pattern: /^(  DOCKER_VERSION: )(v\S+)()$/m, version},
+              {pattern: /^(          - )(v\S+)()$/m, version},
+              {pattern: /^(          - type=image,tag=)(\S+)()$/m, version: version.replace(/^v/, '')}
+            ] : [{pattern: tsConstStringPattern(config.key), version}];
+            let updatedContent = content;
+            let previousVersion;
+            for (const replacement of replacements) {
+              const match = updatedContent.match(replacement.pattern);
+              if (!match) {
+                throw new Error(`Missing ${replacement.pattern} in ${targetPath}`);
+              }
+              previousVersion ??= match[2];
+              updatedContent = updatedContent.replace(replacement.pattern, (_, prefix, current, suffix) => `${prefix}${replacement.version}${suffix}`);
             }
 
-            const previousVersion = match[2];
-            const changed = previousVersion !== version;
+            const changed = updatedContent !== content;
             if (changed) {
               fs.writeFileSync(
                 absolutePath,
-                content.replace(pattern, `$1${version}$3`),
+                updatedContent,
                 'utf8'
               );
               core.info(`New ${config.name} ${version} found`);
@@ -143,9 +160,12 @@ jobs:
             core.setOutput('before', previousVersion);
             core.setOutput('after', version);
             core.setOutput('source-url', config.sourceUrl);
+            core.setOutput('description', dep === 'docker'
+              ? `This updates the pinned Docker version in \`${targetPath}\` from \`${previousVersion}\` to \`${version}\`, including the binary and image test matrix entries.`
+              : `This updates the pinned default in \`${targetPath}\` from \`${previousVersion}\` to \`${version}\` and refreshes generated \`dist\` content.`);
       -
         name: Build
-        if: steps.update.outputs.changed == 'true'
+        if: steps.update.outputs.changed == 'true' && matrix.dep != 'docker'
         uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           source: .
@@ -163,6 +183,6 @@ jobs:
           sign-commits: true
           delete-branch: true
           body: |
-            This updates the pinned default in `src/main.ts` from `${{ steps.update.outputs.before }}` to `${{ steps.update.outputs.after }}` and refreshes generated `dist` content.
+            ${{ steps.update.outputs.description }}
 
             The source of truth for this update is ${{ steps.update.outputs.source-url }}.