From 73e1602f58b752959c204915559c033719943337 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:32:42 +0000 Subject: [PATCH 1/3] chore(deps): bump python Bumps the dependencies group with 1 update: python. Updates `python` from 3.14.8-slim to 3.15.0-slim --- updated-dependencies: - dependency-name: python dependency-version: 3.15.0-slim dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ec02798..8c1c9f2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ #checkov:skip=CKV_DOCKER_2 #checkov:skip=CKV_DOCKER_3 #trivy:ignore:AVD-DS-0002 -FROM python:3.14.8-slim@sha256:a2b82f3c48559aa0a8446d9af49826b6e2b2016f4cd2afabfe6013ec53729170 +FROM python:3.15.0-slim@sha256:f5b92f2a669a4c347044f29367f31983280b648250ca94dea66f98c53bc87e58 LABEL org.opencontainers.image.source https://github.com/github-community-projects/cleanowners WORKDIR /action/workspace From 826283d92486248eeff89eb02ce0512a46044710 Mon Sep 17 00:00:00 2001 From: Zack Koppert Date: Mon, 2 Nov 2026 22:09:27 -0800 Subject: [PATCH 2/3] fix: build Python 3.15 dependencies Build native dependencies in an isolated stage because cffi does not yet publish Python 3.15 wheels. Keep the compiler toolchain out of the runtime image. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Zack Koppert --- Dockerfile | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8c1c9f2..ea6c438 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,16 +1,24 @@ #checkov:skip=CKV_DOCKER_2 #checkov:skip=CKV_DOCKER_3 #trivy:ignore:AVD-DS-0002 +FROM python:3.15.0-slim@sha256:f5b92f2a669a4c347044f29367f31983280b648250ca94dea66f98c53bc87e58 AS builder + +WORKDIR /action/workspace +COPY pyproject.toml uv.lock /action/workspace/ +COPY --from=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82 /uv /uvx /bin/ +RUN apt-get -y update \ + && apt-get -y install --no-install-recommends build-essential libffi-dev \ + && uv sync --frozen --no-dev --no-editable + FROM python:3.15.0-slim@sha256:f5b92f2a669a4c347044f29367f31983280b648250ca94dea66f98c53bc87e58 -LABEL org.opencontainers.image.source https://github.com/github-community-projects/cleanowners +LABEL org.opencontainers.image.source=https://github.com/github-community-projects/cleanowners WORKDIR /action/workspace COPY pyproject.toml uv.lock *.py /action/workspace/ - COPY --from=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82 /uv /uvx /bin/ +COPY --from=builder /action/workspace/.venv /action/workspace/.venv -RUN uv sync --frozen --no-dev --no-editable \ - && apt-get -y update \ +RUN apt-get -y update \ && apt-get -y install --no-install-recommends git=1:2.47.3-0+deb13u1 \ && rm -rf /var/lib/apt/lists/* From edc3fe5d00b0083446f32756320b15facb899603 Mon Sep 17 00:00:00 2001 From: Zack Koppert Date: Mon, 2 Nov 2026 22:36:51 -0800 Subject: [PATCH 3/3] no-mistakes(ci): Both failed checks reported Hadolint DL3008 for unpinned builder packages. I changed only Dockerfile, pinning build-essential=12.12 and libffi-dev=3.4.8-2 after verifying availability in the pinned base image. Python 3.15 and the separate runtime stage remain unchanged. Hadolint 2.15.1 reproduced the failure before the fix and passed afterward. The linux/amd64 Docker build succeeded and compiled cffi 2.0.0 from source. Offline runtime checks verified imports, cffi execution, and absence of compiler executables and APT development packages. Repository lint and all 73 tests passed locally on Python 3.14.3, with 100% coverage. git diff --check passed. The summary-comment HTTP 403 is nonfatal in the pinned Super-Linter implementation and requires no workflow change. I didn't push or rerun remote CI; those actions remain with the outer executor --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ea6c438..c2f86bc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,7 @@ WORKDIR /action/workspace COPY pyproject.toml uv.lock /action/workspace/ COPY --from=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82 /uv /uvx /bin/ RUN apt-get -y update \ - && apt-get -y install --no-install-recommends build-essential libffi-dev \ + && apt-get -y install --no-install-recommends build-essential=12.12 libffi-dev=3.4.8-2 \ && uv sync --frozen --no-dev --no-editable FROM python:3.15.0-slim@sha256:f5b92f2a669a4c347044f29367f31983280b648250ca94dea66f98c53bc87e58