From c1fd14dbe86964b39b4feb139d567641b1a2da10 Mon Sep 17 00:00:00 2001 From: Luke Tomlinson Date: Fri, 31 Jul 2026 11:07:47 -0400 Subject: [PATCH 1/2] Fix independent Docker and Buildx updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 548ba3f7-0d56-4966-ad57-1b9ace7534f6 --- .github/workflows/docker-buildx-upgrade.yml | 95 ++++++++++++++------- docs/dependency-management.md | 2 +- 2 files changed, 63 insertions(+), 34 deletions(-) diff --git a/.github/workflows/docker-buildx-upgrade.yml b/.github/workflows/docker-buildx-upgrade.yml index 0bb91228ac3..e83d796d6e6 100644 --- a/.github/workflows/docker-buildx-upgrade.yml +++ b/.github/workflows/docker-buildx-upgrade.yml @@ -36,8 +36,8 @@ jobs: exit 1 fi - should_update=0 - [ "$current_version" != "$latest_version" ] && should_update=1 + should_update=false + [ "$current_version" != "$latest_version" ] && should_update=true echo "CURRENT_VERSION=${current_version}" >> $GITHUB_OUTPUT echo "LATEST_VERSION=${latest_version}" >> $GITHUB_OUTPUT @@ -53,8 +53,8 @@ jobs: # Fetch latest Buildx version latest_version=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//') - should_update=0 - [ "$current_version" != "$latest_version" ] && should_update=1 + should_update=false + [ "$current_version" != "$latest_version" ] && should_update=true echo "CURRENT_VERSION=${current_version}" >> $GITHUB_OUTPUT echo "LATEST_VERSION=${latest_version}" >> $GITHUB_OUTPUT @@ -66,17 +66,17 @@ jobs: buildx_should_update="${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}" # Show annotation if only Docker needs update - if [[ "$docker_should_update" == "1" && "$buildx_should_update" == "0" ]]; then - echo "::warning ::Docker version (${{ steps.check_docker_version.outputs.LATEST_VERSION }}) needs update but Buildx is current. Only updating when both need updates." + if [[ "$docker_should_update" == "true" && "$buildx_should_update" == "false" ]]; then + echo "::warning ::Docker version (${{ steps.check_docker_version.outputs.LATEST_VERSION }}) needs update; Buildx is current." fi # Show annotation if only Buildx needs update - if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "1" ]]; then - echo "::warning ::Buildx version (${{ steps.check_buildx_version.outputs.LATEST_VERSION }}) needs update but Docker is current. Only updating when both need updates." + if [[ "$docker_should_update" == "false" && "$buildx_should_update" == "true" ]]; then + echo "::warning ::Buildx version (${{ steps.check_buildx_version.outputs.LATEST_VERSION }}) needs update; Docker is current." fi # Show annotation when both are current - if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "0" ]]; then + if [[ "$docker_should_update" == "false" && "$buildx_should_update" == "false" ]]; then echo "::warning ::Latest Docker version is ${{ steps.check_docker_version.outputs.LATEST_VERSION }} and Buildx version is ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}. No updates needed." fi @@ -85,13 +85,14 @@ jobs: pull-requests: write contents: write needs: [check-versions] - if: ${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE == 1 && needs.check-versions.outputs.BUILDX_SHOULD_UPDATE == 1 }} + if: ${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE == 'true' || needs.check-versions.outputs.BUILDX_SHOULD_UPDATE == 'true' }} runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v7 - name: Update Docker version + if: ${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE == 'true' }} shell: bash run: | latest_version="${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}" @@ -101,6 +102,7 @@ jobs: sed -i "s/ARG DOCKER_VERSION=$current_version/ARG DOCKER_VERSION=$latest_version/g" ./images/Dockerfile - name: Update Buildx version + if: ${{ needs.check-versions.outputs.BUILDX_SHOULD_UPDATE == 'true' }} shell: bash run: | latest_version="${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" @@ -114,9 +116,26 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | # Setup branch and commit information + docker_should_update="${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE }}" + buildx_should_update="${{ needs.check-versions.outputs.BUILDX_SHOULD_UPDATE }}" branch_name="feature/docker-buildx-upgrade" - commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" - pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" + + if [[ "$docker_should_update" == "true" && "$buildx_should_update" == "true" ]]; then + commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" + pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" + pr_summary="Automated Docker and Buildx version update:" + pr_detail="This update ensures we're using the latest stable Docker and Buildx versions for security and performance improvements." + elif [[ "$docker_should_update" == "true" ]]; then + commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}" + pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}" + pr_summary="Automated Docker version update:" + pr_detail="This update ensures we're using the latest stable Docker version for security and performance improvements." + else + commit_message="Upgrade Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" + pr_title="Update Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" + pr_summary="Automated Buildx version update:" + pr_detail="This update ensures we're using the latest stable Buildx version for security and performance improvements." + fi # Configure git git config --global user.name "github-actions[bot]" @@ -134,27 +153,37 @@ jobs: git commit -a -m "$commit_message" git push --force origin "$branch_name" - # Create PR body using here-doc for proper formatting - cat > pr_body.txt << 'EOF' - Automated Docker and Buildx version update: - - - Docker: ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} - - Buildx: ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }} - - This update ensures we're using the latest stable Docker and Buildx versions for security and performance improvements. - - **Release notes:** https://docs.docker.com/engine/release-notes/ - - **Next steps:** - - Review the version changes - - Verify container builds work as expected - - Test multi-platform builds if applicable - - Merge when ready - - --- - - Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml) - EOF + # Create PR body + { + echo "$pr_summary" + echo + if [[ "$docker_should_update" == "true" ]]; then + echo "- Docker: ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}" + fi + if [[ "$buildx_should_update" == "true" ]]; then + echo "- Buildx: ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}" + fi + echo + echo "$pr_detail" + echo + echo "**Release notes:**" + if [[ "$docker_should_update" == "true" ]]; then + echo "- Docker: https://docs.docker.com/engine/release-notes/" + fi + if [[ "$buildx_should_update" == "true" ]]; then + echo "- Buildx: https://github.com/docker/buildx/releases" + fi + echo + echo "**Next steps:**" + echo "- Review the version changes" + echo "- Verify container builds work as expected" + echo "- Test multi-platform builds if applicable" + echo "- Merge when ready" + echo + echo "---" + echo + echo "Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)" + } > pr_body.txt # Create PR gh pr create -B main -H "$branch_name" \ diff --git a/docs/dependency-management.md b/docs/dependency-management.md index 9f20540c015..6f8a3a2398f 100644 --- a/docs/dependency-management.md +++ b/docs/dependency-management.md @@ -180,7 +180,7 @@ When updating Node.js versions, remember to: ### Docker Updates -- Updates include both Docker Engine and Docker Buildx +- Updates can include Docker Engine, Docker Buildx, or both - Verify compatibility with runner container workflows ## Troubleshooting From cff960d0b23f2b51785f20437a12eb3abf1f23c9 Mon Sep 17 00:00:00 2001 From: Luke Tomlinson Date: Fri, 31 Jul 2026 11:14:32 -0400 Subject: [PATCH 2/2] Fix Docker Buildx update reruns Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 548ba3f7-0d56-4966-ad57-1b9ace7534f6 --- .github/workflows/docker-buildx-upgrade.yml | 49 ++++++++++++++------- 1 file changed, 32 insertions(+), 17 deletions(-) diff --git a/.github/workflows/docker-buildx-upgrade.yml b/.github/workflows/docker-buildx-upgrade.yml index e83d796d6e6..8680efb9dc6 100644 --- a/.github/workflows/docker-buildx-upgrade.yml +++ b/.github/workflows/docker-buildx-upgrade.yml @@ -51,7 +51,20 @@ jobs: current_version=$(grep "ARG BUILDX_VERSION=" ./images/Dockerfile | cut -d'=' -f2) # Fetch latest Buildx version - latest_version=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//') + latest_response=$(curl -fsSL https://api.github.com/repos/docker/buildx/releases/latest) || { + echo "Failed to retrieve Buildx release information" + exit 1 + } + latest_version=$(jq -er '.tag_name | sub("^v"; "")' <<< "$latest_response") || { + echo "Failed to retrieve a valid Buildx version" + exit 1 + } + + # Extra check to ensure we got a valid version + if [[ ! $latest_version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Failed to retrieve a valid Buildx version" + exit 1 + fi should_update=false [ "$current_version" != "$latest_version" ] && should_update=true @@ -91,6 +104,12 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 + - name: Create update branch + shell: bash + run: | + branch_name="feature/docker-buildx-upgrade" + git checkout -B "$branch_name" + - name: Update Docker version if: ${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE == 'true' }} shell: bash @@ -141,14 +160,6 @@ jobs: git config --global user.name "github-actions[bot]" git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>" - # Create branch or switch to it if it exists - if git show-ref --quiet refs/remotes/origin/$branch_name; then - git fetch origin - git checkout -B "$branch_name" origin/$branch_name - else - git checkout -b "$branch_name" - fi - # Commit and push changes git commit -a -m "$commit_message" git push --force origin "$branch_name" @@ -185,11 +196,15 @@ jobs: echo "Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)" } > pr_body.txt - # Create PR - gh pr create -B main -H "$branch_name" \ - --title "$pr_title" \ - --label "dependencies" \ - --label "dependencies-weekly-check" \ - --label "dependencies-not-dependabot" \ - --label "docker" \ - --body-file pr_body.txt + existing_pr=$(gh pr list --head "$branch_name" --state open --json number --jq '.[0].number // ""') + if [[ -n "$existing_pr" ]]; then + gh pr edit "$existing_pr" --title "$pr_title" --body-file pr_body.txt + else + gh pr create -B main -H "$branch_name" \ + --title "$pr_title" \ + --label "dependencies" \ + --label "dependencies-weekly-check" \ + --label "dependencies-not-dependabot" \ + --label "docker" \ + --body-file pr_body.txt + fi