fix(deps): update module github.com/docker/cli to v29.7.2+incompatible (main) - #253
Open
crossplane-renovate[bot] wants to merge 1 commit into
Open
fix(deps): update module github.com/docker/cli to v29.7.2+incompatible (main)#253crossplane-renovate[bot] wants to merge 1 commit into
crossplane-renovate[bot] wants to merge 1 commit into
Conversation
crossplane-renovate
Bot
requested review from
a team,
jcogilvie and
tampakrap
as code owners
August 7, 2026 08:25
crossplane-renovate
Bot
requested review from
negz
and removed request for
a team
August 7, 2026 08:25
Contributor
Author
|
5 tasks
haarchri
pushed a commit
that referenced
this pull request
Aug 11, 2026
* ci: fix Renovate's Nix tasks and let it update flake.lock Renovate's post-upgrade tasks fail here, so nix run .#tidy and nix run .#generate never refresh gomod2nix.toml or our generated code. The docker/cli bump in #253 was opened with go.mod and go.sum alone for this reason. Nix builds without its sandbox in Renovate's container, where HOME is /homeless-shelter on the real filesystem. A build that writes there creates the directory, and Nix then refuses to start any later build. pkgs.gomod2nix is one of the builds that creates it, and it comes from a dependency rather than our own Nix code, so we have nowhere to set a writable HOME. The entrypoint now registers a post-build hook that removes the directory after each build, and sets max-jobs to 1 so no build starts before the cleanup runs. The nix manager is disabled by default, so flake.lock has never been updated here and everything it pins is frozen. This commit enables the manager along with lock file maintenance, on an empty schedule so a refresh can open during any run, and gives it a prPriority that sorts it behind security updates only. Release branches opt out of non-security updates, but they build with Nix too and pick up newer Go versions through the lock file, so a rule re-enables maintenance for them. Renovate installs its own Nix through containerbase whenever it updates flake.lock. That one goes earlier on PATH and ignores /etc/nix/nix.conf, so the entrypoint publishes a crossplane-nix launcher that pins both the binary and the config it reads, and the post-upgrade tasks call it. RENOVATE_ALLOWED_COMMANDS no longer permits a bare nix, so a command still spelled that way fails on the allowlist instead of running against the wrong Nix. RENOVATE_VERSION now pins the version the validator runs and the version the action runs, so the two cannot disagree, and a customManager keeps it current. prConcurrentLimit returns to Renovate's default of 10 and the hourly PR limit is disabled so a backlog drains faster, security fixes skip dependency dashboard approval, and the entrypoint no longer installs Earthly, which nothing in this repo builds with. Signed-off-by: Jared Watts <jbw976@gmail.com> * build: bump nixpkgs from nixos-25.11 to nixos-26.05 The nixos-25.11 branch stopped moving at the end of June 2026 when the channel reached end of life, so every tool we pin through it is frozen. This commit points the nixpkgs input at nixos-26.05 and refreshes both inputs in flake.lock, neither of which had moved since April. Moving the channel moves the toolchain, and that accounts for the rest of the diff. protoc-gen-go 1.36.10 to 1.36.11 regenerates the render protobuf output. golangci-lint 2.11.4 to 2.12.2, which arrives with the nixpkgs-unstable refresh, reports new goconst and modernize findings, each addressed in place. nixpkgs 26.05 makes nixfmt-rfc-style an alias of nixfmt and warns when it is used, so we call nixfmt directly. Signed-off-by: Jared Watts <jbw976@gmail.com> --------- Signed-off-by: Jared Watts <jbw976@gmail.com>
jbw976
added a commit
that referenced
this pull request
Aug 11, 2026
Renovate's post-upgrade tasks fail here, so nix run .#tidy and nix run .#generate never refresh gomod2nix.toml or our generated code. The docker/cli bump in #253 was opened with go.mod and go.sum alone for this reason. Nix builds without its sandbox in Renovate's container, where HOME is /homeless-shelter on the real filesystem. A build that writes there creates the directory, and Nix then refuses to start any later build. pkgs.gomod2nix is one of the builds that creates it, and it comes from a dependency rather than our own Nix code, so we have nowhere to set a writable HOME. The entrypoint now registers a post-build hook that removes the directory after each build, and sets max-jobs to 1 so no build starts before the cleanup runs. The nix manager is disabled by default, so flake.lock has never been updated here and everything it pins is frozen. This commit enables the manager along with lock file maintenance, on an empty schedule so a refresh can open during any run, and gives it a prPriority that sorts it behind security updates only. Release branches opt out of non-security updates, but they build with Nix too and pick up newer Go versions through the lock file, so a rule re-enables maintenance for them. Renovate installs its own Nix through containerbase whenever it updates flake.lock. That one goes earlier on PATH and ignores /etc/nix/nix.conf, so the entrypoint publishes a crossplane-nix launcher that pins both the binary and the config it reads, and the post-upgrade tasks call it. RENOVATE_ALLOWED_COMMANDS no longer permits a bare nix, so a command still spelled that way fails on the allowlist instead of running against the wrong Nix. RENOVATE_VERSION now pins the version the validator runs and the version the action runs, so the two cannot disagree, and a customManager keeps it current. prConcurrentLimit returns to Renovate's default of 10 and the hourly PR limit is disabled so a backlog drains faster, security fixes skip dependency dashboard approval, and the entrypoint no longer installs Earthly, which nothing in this repo builds with. Signed-off-by: Jared Watts <jbw976@gmail.com> (cherry picked from commit 98b9db9)
jbw976
added a commit
that referenced
this pull request
Aug 11, 2026
Renovate's post-upgrade tasks fail here, so nix run .#tidy and nix run .#generate never refresh gomod2nix.toml or our generated code. The docker/cli bump in #253 was opened with go.mod and go.sum alone for this reason. Nix builds without its sandbox in Renovate's container, where HOME is /homeless-shelter on the real filesystem. A build that writes there creates the directory, and Nix then refuses to start any later build. pkgs.gomod2nix is one of the builds that creates it, and it comes from a dependency rather than our own Nix code, so we have nowhere to set a writable HOME. The entrypoint now registers a post-build hook that removes the directory after each build, and sets max-jobs to 1 so no build starts before the cleanup runs. The nix manager is disabled by default, so flake.lock has never been updated here and everything it pins is frozen. This commit enables the manager along with lock file maintenance, on an empty schedule so a refresh can open during any run, and gives it a prPriority that sorts it behind security updates only. Release branches opt out of non-security updates, but they build with Nix too and pick up newer Go versions through the lock file, so a rule re-enables maintenance for them. Renovate installs its own Nix through containerbase whenever it updates flake.lock. That one goes earlier on PATH and ignores /etc/nix/nix.conf, so the entrypoint publishes a crossplane-nix launcher that pins both the binary and the config it reads, and the post-upgrade tasks call it. RENOVATE_ALLOWED_COMMANDS no longer permits a bare nix, so a command still spelled that way fails on the allowlist instead of running against the wrong Nix. RENOVATE_VERSION now pins the version the validator runs and the version the action runs, so the two cannot disagree, and a customManager keeps it current. prConcurrentLimit returns to Renovate's default of 10 and the hourly PR limit is disabled so a backlog drains faster, security fixes skip dependency dashboard approval, and the entrypoint no longer installs Earthly, which nothing in this repo builds with. Signed-off-by: Jared Watts <jbw976@gmail.com> (cherry picked from commit 98b9db9)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v29.7.1+incompatible→v29.7.2+incompatibleRelease Notes
docker/cli (github.com/docker/cli)
v29.7.2+incompatibleCompare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.