Chore: [AEA-0000] - bump dev container version to 1.4.8#2972
Chore: [AEA-0000] - bump dev container version to 1.4.8#2972anthony-nhs merged 1 commit intomainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Bumps the development container image version used by this repo and updates associated CI reusable-workflow pins so quality checks run against the updated devcontainer tooling.
Changes:
- Update devcontainer image version from
v1.4.4tov1.4.8. - Bump
quality-checks-devcontainer.ymlreusable workflow reference to a newer pinned commit SHA. - Update
zizmor.ymlignore locations to match the new reported column positions.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
zizmor.yml |
Updates ignore pointers for unpinned-image findings to new line/column locations. |
.github/workflows/release.yml |
Bumps the quality-checks-devcontainer.yml reusable workflow pin. |
.github/workflows/pull_request.yml |
Bumps the quality-checks-devcontainer.yml reusable workflow pin. |
.github/workflows/ci.yml |
Bumps the quality-checks-devcontainer.yml reusable workflow pin. |
.devcontainer/devcontainer.json |
Updates the devcontainer image version argument to v1.4.8. |
| verify_published_from_main_image: true | ||
| quality_checks: | ||
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20 | ||
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc |
There was a problem hiding this comment.
This workflow now pins quality-checks-devcontainer.yml to a different eps-common-workflows commit than the other reusable workflows in the same file (get-repo-config.yml, tag-release-devcontainer.yml). Using multiple versions of the same upstream reusable-workflow repo in one workflow increases the risk of mismatched inputs/outputs and complicates debugging. Consider bumping the other eps-common-workflows references in this file to the same commit SHA (or centralising the SHA) so they stay consistent.
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc | |
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20 |
|
|
||
| quality_checks: | ||
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20 | ||
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc |
There was a problem hiding this comment.
This workflow now pins quality-checks-devcontainer.yml to a different eps-common-workflows commit than the other reusable workflows in the same file (get-repo-config.yml, tag-release-devcontainer.yml). Mixing versions from the same upstream repo can introduce subtle incompatibilities (inputs/outputs/permissions) and makes upgrades harder to reason about. Consider bumping all NHSDigital/eps-common-workflows/.github/workflows/* references in this workflow to the same commit SHA (or centralising the SHA via a single variable) so they stay in sync.
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc | |
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20 |
|
|
||
| quality_checks: | ||
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20 | ||
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc |
There was a problem hiding this comment.
This workflow now pins quality-checks-devcontainer.yml to a different eps-common-workflows commit than the other reusable workflows in the same file (get-repo-config.yml, tag-release-devcontainer.yml, etc.). Keeping all reusable workflow references from the same upstream repo on a single commit SHA helps avoid compatibility issues and simplifies future bumps. Consider updating the remaining eps-common-workflows references here to the same SHA (or centralising the SHA) to keep them aligned.
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc | |
| uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20 |
|
bump dev container version to 1.4.8