Repository navigation
chore(deps): hold Postgres majors on the sensitive tier, as wiki and bloodhound already do - #1185
Merged
Merged
Conversation
…bloodhound already do The sensitive tier's three Postgres volumes are quiesced data-directory tars in `make backup`, restorable only into the same major (ADR-0065), and trinity's converge timer deploys a merged bump within the hour. The wiki and bloodhound entries already ignore semver-major for postgres; this one did not, so a major bump would have reached the host with the previous night's set as the only way back. Both image names are held, because Immich's vectorchord build is its own image whose tag moves with the Postgres major too. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013Dchg9vmfKeQd7uzRzPcLR
There was a problem hiding this comment.
🟢 Approval recommended
The configuration is valid, narrowly scoped, and consistent with existing Postgres safeguards.
0 open findings
What changed in this PR
Prevents unsafe automatic Postgres major upgrades for the sensitive stack.
Changes:
- Ignores major updates for standard and Immich Postgres images.
- Documents the backup and deployment rationale.
| File | Description |
|---|---|
.github/dependabot.yml |
Adds sensitive-tier Postgres major-version holds. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The
/stacks/sensitiveDependabot entry now ignoresversion-update:semver-majorforpostgresandghcr.io/immich-app/postgres, the sameignoreblock the/stacks/wikiand/stacks/bloodhoundentries already carry. Nothing else moves.Why
Found during a repository review. The tier's three Postgres volumes (
immich-db,paperless-db-data,miniflux-db-data) are quiesced data-directory tars inmake backup, restorable only into the same major (ADR-0065), and trinity'shomelab-converge-sensitivedeploys a merged bump within the hour. With no ignore on this entry, a major bump would have started the next major against the previous major's data directory on trinity, with the previous night's set the only way back. Immich's vectorchord image is held by name too, since its tag moves with the Postgres major.Blast radius
None at runtime: this changes which PRs Dependabot opens, not what deploys.
secrets/*.sops.yamlVerification
make validatecould not be run in this environment (no Docker daemon, no yamllint binary); CI's lint job covers it.make validatepasses (CI)🤖 Generated with Claude Code
https://claude.ai/code/session_013Dchg9vmfKeQd7uzRzPcLR
Generated by Claude Code