sync-dependabot-pins

name	sync-dependabot-pins
description	After a Dependabot bump of oss-crs-infra/dependabot-pins.Dockerfile, resolve the human-readable version tag for each updated digest, fix the inline comment, and sync the digest to oss_crs/src/constants.py.
allowed-tools	Read, Bash, Edit

Sync Dependabot Pins

Dependabot updates image digests in oss-crs-infra/dependabot-pins.Dockerfile but leaves version comments stale or copies the old one. This skill resolves the correct human-readable version for each changed digest, patches the Dockerfile comment, and syncs the digest to oss_crs/src/constants.py.

Step 1 — Confirm the latest commit touched dependabot-pins.Dockerfile

git log --oneline -1 -- oss-crs-infra/dependabot-pins.Dockerfile

If no output, the latest commit did not touch this file. Stop here and tell the user there is nothing to sync.

Step 2 — Read the current Dockerfile

Read oss-crs-infra/dependabot-pins.Dockerfile and extract every FROM line. Each has the form:

FROM <image>@sha256:<digest>  # <version-comment>

Note the image name, full digest, and existing comment for each line.

Step 3 — Identify what changed

git diff HEAD~1 HEAD -- oss-crs-infra/dependabot-pins.Dockerfile

Only process the FROM lines whose digest actually changed. Leave unchanged lines alone.

Step 4 — Resolve the human-readable version for each changed digest

For each changed image, use docker buildx imagetools inspect to scan release tags until the digest matches. This avoids pulling the image and works for multi-platform indexes.

For ghcr.io/berriai/litellm-database

The image uses semver tags (v1.86.1, v1.87.0, etc.) that match the BerriAI/litellm GitHub release tags. Fetch recent releases and resolve each one's digest:

TARGET_DIGEST="sha256:<new-digest>"

# Get recent release tags from GitHub
TAGS=$(curl -s "https://api.github.com/repos/BerriAI/litellm/releases?per_page=20" \
  | python3 -c "import json,sys; [print(r['tag_name']) for r in json.load(sys.stdin) if not r.get('prerelease')]")

# Resolve each tag to its OCI index digest and look for a match
for tag in $TAGS; do
  DIGEST=$(docker buildx imagetools inspect "ghcr.io/berriai/litellm-database:$tag" \
    --format '{{.Manifest.Digest}}' 2>/dev/null)
  echo "$tag -> $DIGEST"
  if [ "$DIGEST" = "$TARGET_DIGEST" ]; then
    echo "MATCH FOUND: $tag"
    break
  fi
done

If the matching tag is not in the first 20 releases, broaden the search with per_page=50 or check older pages.

For postgres (Docker Hub)

TARGET_DIGEST="sha256:<new-digest>"

# Fetch recent postgres tags and resolve each
curl -s "https://registry.hub.docker.com/v2/repositories/library/postgres/tags?page_size=50&ordering=last_updated" \
  | python3 -c "
import json,sys
data=json.load(sys.stdin)
for t in data.get('results',[]):
    # Skip non-numeric tags (alpha, beta, etc.)
    name=t['name']
    if name[0].isdigit():
        print(name)
" | while read tag; do
  DIGEST=$(docker buildx imagetools inspect "postgres:$tag" \
    --format '{{.Manifest.Digest}}' 2>/dev/null)
  if [ "$DIGEST" = "$TARGET_DIGEST" ]; then
    echo "MATCH FOUND: $tag"
    break
  fi
done

If docker buildx imagetools inspect returns empty digests (Docker Hub rate-limits anonymous manifest inspects, often hitting newer tags like the 18.x series while older tags still resolve), skip buildx entirely and match against the digests already embedded in the Docker Hub tags API response. Each tag entry carries a top-level digest (the multi-arch OCI index digest, which is what the FROM ...@sha256: pin uses) plus per-images digests:

TARGET_DIGEST="sha256:<new-digest>"

for page in 1 2 3; do
curl -s "https://registry.hub.docker.com/v2/repositories/library/postgres/tags?page_size=100&page=$page&ordering=last_updated" \
  | python3 -c "
import json,sys
target='$TARGET_DIGEST'
data=json.load(sys.stdin)
for t in data.get('results',[]):
    if t.get('digest','')==target:
        print('MATCH (index digest):', t['name'])
    for img in t.get('images',[]):
        if img.get('digest','')==target:
            print('MATCH (image digest):', t['name'], img.get('os'), img.get('architecture'))
"
done

This usually returns several aliases for one digest (e.g. 18.4, 18, trixie, latest). Pick the most specific numeric version tag (18.4) for the comment. Note that a digest bump does not always mean a version bump — a rebuild of the same version with refreshed base packages keeps the same numeric tag, so the existing comment may already be correct.

Fallback — Inspect the Dependabot commit message

The commit message from git log -1 -- oss-crs-infra/dependabot-pins.Dockerfile sometimes contains release note links. You can also check GHCR tags directly:

TOKEN=$(curl -s "https://ghcr.io/token?service=ghcr.io&scope=repository:berriai/litellm-database:pull" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')
curl -s -H "Authorization: Bearer $TOKEN" "https://ghcr.io/v2/berriai/litellm-database/tags/list" \
  | python3 -c "import json,sys; print('\n'.join(data.get('tags',[]) for data in [json.load(sys.stdin)]))"

If no strategy resolves the version, leave the comment as # <unknown> and note it in your response so the user can fill it in manually.

Step 5 — Update the inline comment in dependabot-pins.Dockerfile

For each changed FROM line, replace the old comment with the resolved version:

FROM <image>@sha256:<new-digest>  # <resolved-version>

Use the Edit tool to make this change.

Step 6 — Sync digests to oss_crs/src/constants.py

Read oss_crs/src/constants.py. It contains constants of the form:

LITELLM_IMAGE = "ghcr.io/berriai/litellm-database@sha256:<digest>"  # <version>
POSTGRES_IMAGE = "postgres@sha256:<digest>"  # <version>

The mapping from Dockerfile FROM image to Python constant is:

Dockerfile image prefix	Python constant
ghcr.io/berriai/litellm-database	LITELLM_IMAGE
postgres	POSTGRES_IMAGE

For each changed image, update both the digest and the inline comment in constants.py to match what is now in dependabot-pins.Dockerfile. Use the Edit tool.

Step 7 — Verify the sync

After editing, confirm the digests and comments match between the two files:

grep -E 'sha256:|# v|# [0-9]' oss-crs-infra/dependabot-pins.Dockerfile oss_crs/src/constants.py

All digests that appear in dependabot-pins.Dockerfile must appear verbatim in constants.py. Report any mismatch.

Example Output

After a successful sync, report something like:

Updated: ghcr.io/berriai/litellm-database
  Old digest: 069da88...  # v1.84.1
  New digest: 49f8919...  # v1.85.0
  Updated in: oss-crs-infra/dependabot-pins.Dockerfile, oss_crs/src/constants.py