Repository navigation
fix: support Python 3.15 in the slim Docker image - #557
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
Bumps the dependencies group with 1 update: python. Updates `python` from 3.14.8-slim to 3.15.0-slim --- updated-dependencies: - dependency-name: python dependency-version: 3.15.0-slim dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Zack Koppert <zkoppert@github.com>
zkoppert
force-pushed
the
dependabot/docker/dependencies-ad7ad3a871
branch
from
November 2, 2026 18:36
45a6ce9 to
25ee154
Compare
zkoppert
changed the title
zkoppert
approved these changes
Nov 2, 2026
zkoppert
left a comment
zkoppert
left a comment
Collaborator
There was a problem hiding this comment.
CI is green. The Docker build now compiles Python 3.15 dependencies in a dedicated builder stage while keeping the runtime image slim.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Fix the failing CI on github-community-projects/contributors PR #557, which upgrades the Docker base image to Python 3.15. Preserve the slim runtime image while making dependencies without Python 3.15 wheels build successfully. Once CI passes, approve and merge the existing Dependabot pull request.
What Changed
gcc,libc6-dev, andlibffi-devpackages for dependencies without Python 3.15 wheels.Risk Assessment
✅ Low: The well-bounded multi-stage Docker change installs the required C build toolchain before dependency synchronization while retaining a Python slim final image without build dependencies.
Testing
After resolving local builder setup, reproduced the pre-fix compiler failure, rebuilt the target using archive and normal Docker contexts, verified offline native-library operation without compiler tooling, and exercised PAT/App report generation against an isolated API; retained build logs, runtime checks, API traces, and generated reports demonstrate that all targeted scenarios passed.
Evidence: Pre-fix compiler-failure reproduction
Evidence: Python 3.15 image build
Evidence: Offline native-runtime and compiler-exclusion checks
Evidence: Final runtime image metadata
~/.no-mistakes/evidence/01M6EQM1THH138ATWGVEXHHDQE/directory-context/action-reports-live.log)Evidence: PAT-generated contributor report
Evidence: GitHub App-generated contributor data
Evidence: GitHub App-generated job summary
Evidence: Isolated API authentication trace
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
✅ **Review** - passed
✅ No issues found.
✅ **Test** - passed
✅ No issues found.
Checkeddocker versionanddocker buildx version. Resolved the missing Buildx plugin and legacy-builder architecture mismatch using checksum-verified Buildx v0.38.1 installed only inside the disposable workspace.Built the pre-fix commit 168acfe using archive input anddocker buildx build --platform linux/amd64 --no-cache --progress=plain --load --tag contributors-live-01m6eqm1:prefixed-directory .local-docker-validation/prefixed-context; both reproduced cffi's missing-gcc failure.Built target commit 25ee154496340fa890cbffd7c7655a49bb047b0f from archive input, then randocker buildx build --platform linux/amd64 --no-cache --progress=plain --load --tag contributors-live-01m6eqm1:directory .to exercise the normal context and .dockerignore.Randocker run --rm --platform linux/amd64 --network none --tmpfs /tmp:rw,nosuid,size=64m --env UV_CACHE_DIR=/tmp/uv-cache --env UV_OFFLINE=true --env PYTHONDONTWRITEBYTECODE=1 -i contributors-live-01m6eqm1:directory python - < .local-docker-validation/runtime_check.py. Verified Python 3.15, native cffi execution/linkage, valid and tampered signatures, GitHub App JWT signing, locked dependencies, Git availability, and absence of compiler/development packages. Also exercised the archive-built image.RanPYTHONDONTWRITEBYTECODE=1 python3 .local-docker-validation/drive_reports.pyagainst both built images. The unmodified action entrypoint used PAT and GitHub App credentials against an isolated API; assertions checked complete JSON output, Markdown content, matching job summaries, and authenticated API requests.Inspected the final image withdocker image inspect contributors-live-01m6eqm1:directory; removed test containers, networks, images, synthetic credentials, and workspace-local tooling.GIT_OPTIONAL_LOCKS=0 git status --shortconfirmed no remaining changes.✅ **Document** - passed
✅ No issues found.
Dockerfile- Dockerfile lint and static-analysis checks remain blocked: hadolint, checkov, trivy, pre-commit, gitleaks, codespell, and jscpd are unavailable on PATH, and no repository-local executables were supplied. Searching elsewhere or installing system tools is prohibited. git diff --check passed. Make the configured tools available before rerunning this phase.🔧 No changes applied.
1 warning still open:
Dockerfile- Dockerfile lint and static-analysis checks remain blocked: hadolint, checkov, trivy, pre-commit, gitleaks, codespell, and jscpd are unavailable on PATH. No repository-local executable paths were supplied. Per the workspace rules, stopped without searching elsewhere or installing tools. Make the configured tools available before rerunning this phase.✅ **Push** - passed
✅ No issues found.