music_library/backlog/completed/ml-8 - Add-docker-ecosystem-to-Dependabot-for-Dockerfile-base-images.md

id, title, status, assignee, created_date, labels, dependencies, references, priority

id	title	status	assignee	created_date	labels	dependencies	references	priority
ML-8	Add docker ecosystem to Dependabot for Dockerfile base images	Done		2026-04-20 08:49			https://github.com/cloud8421/music_library/issues/175	low

Description

GitHub: created 2026-04-16 · updated 2026-04-17 · closed 2026-04-17

Summary

.github/dependabot.yml covers github-actions, docker-compose, mix, and npm, but not the Dockerfile base-image ARGs (ELIXIR_VERSION, OTP_VERSION, DEBIAN_VERSION). Updates are currently manual.

Evidence

• .github/dependabot.yml — no package-ecosystem: docker entry targeting Dockerfile
• Dockerfile uses ARG ELIXIR_VERSION=1.20.0-rc.4, ARG OTP_VERSION=28.4.2, ARG DEBIAN_VERSION=trixie-20260406-slim

Fix

Add to .github/dependabot.yml:

- package-ecosystem: docker
  directory: /
  schedule:
    interval: daily
  open-pull-requests-limit: 5

Dependabot will open PRs bumping the base image ARGs; the mise run dev:validate-docker-image task (already in the project) will need to be run on those PRs to confirm hexpm/elixir tag availability on both linux/amd64 and linux/arm64.

Acceptance Criteria

• Docker base-image updates surface as Dependabot PRs
• Existing validate-docker-image task runs in CI to gate them

• #1 Docker base-image updates surface as Dependabot PRs
• #2 Existing validate-docker-image task runs in CI to gate them