⚠️ CONFLICT! Lineage pull request for: skeleton by cisagovbot · Pull Request #283 · cisagov/code-gov-update

cisagovbot · 2026-03-25T00:55:10Z

Lineage Pull Request: CONFLICT

Lineage has created this pull request to incorporate new changes found in an upstream repository:

Upstream repository: https://github.com/cisagov/skeleton-docker.git
Remote branch: HEAD

Check the changes in this pull request to ensure they won't cause issues with your project.

The lineage/skeleton branch has one or more unresolved merge conflicts that you must resolve before merging this pull request!

How to resolve the conflicts

Take ownership of this pull request by removing any other assignees.

Clone the repository locally, and reapply the merge:

git clone git@github.com:cisagov/code-gov-update.git code-gov-update
cd code-gov-update
git remote add skeleton https://github.com/cisagov/skeleton-docker.git
git remote set-url --push skeleton no_push
git switch develop
git switch --create lineage/skeleton --track origin/develop
git pull skeleton HEAD
git status

Review the changes displayed by the status command. Fix any conflicts and possibly incorrect auto-merges.
After resolving each of the conflicts, add your changes to the branch, commit, and push your changes:
```
git add Dockerfile README.md src/Pipfile src/Pipfile.lock 
git commit
git push --force --set-upstream origin lineage/skeleton
```
Note that you may append to the default merge commit message that git creates for you, but please do not delete the existing content. It provides useful information about the merge that is being performed.
Wait for all the automated tests to pass.
Confirm each item in the "Pre-approval checklist" below.
Remove any of the checklist items that do not apply.
Ensure every remaining checkbox has been checked.
Mark this draft pull request "Ready for review".

✅ Pre-approval checklist

Remove any of the following that do not apply. If you're unsure about any of these, don't hesitate to ask. We're here to help!

✌️ The conflicts in this pull request have been resolved.
All relevant type-of-change labels have been added.
All new and existing tests pass.

Note

You are seeing this because one of this repository's maintainers has configured Lineage to open pull requests.

For more information:

🛠 Lineage configurations for this project are stored in .github/lineage.yml

📚 Read more about Lineage

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

The `pull_request` trigger's default activity types are `opened`, `reopened`, and `synchronized`. These types better represent when we want this workflow to run and the `edited` type was resulting in undesired workflow runs.

This is done automatically with the `pre-commit autoupdate` command.

The latest release supports the artifact-metadata permission that we are now using in the generate-sbom job of the build.yml GitHub Actions workflow in cisagov/skeleton-aws-lambda-python, cisagov/skeleton-docker, and cisagov/skeleton-python-library.

This will return the cache key to being a string with no new lines.

Bumps library/python from 3.14.2-alpine3.22 to 3.14.3-alpine3.22. --- updated-dependencies: - dependency-name: library/python dependency-version: 3.14.3-alpine3.22 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

The Python version in the Pipfile should match that being used in the Docker image.

It is no longer necessary to install wheel alongside setuptools as of setuptools v70.1: https://github.com/pypa/wheel?tab=readme-ov-file#historical-note

This is done automatically with the pre-commit autoupdate command.

We rely on the default activity types for the pull_request event in our GitHub Actions workflows. This adds a comment mentioning that we do so and linking to the GitHub documentation for the event which details the specific activity types that are used by default. Co-authored-by: dav3r <david.redmin@gwe.cisa.dhs.gov>

This is done automatically with the pre-commit autoupdate command.

Remove installation of `wheel` Python package

…s/cache-5 Bump actions/cache from 4 to 5

…ggers Adjust the activity types for the `pull_request` trigger in the `Label pull requests` workflow

…ting Adjust the `lint` job of the `build` workflow's cache key formatting

Update `pre-commit` hook versions

Now that I have two pull requests out for changes relevant to our work it makes sense to use a branch that consolidates any changes we need.

We need to update the comment about using a branch of mcdonnnj's terraform-docs fork to reflect that a second PR with different functionality is now included in the branch. Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

…s_branch Change the branch we use for installing terraform-docs

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v6...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [crazy-max/ghaction-github-labeler](https://github.com/crazy-max/ghaction-github-labeler) from 5 to 6. - [Release notes](https://github.com/crazy-max/ghaction-github-labeler/releases) - [Commits](crazy-max/ghaction-github-labeler@v5...v6) --- updated-dependencies: - dependency-name: crazy-max/ghaction-github-labeler dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) from 3 to 4. - [Release notes](https://github.com/hashicorp/setup-terraform/releases) - [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md) - [Commits](hashicorp/setup-terraform@v3...v4) --- updated-dependencies: - dependency-name: hashicorp/setup-terraform dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Also remove the name attribute as it is not used when archive is false. Note that this requires updating the name of the artifact in a few places where we download it. Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

actions/upload-artifact@v7 requires actions/download-artifact@v8.

We no longer need this directory now that we are uploading image.tar.gz directly, i.e., instead of the entire dist directory. Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

These actions often need to be upgraded in lockstep, so it makes sense to group them.

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6...v7) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

We have to ignore this vulnerability for now since an update for pygments has not yet been released. In any event, this vulnerability is unlikely to cause us any problems since we don't feed any regexes to pygments directly. See also: - cisagov/skeleton-generic#257 - https://nvd.nist.gov/vuln/detail/CVE-2026-4539 - pygments/pygments#3058 Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Ignore a vulnerability originating from `pygments`

…orp/setup-terraform-4 Bump hashicorp/setup-terraform from 3 to 4

…max/ghaction-github-labeler-6 Bump crazy-max/ghaction-github-labeler from 5 to 6

This is done automatically with the pre-commit autoupdate command.

Newer versions of the hook require Python 3.14, but we are still using Python 3.13 in our GitHub Actions configuration.

Install the `go-critic` command instead of `gocritic` in the `build.yml` workflow

…uration Add additional plugins to the `flake8` pre-commit configuration

…to_lock_terraform_providers Add a pre-commit hook to lock Terraform providers automatically

Update `pre-commit` hook versions

…uration_file Remove the bandit configuration file

This gets rid of an error from our flake8 pre-commit hook.

⚠️ CONFLICT! Lineage pull request for: skeleton

New line length findings require us to adjust the `src/email-updates.py` script.

dependabot bot and others added 30 commits December 15, 2025 18:26

Remove itemized pull_request trigger types

ce44624

The `pull_request` trigger's default activity types are `opened`, `reopened`, and `synchronized`. These types better represent when we want this workflow to run and the `edited` type was resulting in undesired workflow runs.

Update pre-commit hook versions

9c0d2b6

This is done automatically with the `pre-commit autoupdate` command.

Adjust the build workflow's cache key formatting

77f204a

This will return the cache key to being a string with no new lines.

Update Python version in Pipfile and re-lock

61694ea

The Python version in the Pipfile should match that being used in the Docker image.

Upgrade to Alpine 3.23

74a0b51

Update the versions of the Python packages being installed directly

7d407f7

Remove installation of wheel Python package

2fb5133

It is no longer necessary to install wheel alongside setuptools as of setuptools v70.1: https://github.com/pypa/wheel?tab=readme-ov-file#historical-note

Update pre-commit hook versions

6b9b731

This is done automatically with the pre-commit autoupdate command.

Update pre-commit hook versions

57ee431

This is done automatically with the pre-commit autoupdate command.

Merge pull request #249 from cisagov/improvement/remove-wheel

7d62b5e

Remove installation of `wheel` Python package

Merge pull request #244 from cisagov/dependabot/github_actions/action…

9eac052

…s/cache-5 Bump actions/cache from 4 to 5

Merge pull request #245 from cisagov/improvement/adjust_label-prs_tri…

fe7eb42

…ggers Adjust the activity types for the `pull_request` trigger in the `Label pull requests` workflow

Merge pull request #247 from cisagov/improvement/fix_cache_key_format…

ace1712

…ting Adjust the `lint` job of the `build` workflow's cache key formatting

Merge pull request #246 from cisagov/maintenance/update_pre-commit_hooks

6ae498b

Update `pre-commit` hook versions

Change the branch used for terraform-docs

44f5b28

Now that I have two pull requests out for changes relevant to our work it makes sense to use a branch that consolidates any changes we need.

Update comment in the build workflow

4991be5

We need to update the comment about using a branch of mcdonnnj's terraform-docs fork to reflect that a second PR with different functionality is now included in the branch. Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Merge pull request #250 from cisagov/improvement/change_terraform-doc…

5df67a7

…s_branch Change the branch we use for installing terraform-docs

Set archive to false to avoid double-zipping

f8f8a72

Also remove the name attribute as it is not used when archive is false. Note that this requires updating the name of the artifact in a few places where we download it. Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Do not specify a path when downloading the artifact

4ced287

Upgrade actions/download-artifact to v8

18b9e40

actions/upload-artifact@v7 requires actions/download-artifact@v8.

Get rid of the dist directory

be5c2c5

We no longer need this directory now that we are uploading image.tar.gz directly, i.e., instead of the entire dist directory. Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Group the upload-artifact and download-artifact actions

534ed38

These actions often need to be upgraded in lockstep, so it makes sense to group them.

mcdonnnj unassigned jsf9k and dav3r Mar 25, 2026

mcdonnnj force-pushed the lineage/skeleton branch from f2e1f3a to e221c3f Compare March 25, 2026 06:32

jsf9k and others added 17 commits March 25, 2026 12:55

Correct reference to ticket in TODO comment

a1cdc78

Merge pull request #258 from cisagov/ignore-pygments-vuln

71bbac4

Ignore a vulnerability originating from `pygments`

Merge pull request #252 from cisagov/dependabot/github_actions/hashic…

2f729bb

…orp/setup-terraform-4 Bump hashicorp/setup-terraform from 3 to 4

Merge pull request #251 from cisagov/dependabot/github_actions/crazy-…

391e54b

…max/ghaction-github-labeler-6 Bump crazy-max/ghaction-github-labeler from 5 to 6

Update pre-commit hook versions

811785c

This is done automatically with the pre-commit autoupdate command.

Revert version bump of the ansible-lint pre-commit hook

df57f2a

Newer versions of the hook require Python 3.14, but we are still using Python 3.13 in our GitHub Actions configuration.

Merge pull request #254 from cisagov/bug/adjust_gocritic_install

60c481a

Install the `go-critic` command instead of `gocritic` in the `build.yml` workflow

Merge pull request #255 from cisagov/improvement/update_flake8_config…

24bc1e0

…uration Add additional plugins to the `flake8` pre-commit configuration

Merge pull request #256 from cisagov/improvement/add_pre-commit_hook_…

5103fb6

…to_lock_terraform_providers Add a pre-commit hook to lock Terraform providers automatically

Merge pull request #259 from cisagov/maintenance/update_pre-commit_hooks

52df901

Update `pre-commit` hook versions

Merge pull request #253 from cisagov/improvement/remove_bandit_config…

72ac03a

…uration_file Remove the bandit configuration file

Merge remote-tracking branch 'skeleton/develop' into lineage/skeleton

529fe71

Rename TIMEOUT to timeout

8dd3691

This gets rid of an error from our flake8 pre-commit hook.

Rename i to _i

e849833

This gets rid of an error from our flake8 pre-commit hook.

Break up an overly long string

fe8e753

This gets rid of an error from our flake8 pre-commit hook.

Merge pull request #288 from cisagov/lineage/skeleton

51d33e8

⚠️ CONFLICT! Lineage pull request for: skeleton

github-actions bot added python Pull requests that update Python code test This issue or pull request adds or otherwise modifies test code labels Mar 27, 2026

mcdonnnj added 2 commits March 30, 2026 15:46

Merge github.com:cisagov/skeleton-docker into lineage/skeleton

531e93e

Satisfy the flake8 pre-commit hook

962166d

New line length findings require us to adjust the `src/email-updates.py` script.

mcdonnnj force-pushed the lineage/skeleton branch from 0d99449 to 962166d Compare March 30, 2026 19:47

mcdonnnj marked this pull request as ready for review March 30, 2026 20:23

mcdonnnj requested review from dav3r, felddy, jsf9k and mcdonnnj as code owners March 30, 2026 20:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

⚠️ CONFLICT! Lineage pull request for: skeleton#283

⚠️ CONFLICT! Lineage pull request for: skeleton#283
cisagovbot wants to merge 100 commits intodevelopfrom
lineage/skeleton

cisagovbot commented Mar 25, 2026 •

edited by mcdonnnj

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

cisagovbot commented Mar 25, 2026 • edited by mcdonnnj Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Lineage Pull Request: CONFLICT

How to resolve the conflicts

✅ Pre-approval checklist

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cisagovbot commented Mar 25, 2026 •

edited by mcdonnnj

Loading