docker-base: alpine 3.17.0

.gitignore

@@ -20,3 +20,5 @@ atlantis.env
 # gitreleaser
 dist/
 tmp-CHANGELOG.md
+
+.envrc

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: build artifact
-FROM golang:1.19.3-alpine AS builder
+FROM golang:1.19.4-alpine AS builder
 
 WORKDIR /app
 COPY . /app
@@ -8,7 +8,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -v -o atlantis .
 
 # Stage 2
-# The runatlantis/atlantis-base is created by docker-base/Dockerfile.
+# The runatlantis/atlantis-base is created by docker-base/Dockerfile
 FROM ghcr.io/runatlantis/atlantis-base:2022.12.05 AS base
 
 # Get the architecture the image is being built for
@@ -38,7 +38,7 @@ RUN AVAILABLE_TERRAFORM_VERSIONS="1.0.11 1.1.9 1.2.9 ${DEFAULT_TERRAFORM_VERSION
     done && \
     ln -s "/usr/local/bin/tf/versions/${DEFAULT_TERRAFORM_VERSION}/terraform" /usr/local/bin/terraform
 
-ENV DEFAULT_CONFTEST_VERSION=0.35.0
+ENV DEFAULT_CONFTEST_VERSION=0.36.0
 
 RUN AVAILABLE_CONFTEST_VERSIONS="${DEFAULT_CONFTEST_VERSION}" && \
     case ${TARGETPLATFORM} in \

Dockerfile.dev

@@ -1,6 +1,6 @@
 FROM ghcr.io/runatlantis/atlantis:latest
 COPY atlantis /usr/local/bin/atlantis
 # TODO: remove this once we get this in the base image
-ENV DEFAULT_CONFTEST_VERSION=0.35.0
+ENV DEFAULT_CONFTEST_VERSION=0.36.0
 
 WORKDIR /atlantis/src

docker-base/Dockerfile

@@ -1,7 +1,7 @@
 # This Dockerfile builds our base image with gosu, dumb-init and the atlantis
 # user. We split this from the main Dockerfile because this base doesn't change
 # and also because it kept breaking the build due to flakiness.
-FROM alpine:3.16.3
+FROM alpine:3.17.0
 LABEL authors="Anubhav Mishra, Luke Kysow"
 
 # We use gosu to step down from root and run as the atlantis user so we need
@@ -26,19 +26,19 @@ ARG TARGETPLATFORM
 
 # Install packages needed for running Atlantis.
 RUN apk add --no-cache \
-        ca-certificates=20220614-r0 \
-        curl=7.83.1-r4 \
-        git=2.36.3-r0 \
-        unzip=6.0-r9 \
-        bash=5.1.16-r2 \
-        openssh=9.0_p1-r2 \
-        libcap=2.64-r0 \
-        dumb-init=1.2.5-r1 \
-        gcompat=1.0.0-r4 && \
+        ca-certificates=20220614-r2 \
+        curl=7.86.0-r1 \
+        git=2.38.1-r0 \
+        unzip=6.0-r13 \
+        bash=5.2.12-r0 \
+        openssh=9.1_p1-r1 \
+        libcap=2.66-r0 \
+        dumb-init=1.2.5-r2 \
+        gcompat=1.1.0-r0 && \
     # Install packages needed for building dependencies.
     apk add --no-cache --virtual .build-deps \
-        gnupg=2.2.35-r4 \
-        openssl=1.1.1s-r0 && \
+        gnupg=2.2.40-r0 \
+        openssl=3.0.7-r0 && \
     mkdir -p /tmp/build && \
     cd /tmp/build && \
     # git-lfs

server/controllers/events/events_controller_e2e_test.go

@@ -42,7 +42,7 @@ import (
 	. "github.com/runatlantis/atlantis/testing"
 )
 
-const ConftestVersion = "0.35.0"
+const ConftestVersion = "0.36.0"
 
 var applyLocker locking.ApplyLocker
 var userConfig server.UserConfig
@@ -64,8 +64,8 @@ func (m *NoopTFDownloader) GetAny(dst, src string, opts ...getter.ClientOption)
 type LocalConftestCache struct {
 }
 
-func (m *LocalConftestCache) Get(key *version.Version) (string, error) {
-	return exec.LookPath(fmt.Sprintf("conftest%s", ConftestVersion))
+func (m *LocalConftestCache) Get() (string, error) {
+	return exec.LookPath("conftest")
 }
 
 func TestGitHubWorkflow(t *testing.T) {
@@ -1362,16 +1362,16 @@ func mkSubDirs(t *testing.T) (string, string, string) {
 	return tmp, binDir, cachedir
 }
 
-// Will fail test if conftest isn't in path and isn't version >= 0.25.0
+// Will fail test if conftest isn't in path and isn't version >= 0.36.0
 func ensureRunningConftest(t *testing.T) {
-	localPath, err := exec.LookPath(fmt.Sprintf("conftest%s", ConftestVersion))
+	localPath, err := exec.LookPath("conftest")
 	if err != nil {
 		t.Logf("conftest >= %s must be installed to run this test", ConftestVersion)
 		t.FailNow()
 	}
 	versionOutBytes, err := exec.Command(localPath, "--version").Output() // #nosec
 	if err != nil {
-		t.Logf("error running conftest version: %s", err)
+		t.Logf("error running conftest --version: %s", err)
 		t.FailNow()
 	}
 	versionOutput := string(versionOutBytes)
@@ -1429,7 +1429,7 @@ var versionRegex = regexp.MustCompile("Terraform v(.*?)(\\s.*)?\n")
 
 /*
  * Newer versions will return both Conftest and OPA
- * Conftest: 0.35.0
- * OPA: 0.45.0
+ * Conftest: x.y.z
+ * OPA: x.y.z
  */
 var versionConftestRegex = regexp.MustCompile("Conftest: (.*?)(\\s.*)?\n")

testing/Dockerfile

@@ -14,7 +14,7 @@ RUN case $(uname -m) in x86_64|amd64) ARCH="amd64" ;; aarch64|arm64|armv7l) ARCH
     rm terraform.zip
 
 # Install conftest
-ENV CONFTEST_VERSION=0.35.0
+ENV CONFTEST_VERSION=0.36.0
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN case $(uname -m) in x86_64|amd64) ARCH="x86_64" ;; aarch64|arm64|armv7l) ARCH="arm64" ;; esac && \
     curl -LOs https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_${ARCH}.tar.gz && \