From a19eba6f87d83aab451c090a096a85fa2d205492 Mon Sep 17 00:00:00 2001
From: Marko Bevc <marko@kosli.com>
Date: Mon, 26 Oct 2026 10:02:25 +0000
Subject: [PATCH] ci: show what changed inside the builder image on Dependabot
 docker bumps

A digest bump of golang:1.26.10-alpine3.23 reads as two hashes. The last
one (#1303) was an Alpine 3.23.7 rebuild that moved the CA bundle the
final image ships, and nothing in the PR said so.

The dependency-review job now pulls the base and PR builder images and
writes a before/after table of Alpine release, Go version and installed
packages to the job summary and to builder-image.md. The Claude review
puts that table at the top of its comment instead of guessing.
---
 .github/workflows/claude-pr-review.yml | 48 +++++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index f2ac1a891..0c4f46712 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -34,6 +34,48 @@ jobs:
         with:
           fetch-depth: 0
 
+      # A digest bump says nothing by itself. Pull both images and report what
+      # differs inside them, so the review states facts instead of guessing.
+      - name: Describe the builder image change
+        if: startsWith(github.head_ref, 'dependabot/docker/')
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          builder_ref() { sed -n 's/^FROM \(golang:[^ ]*\) AS builder$/\1/p'; }
+          old=$(git show "$BASE_SHA:Dockerfile" | builder_ref)
+          new=$(builder_ref < Dockerfile)
+
+          facts() {
+            docker run --rm "$1" sh -c '
+              echo "Alpine $(cat /etc/alpine-release)"
+              echo "Go $(go version | cut -d" " -f3)"
+              apk list -I 2>/dev/null | cut -d" " -f1 | sort | sed "s/^/pkg /"'
+          }
+          facts "$old" > old.txt
+          facts "$new" > new.txt
+
+          {
+            echo "### Builder image: what changed"
+            echo
+            echo "| | base | PR |"
+            echo "|---|---|---|"
+            for k in Alpine Go; do
+              printf '| %s | %s | %s |\n' "$k" \
+                "$(awk -v k="$k" '$1==k{print $2}' old.txt)" \
+                "$(awk -v k="$k" '$1==k{print $2}' new.txt)"
+            done
+            echo
+            echo "<details><summary>Package changes</summary>"
+            echo
+            echo '```diff'
+            # diff exits 1 on differences, which pipefail would turn into a failure.
+            { diff old.txt new.txt || true; } | sed -n 's/^< pkg /-/p; s/^> pkg /+/p'
+            echo '```'
+            echo "</details>"
+          } > builder-image.md
+          cat builder-image.md >> "$GITHUB_STEP_SUMMARY"
+
       - name: Claude review (dependency updates)
         uses: anthropics/claude-code-action@v1.0.261
 
@@ -48,13 +90,17 @@ jobs:
             --max-turns 40
             --max-budget-usd 5
             --model claude-opus-5-5
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read"
           prompt: |
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}
 
             This PR updates dependencies. Please:
 
+            If `builder-image.md` exists, put its contents verbatim at the top of your
+            summary comment. It is the measured difference between the old and new
+            builder images; do not guess at what a digest bump contains.
+
             1. Identify which dependencies changed.
             2. For each changed dependency, consider changelogs, release notes, and semver: look for breaking changes, deprecations, and behavior changes that could affect this codebase.
             3. Search the repo for how each upgraded dependency is used (imports, config, APIs). Flag any usage that might break or behave differently after the upgrade.