feat: switch to Alpine base image and update package installation

Author: ChristophShyper

.dockerignore

@@ -7,4 +7,4 @@
 !README.md
 !entrypoint.sh
 !terraform-copy-vars.py
-!pip
+!alpine-packages.txt

Dockerfile

@@ -1,23 +1,21 @@
-FROM ubuntu:questing-20251217
-
-# Disable interactive mode
-ENV DEBIAN_FRONTEND=noninteractive
+FROM alpine:3.23.4
 
 # Copy all needed files
 COPY terraform-copy-vars.py entrypoint.sh /
+COPY alpine-packages.txt /tmp/alpine-packages.txt
 
 # Install needed packages
-SHELL ["/bin/bash", "-euxo", "pipefail", "-c"]
-# hadolint ignore=DL3008
-RUN chmod +x /entrypoint.sh ;\
-  apt-get update -y ;\
-  apt-get install --no-install-recommends -y \
-    bash \
-    git \
-    python3 \
-    python3-pip ;\
-  apt-get clean ;\
-  rm -rf /var/lib/apt/lists/*
+SHELL ["/bin/sh", "-euxo", "pipefail", "-c"]
+# hadolint ignore=DL3018
+RUN set -eux; \
+  xargs -r apk add --no-cache < /tmp/alpine-packages.txt; \
+  chmod +x /entrypoint.sh; \
+  python3 --version; \
+  pip3 --version; \
+  git --version; \
+  rm -rf /var/cache/*; \
+  rm -rf /root/.cache/*; \
+  rm -rf /tmp/*
 
 # Finish up
 CMD ["python3", "--version"]

Taskfile.cicd.yml

@@ -60,9 +60,9 @@ tasks:
       - task: scripts:lint:yamllint
 
   dependency:update:
-    desc: 'No-op: no dedicated dependency updater configured for this profile'
+    desc: Update repository dependencies not covered by Dependabot
     cmds:
-      - task: scripts:dependency:update
+      - task: scripts:packages:update
 
   version:set:
     desc: Update version in README.md and action.yml

Taskfile.scripts.yml

@@ -107,12 +107,9 @@ tasks:
         fi
 
   dependency:update:
-    desc: 'No-op: no dedicated dependency updater configured for this profile'
+    desc: Update dependency metadata for this repository
     cmds:
-      - |
-        echo "INFO: No dedicated dependency updater configured for this repository profile."
-        echo "INFO: Dependabot handles GitHub Actions and package metadata updates."
-        echo "INFO: Keep this task as a safe no-op until a repo-specific dependency updater is defined."
+      - task: packages:update
 
   version:get:
     desc: Get current version
@@ -287,7 +284,22 @@ tasks:
           exit 0
         fi
 
-        base_image="$(sed -nE 's/^FROM[[:space:]]+([^[:space:]]+).*/\1/p' Dockerfile | head -1)"
+        base_image="$(awk '
+          toupper($1) == "FROM" {
+            i = 2
+            while (i <= NF && $i ~ /^--/) {
+              i++
+            }
+            if (i <= NF) {
+              image = $i
+            }
+          }
+          END {
+            if (image != "") {
+              print image
+            }
+          }
+        ' Dockerfile)"
         if [ -z "$base_image" ]; then
           echo "INFO: Could not resolve base image; nothing to update"
           exit 0

alpine-packages.txt

@@ -0,0 +1,4 @@
+bash~=5.3
+git~=2.52
+python3~=3.12
+py3-pip~=25.1

tests/docker/local-image.yml

@@ -4,19 +4,22 @@ commandTests:
   - name: OS version check
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID="25\.10"]
+    expectedOutput: [VERSION_ID=3\.23]
 
   - name: Required tools installed
     command: bash
     args:
       - -lc
       - command -v bash >/dev/null 2>&1 && command -v python3 >/dev/null 2>&1 && command -v pip3 >/dev/null 2>&1 && command -v git >/dev/null 2>&1
 
-  - name: Apt cache cleaned
+  - name: Temporary and APK cache cleaned
     command: bash
     args:
       - -lc
-      - test ! -d /var/lib/apt/lists || test -z "$(find /var/lib/apt/lists -mindepth 1 -maxdepth 1 2>/dev/null)"
+      - >-
+        test ! -f /tmp/alpine-packages.txt &&
+        (test ! -d /var/cache/apk || test -z "$(find /var/cache/apk -mindepth 1 -maxdepth 1 2>/dev/null)") &&
+        (test ! -d /root/.cache || test -z "$(find /root/.cache -mindepth 1 -maxdepth 1 2>/dev/null)")
 
 fileExistenceTests:
   - name: entrypoint exists