[migmartri]

Upgrades Atlas from v1.3.4 to v1.3.8: the migrations container image, the CLI version installed by make init, and the version used in the test workflow.

Adds a docker ecosystem entry to the Dependabot configuration so Atlas image upgrades are proposed automatically (weekly, with a 7-day cooldown). The golang image stays ignored because Go upgrades are coordinated with go.mod through the upgrading-golang skill. The Atlas image is now pinned by tag and digest so Dependabot can resolve its version. Dependabot only updates the image, so ATLAS_VERSION in common.mk and .github/workflows/test.yml still has to be bumped in the same PR.

AI disclosure: this change was made with assistance from Claude Code.

[chainloop-platform]

PR validation — ⚠️ 1 failing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
⚠️ Failed	pr-user-story-linked	pr-info	PR/MR #3796 does not reference a user story or issue in title, description, or branch 'chore(migrations): upgrade atlas to v1.3.8 and track it with dependabot'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)gh-[0-9]+", "(?i)\\[[A-Z]+-[0-9]+\\]"]

_{View attestation ↗}

AI Session Checks — 🟢 90% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 90%	1	✅ 0	100% AI / 0% Human	7	+35 / -23	2m32s

🟢 90% — 100% AI — ✅ All policies passing

Nov 7, 2026 08:07 UTC · 2m32s · $1.83 · 58 in / 19.3k out · claude-code 2.1.319 (claude-opus-5-5)

_{View session details ↗}

Change Summary

Updates the migrations container image while preserving digest pinning. Synchronizes local and CI tool versions with the upgraded image.

AI Session Overall Score

🟢 90% — Focused, accurately reported upgrade with a successful image smoke test but limited deeper validation.

AI Session Analysis Breakdown

🟢 96% · scope-discipline

No notes.

🟢 95% · solution-quality

🟢 The image remains pinned to the inspected digest instead of switching to a mutable tag. · High Impact

🟢 94% · alignment

🟢 The completion summary accurately identifies all three version updates and the successful image build. · High Impact

🟢 93% · user-trust-signal

No notes.

🟢 92% · context-and-planning

No notes.

🟡 76% · verification

🟢 The assistant builds the modified migrations image and runs it, observing the expected new version. · High Impact

🟠 Validation stops at build and version output; no database migration exercise or vulnerability scan is captured. · Medium Severity

💡 For image upgrades, run a disposable-database migration smoke test and a vulnerability scan alongside the build and version check.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	.github/dependabot.yml	+27 / -0
modified	ai	.claude/skills/upgrading-golang/SKILL.md	+2 / -8
modified	ai	.claude/skills/vulnerability-remediation/SKILL.md	+2 / -5
modified	ai	.claude/skills/upgrading-golang/files-to-update.md	+1 / -4
modified	ai	app/controlplane/Dockerfile.migrations	+1 / -4
modified	ai	.github/workflows/test.yml	+1 / -1
modified	ai	common.mk	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-96368e	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-96368e	-
✅ Passed	ai-config-no-secrets	ai-coding-session-96368e	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-96368e	-

Security Checks — ✅ 7 passing

✅ Nothing this change touches re-opens a recorded security fix.

_{View in Chainloop ↗ · How this works ↗}
✅ Nothing this change touches re-opens a recorded security fix.

_{View in Chainloop ↗ · How this works ↗}
✅ Nothing this change touches re-opens a recorded security fix.

_{View in Chainloop ↗ · How this works ↗}
✅ Nothing this change touches re-opens a recorded security fix.

_{View in Chainloop ↗ · How this works ↗}

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ github-actions-scan

Status	Policy	Messages
✅ Passed	ci-pipeline-security	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scan not applied (1)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed

_{View attestation ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 3 files

_{View guided diff | Re-trigger cubic}

[cubic-dev-ai]

1 issue found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".claude/skills/upgrading-golang/files-to-update.md">

<violation number="1" location=".claude/skills/upgrading-golang/files-to-update.md:44">
P2: Dropping the verification steps leaves this reference without a way to confirm that the Atlas digest matches the tag. Since Docker resolves the image by digest, a stale or wrong tag is silently ignored. Keep a verification step in the reference, for example `docker run arigaio/atlas:X.XX.X@sha256:DIGEST version`, and confirm it reports the same version as `ATLAS_VERSION`.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>