From 0e7e504aa057b5bf88565a77ae6ca24b9c98aab0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:11:04 +0000
Subject: [PATCH 01/12] Initial plan


From 231b7f9d128def510c292ffae52ec516cca3db02 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:13:28 +0000
Subject: [PATCH 02/12] feat: add workflow to update base-image after release

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 87 +++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 .github/workflows/update-base-image.yml

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
new file mode 100644
index 0000000..dd1b4ef
--- /dev/null
+++ b/.github/workflows/update-base-image.yml
@@ -0,0 +1,87 @@
+# This workflow automatically creates a PR on flanksource/base-image
+# to update the deps version after a release is published.
+#
+# Requirements:
+# - FLANKBOT_GITHUB_TOKEN secret must be configured with permissions to:
+#   - Read from flanksource/base-image
+#   - Create branches and PRs on flanksource/base-image
+#
+# The workflow will:
+# 1. Extract the version from the release tag
+# 2. Checkout flanksource/base-image
+# 3. Update the Dockerfile to reference the specific deps version
+# 4. Create a PR with the changes
+
+name: Update base-image
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  update-base-image:
+    name: Create PR to update deps in base-image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get release version
+        id: version
+        run: |
+          # Extract version from the release tag (remove 'v' prefix if present)
+          VERSION="${{ github.event.release.tag_name }}"
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
+          echo "Release version: $VERSION"
+
+      - name: Checkout base-image repository
+        uses: actions/checkout@v4
+        with:
+          repository: flanksource/base-image
+          token: ${{ secrets.FLANKBOT_GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Create branch and update Dockerfile
+        run: |
+          BRANCH="update-deps-${{ steps.version.outputs.version }}"
+          git checkout -b "$BRANCH"
+          
+          # Update the Dockerfile to use the specific version instead of latest
+          sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}.tar.gz|g' Dockerfile
+          
+          # Check if changes were made
+          if git diff --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+          
+          git add Dockerfile
+          git commit -m "chore: update deps to ${{ steps.version.outputs.version }}"
+          git push origin "$BRANCH"
+
+      - name: Create Pull Request
+        env:
+          GH_TOKEN: ${{ secrets.FLANKBOT_GITHUB_TOKEN }}
+        run: |
+          gh pr create \
+            --repo flanksource/base-image \
+            --title "chore: update deps to ${{ steps.version.outputs.version }}" \
+            --body "This PR updates the deps version to [${{ steps.version.outputs.version }}](https://github.com/flanksource/deps/releases/tag/${{ steps.version.outputs.tag }}) after the release.
+
+**Changes:**
+- Updates deps binary download URL to use version ${{ steps.version.outputs.version }}
+
+**Release Notes:**
+${{ github.event.release.body }}
+
+---
+*This PR was automatically created by the deps release workflow.*" \
+            --head "update-deps-${{ steps.version.outputs.version }}" \
+            --base main

From 8c1af9b23cc59ec25c38b7155e036bece98297e8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:14:25 +0000
Subject: [PATCH 03/12] docs: update RELEASE.md with base-image update workflow

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 docs/RELEASE.md | 32 +++++++++++++++++++++++---------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 7c9792a..e50405f 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -34,21 +34,35 @@ The release workflow will automatically trigger and create the GitHub release wi
 
 ## Workflow Files
 
-- `.github/workflows/auto-release.yml` - Automatic version bumping and tagging on main branch merges
-- `.github/workflows/release.yml` - GoReleaser workflow that triggers on tag pushes
-- `.goreleaser.yml` - GoReleaser configuration for building and releasing binaries
+- `.github/workflows/release.yml` - Automated release workflow that triggers on main branch pushes. Creates version tags and builds binaries.
+- `.github/workflows/update-base-image.yml` - Automatically creates a PR on flanksource/base-image to update the deps version after a release is published.
+- `.github/workflows/test.yml` - Unit and integration tests
+- `.github/workflows/test-action.yml` - Tests the GitHub Action functionality
+- `.github/workflows/golangci-lint.yml` - Code quality checks
 
 ## Version Calculation
 
-The auto-release workflow uses [svu](https://github.com/caarlos0/svu) to calculate the next version based on:
+The release workflow uses [svu](https://github.com/caarlos0/svu) to calculate the next version based on:
 
 1. Conventional commit messages since the last tag
 2. Current semantic version from the latest tag
-3. If no tags exist, starts with v0.1.0
+3. Automatically creates patch versions on every main branch push
 
-## Disabling Auto-Release
+## Cross-Repository Updates
 
-To skip auto-release for a specific merge, you can:
+After a release is published, the `update-base-image.yml` workflow automatically:
 
-1. Use commit messages that don't trigger version bumps (avoid feat/fix/breaking changes)
-2. Or temporarily disable the workflow by adding `[skip ci]` to commit messages
\ No newline at end of file
+1. Checks out the [flanksource/base-image](https://github.com/flanksource/base-image) repository
+2. Updates the Dockerfile to reference the specific deps version (instead of latest)
+3. Creates a pull request with:
+   - Version update in the Dockerfile
+   - Release notes from the deps release
+   - Link to the release
+
+**Requirements:**
+- A `FLANKBOT_GITHUB_TOKEN` secret must be configured in the repository with permissions to:
+  - Read from flanksource/base-image
+  - Create branches on flanksource/base-image
+  - Create pull requests on flanksource/base-image
+
+This ensures that base-image is kept up-to-date with the latest tested deps releases.

From 39d849acb948f16dd609600b5c7cea0adaedc2df Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:14:57 +0000
Subject: [PATCH 04/12] chore: add error handling to update-base-image workflow

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index dd1b4ef..3f35e12 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -51,6 +51,13 @@ jobs:
       - name: Create branch and update Dockerfile
         run: |
           BRANCH="update-deps-${{ steps.version.outputs.version }}"
+          
+          # Check if branch already exists
+          if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
+            echo "Branch $BRANCH already exists. Skipping."
+            exit 0
+          fi
+          
           git checkout -b "$BRANCH"
           
           # Update the Dockerfile to use the specific version instead of latest
@@ -70,6 +77,14 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.FLANKBOT_GITHUB_TOKEN }}
         run: |
+          BRANCH="update-deps-${{ steps.version.outputs.version }}"
+          
+          # Check if PR already exists
+          if gh pr list --repo flanksource/base-image --head "$BRANCH" --state open | grep -q .; then
+            echo "PR for branch $BRANCH already exists. Skipping."
+            exit 0
+          fi
+          
           gh pr create \
             --repo flanksource/base-image \
             --title "chore: update deps to ${{ steps.version.outputs.version }}" \

From a13b9e7bb9b15846c3b4571d258a55e62c3bda50 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:15:28 +0000
Subject: [PATCH 05/12] fix: improve messaging for edge case handling

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index 3f35e12..7544c24 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -54,7 +54,7 @@ jobs:
           
           # Check if branch already exists
           if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
-            echo "Branch $BRANCH already exists. Skipping."
+            echo "Branch $BRANCH already exists, skipping branch creation."
             exit 0
           fi
           
@@ -81,7 +81,7 @@ jobs:
           
           # Check if PR already exists
           if gh pr list --repo flanksource/base-image --head "$BRANCH" --state open | grep -q .; then
-            echo "PR for branch $BRANCH already exists. Skipping."
+            echo "PR for branch $BRANCH already exists, skipping PR creation."
             exit 0
           fi
           

From 05365145bfa7c8f64a23e626163cc65c46c9350e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:16:14 +0000
Subject: [PATCH 06/12] fix: improve robustness of workflow checks and
 validation

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index 7544c24..2fcceef 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -52,8 +52,8 @@ jobs:
         run: |
           BRANCH="update-deps-${{ steps.version.outputs.version }}"
           
-          # Check if branch already exists
-          if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
+          # Check if branch already exists (exact match to avoid false positives)
+          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/$BRANCH$"; then
             echo "Branch $BRANCH already exists, skipping branch creation."
             exit 0
           fi
@@ -63,6 +63,13 @@ jobs:
           # Update the Dockerfile to use the specific version instead of latest
           sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}.tar.gz|g' Dockerfile
           
+          # Verify that the substitution occurred
+          if ! grep -q "https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-" Dockerfile; then
+            echo "Error: Failed to update Dockerfile with version ${{ steps.version.outputs.tag }}"
+            echo "The Dockerfile URL format may have changed."
+            exit 1
+          fi
+          
           # Check if changes were made
           if git diff --quiet; then
             echo "No changes to commit"
@@ -79,8 +86,9 @@ jobs:
         run: |
           BRANCH="update-deps-${{ steps.version.outputs.version }}"
           
-          # Check if PR already exists
-          if gh pr list --repo flanksource/base-image --head "$BRANCH" --state open | grep -q .; then
+          # Check if PR already exists (using json output for robustness)
+          PR_COUNT=$(gh pr list --repo flanksource/base-image --head "$BRANCH" --state open --json number --jq 'length')
+          if [ "$PR_COUNT" -gt 0 ]; then
             echo "PR for branch $BRANCH already exists, skipping PR creation."
             exit 0
           fi

From 60d2a46a3e558618975af977c7ddd16cf0e025ff Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:16:46 +0000
Subject: [PATCH 07/12] fix: improve verification pattern for Dockerfile URL
 update

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index 2fcceef..fb16e4a 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -61,12 +61,16 @@ jobs:
           git checkout -b "$BRANCH"
           
           # Update the Dockerfile to use the specific version instead of latest
+          # Expected current format: https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz
+          # Expected new format: https://github.com/flanksource/deps/releases/download/<TAG>/deps-linux-${TARGETARCH}.tar.gz
           sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}.tar.gz|g' Dockerfile
           
-          # Verify that the substitution occurred
-          if ! grep -q "https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-" Dockerfile; then
+          # Verify that the substitution occurred by checking the complete URL pattern
+          if ! grep -q "https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-\${TARGETARCH}\.tar\.gz" Dockerfile; then
             echo "Error: Failed to update Dockerfile with version ${{ steps.version.outputs.tag }}"
             echo "The Dockerfile URL format may have changed."
+            echo "Current Dockerfile content:"
+            cat Dockerfile
             exit 1
           fi
           

From 2db67fb47ccfd1a9d656f19016c0a20dcca9549d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:17:23 +0000
Subject: [PATCH 08/12] fix: correct variable expansion and quoting in grep
 patterns

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index fb16e4a..d777c93 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -53,7 +53,7 @@ jobs:
           BRANCH="update-deps-${{ steps.version.outputs.version }}"
           
           # Check if branch already exists (exact match to avoid false positives)
-          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/$BRANCH$"; then
+          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/${BRANCH}$"; then
             echo "Branch $BRANCH already exists, skipping branch creation."
             exit 0
           fi
@@ -66,7 +66,8 @@ jobs:
           sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}.tar.gz|g' Dockerfile
           
           # Verify that the substitution occurred by checking the complete URL pattern
-          if ! grep -q "https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-\${TARGETARCH}\.tar\.gz" Dockerfile; then
+          # The Dockerfile contains literal ${TARGETARCH} (Docker build arg, not shell variable)
+          if ! grep -q 'https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}\.tar\.gz' Dockerfile; then
             echo "Error: Failed to update Dockerfile with version ${{ steps.version.outputs.tag }}"
             echo "The Dockerfile URL format may have changed."
             echo "Current Dockerfile content:"

From 9bf05aed5aa319cd3413e162c678f3d2c25f3a15 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:18:24 +0000
Subject: [PATCH 09/12] fix: properly escape dollar signs in sed and grep
 patterns

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index d777c93..3f40582 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -63,11 +63,12 @@ jobs:
           # Update the Dockerfile to use the specific version instead of latest
           # Expected current format: https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz
           # Expected new format: https://github.com/flanksource/deps/releases/download/<TAG>/deps-linux-${TARGETARCH}.tar.gz
-          sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}.tar.gz|g' Dockerfile
+          # Note: \${TARGETARCH} is a literal string in the Dockerfile (Docker build arg), not a shell variable
+          sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-\${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-\${TARGETARCH}.tar.gz|g' Dockerfile
           
           # Verify that the substitution occurred by checking the complete URL pattern
           # The Dockerfile contains literal ${TARGETARCH} (Docker build arg, not shell variable)
-          if ! grep -q 'https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-${TARGETARCH}\.tar\.gz' Dockerfile; then
+          if ! grep -q 'https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-\${TARGETARCH}\.tar\.gz' Dockerfile; then
             echo "Error: Failed to update Dockerfile with version ${{ steps.version.outputs.tag }}"
             echo "The Dockerfile URL format may have changed."
             echo "Current Dockerfile content:"

From baa256d8b007cb3ea231d0949627679a5b9728af Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:19:15 +0000
Subject: [PATCH 10/12] fix: use variables and double quotes for proper GitHub
 Actions expansion

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index 3f40582..3cc6743 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -51,9 +51,10 @@ jobs:
       - name: Create branch and update Dockerfile
         run: |
           BRANCH="update-deps-${{ steps.version.outputs.version }}"
+          TAG="${{ steps.version.outputs.tag }}"
           
           # Check if branch already exists (exact match to avoid false positives)
-          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/${BRANCH}$"; then
+          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/$BRANCH\$"; then
             echo "Branch $BRANCH already exists, skipping branch creation."
             exit 0
           fi
@@ -64,12 +65,12 @@ jobs:
           # Expected current format: https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz
           # Expected new format: https://github.com/flanksource/deps/releases/download/<TAG>/deps-linux-${TARGETARCH}.tar.gz
           # Note: \${TARGETARCH} is a literal string in the Dockerfile (Docker build arg), not a shell variable
-          sed -i 's|https://github.com/flanksource/deps/releases/latest/download/deps-linux-\${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-\${TARGETARCH}.tar.gz|g' Dockerfile
+          sed -i "s|https://github.com/flanksource/deps/releases/latest/download/deps-linux-\${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${TAG}/deps-linux-\${TARGETARCH}.tar.gz|g" Dockerfile
           
           # Verify that the substitution occurred by checking the complete URL pattern
           # The Dockerfile contains literal ${TARGETARCH} (Docker build arg, not shell variable)
-          if ! grep -q 'https://github.com/flanksource/deps/releases/download/${{ steps.version.outputs.tag }}/deps-linux-\${TARGETARCH}\.tar\.gz' Dockerfile; then
-            echo "Error: Failed to update Dockerfile with version ${{ steps.version.outputs.tag }}"
+          if ! grep -q "https://github.com/flanksource/deps/releases/download/${TAG}/deps-linux-\${TARGETARCH}\.tar\.gz" Dockerfile; then
+            echo "Error: Failed to update Dockerfile with version ${TAG}"
             echo "The Dockerfile URL format may have changed."
             echo "Current Dockerfile content:"
             cat Dockerfile

From 90e56ae499e6d2f34238bd8bcb087e10f632ca39 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:19:45 +0000
Subject: [PATCH 11/12] fix: remove incorrect backslash before end-of-line
 anchor

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index 3cc6743..28f16d9 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -54,7 +54,7 @@ jobs:
           TAG="${{ steps.version.outputs.tag }}"
           
           # Check if branch already exists (exact match to avoid false positives)
-          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/$BRANCH\$"; then
+          if git ls-remote --heads origin "$BRANCH" | grep -q "refs/heads/$BRANCH$"; then
             echo "Branch $BRANCH already exists, skipping branch creation."
             exit 0
           fi

From 2077780348ef34e6b349a1c5ce95f37e57e843e8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 5 Feb 2026 07:20:36 +0000
Subject: [PATCH 12/12] refactor: improve maintainability with URL pattern
 variables

Co-authored-by: moshloop <1489660+moshloop@users.noreply.github.com>
---
 .github/workflows/update-base-image.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-base-image.yml b/.github/workflows/update-base-image.yml
index 28f16d9..333f780 100644
--- a/.github/workflows/update-base-image.yml
+++ b/.github/workflows/update-base-image.yml
@@ -65,13 +65,18 @@ jobs:
           # Expected current format: https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz
           # Expected new format: https://github.com/flanksource/deps/releases/download/<TAG>/deps-linux-${TARGETARCH}.tar.gz
           # Note: \${TARGETARCH} is a literal string in the Dockerfile (Docker build arg), not a shell variable
-          sed -i "s|https://github.com/flanksource/deps/releases/latest/download/deps-linux-\${TARGETARCH}.tar.gz|https://github.com/flanksource/deps/releases/download/${TAG}/deps-linux-\${TARGETARCH}.tar.gz|g" Dockerfile
+          
+          CURRENT_URL='https://github.com/flanksource/deps/releases/latest/download/deps-linux-${TARGETARCH}.tar.gz'
+          NEW_URL="https://github.com/flanksource/deps/releases/download/${TAG}/deps-linux-\${TARGETARCH}.tar.gz"
+          
+          sed -i "s|${CURRENT_URL}|${NEW_URL}|g" Dockerfile
           
           # Verify that the substitution occurred by checking the complete URL pattern
           # The Dockerfile contains literal ${TARGETARCH} (Docker build arg, not shell variable)
-          if ! grep -q "https://github.com/flanksource/deps/releases/download/${TAG}/deps-linux-\${TARGETARCH}\.tar\.gz" Dockerfile; then
+          if ! grep -q "${NEW_URL}" Dockerfile; then
             echo "Error: Failed to update Dockerfile with version ${TAG}"
             echo "The Dockerfile URL format may have changed."
+            echo "Expected to find: ${NEW_URL}"
             echo "Current Dockerfile content:"
             cat Dockerfile
             exit 1