Update alpine Docker tag to v3.23

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
alpine	final	minor	3.18 → 3.23

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[augmentcode]

🤖 Augment PR Summary

Summary: Updates the base image used by the scaffolder cookiecutter Dockerfile from Alpine 3.18 to 3.23.
Why: Keeps the generated container environment on a newer Alpine release (security/bugfix updates in the 3.x line).

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

alpine:3.23 is a floating minor tag, so the underlying image can change as 3.23.x patch releases roll forward and make generated builds less reproducible. If deterministic builds matter here, consider pinning to a patch tag (or image digest) instead.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

This PR updates the Cookiecutter Dockerfile base image to Alpine Linux 3.23 for improved security and package freshness.

• Bumped alpine:3.18 to alpine:3.23 in plugins/scaffolder-backend/scripts/Cookiecutter.dockerfile
• Ensures the Cookiecutter scaffold environment receives the latest Alpine security patches and package updates

---

Confidence Score: 2/5 - Changes Needed

Not safe to merge — while the intent to upgrade Alpine from 3.18 to 3.23 for security patches is sound, the apk add command in Cookiecutter.dockerfile references Python 2 packages (python, python-dev, py-pip) that were removed from Alpine long before version 3.23, meaning the image build will fail entirely with 'package not found' errors. The PR cannot achieve its stated goal until the package names are updated to their Python 3 equivalents: python3, python3-dev, and py3-pip. This is a straightforward fix, but as written the Dockerfile is broken and will prevent any Cookiecutter scaffolding from functioning.

Key Findings:

• The apk add invocation in Cookiecutter.dockerfile installs python, python-dev, and py-pip — all Python 2 package names that Alpine dropped years ago and are definitively absent in Alpine 3.23, causing a hard build failure.
• The version bump from alpine:3.18 to alpine:3.23 is a legitimate and desirable security improvement, but the accompanying package list was not updated to reflect Alpine's Python 3-only ecosystem in modern releases.
• No runtime fallback or error handling exists in the Dockerfile to surface this failure gracefully — the broken image will silently block all Cookiecutter scaffold operations in the Backstage scaffolder plugin.

Files requiring special attention

• plugins/scaffolder-backend/scripts/Cookiecutter.dockerfile

[entelligence-ai-pr-reviews]

Walkthrough

This update bumps the base Docker image used in the Cookiecutter scaffold environment from Alpine Linux 3.18 to Alpine Linux 3.23. The change ensures the environment benefits from the latest security patches and package updates available in the newer Alpine release.

Changes

File(s)	Summary
plugins/scaffolder-backend/scripts/Cookiecutter.dockerfile	Updated base image from alpine:3.18 to alpine:3.23 to incorporate latest security patches and package updates.

Sequence Diagram

This diagram shows the interactions between components:

sequenceDiagram
    participant Dev as Developer
    participant Docker as Docker Build
    participant Registry as Container Registry

    Dev->>Docker: docker build
    Note over Docker: FROM alpine:3.23
    Docker->>Registry: Pull alpine:3.23
    Registry-->>Docker: Alpine 3.23 image layers
    Docker->>Docker: RUN apk add git and dependencies
    Docker-->>Dev: Image built successfully

Loading

---

🔗 Cross-Repository Impact Analysis

Enable automatic detection of breaking changes across your dependent repositories. → Set up now

Learn more about Cross-Repository Analysis

What It Does

• Automatically identifies repositories that depend on this code
• Analyzes potential breaking changes across your entire codebase
• Provides risk assessment before merging to prevent cross-repo issues

How to Enable

1. Visit Settings → Code Management
2. Configure repository dependencies
3. Future PRs will automatically include cross-repo impact analysis!

Benefits

• 🛡️ Prevent breaking changes across repositories
• 🔍 Catch integration issues before they reach production
• 📊 Better visibility into your multi-repo architecture

---

[entelligence-ai-pr-reviews]

Correctness: Alpine dropped Python 2 packages (python, python-dev, py-pip) well before 3.23 — the apk add step will fail with 'package not found', breaking the image build entirely; replace them with python3, python3-dev, and py3-pip.

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

In plugins/scaffolder-backend/scripts/Cookiecutter.dockerfile, the base image was bumped to alpine:3.23 but the RUN command still references Python 2 packages (python, python-dev, py-pip) which no longer exist in Alpine 3.23. Replace 'python' with 'python3', 'python-dev' with 'python3-dev', 'py-pip' with 'py3-pip', and update the 'apk del' line accordingly. Also update any 'pip install' call to 'pip3 install' to ensure the correct Python 3 pip is used.

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!