ci: add Dependabot, and make the base image something it can actually see

.github/dependabot.yml

@@ -0,0 +1,39 @@
+# The plugin parent, the plugin BOM and the pinned Actions all move every few
+# weeks and nothing in this repository bumped them.
+#
+# Note that committing this file is not enough on a fork: Dependabot version
+# updates are off by default for forks and have to be enabled in the repository
+# settings.
+version: 2
+updates:
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: weekly
+      # Weekly Jenkins core and most BOM releases land Monday or Tuesday.
+      day: tuesday
+    open-pull-requests-limit: 5
+    groups:
+      # One PR for the BOM rather than one per managed plugin.
+      jenkins-bom:
+        patterns:
+          - "io.jenkins.tools.bom:*"
+      test-plugins:
+        patterns:
+          - "org.jenkins-ci.plugins.workflow:*"
+          - "org.jenkins-ci.plugins:scm-api"
+    labels: [dependencies]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels: [dependencies]
+
+  # The e2e base image. Its FROM line has to stay a literal image:tag for this
+  # to do anything -- see the comment in .github/e2e/Dockerfile.
+  - package-ecosystem: docker
+    directory: /.github/e2e
+    schedule:
+      interval: weekly
+    labels: [dependencies]

.github/e2e/.gitignore

@@ -1 +1,3 @@
 deploy-dashboard.hpi
+# Generated by the compatibility workflow when it retargets the base image.
+Dockerfile.weekly

.github/e2e/Dockerfile

@@ -3,10 +3,12 @@
 # Built rather than bind-mounted on purpose: `jenkins-plugin-cli` runs as the
 # `jenkins` user and cannot write into a host-owned mount, and the ref directory
 # has to be readable by that user for Jenkins to seed JENKINS_HOME from it.
-# Overridable so the compatibility workflow can run the same e2e against the
-# weekly line: docker build --build-arg JENKINS_IMAGE=jenkins/jenkins:latest-jdk21
-ARG JENKINS_IMAGE=jenkins/jenkins:lts-jdk21
-FROM ${JENKINS_IMAGE}
+# The tag is written out in full, and deliberately not behind an ARG.
+# Dependabot's Dockerfile parser matches a literal image:tag on the FROM line
+# and has no handling for ${VARIABLE}, so an ARG-indirected base image is
+# invisible to it and would never be bumped. The compatibility workflow tests
+# the weekly line by rewriting this line, and checks that the rewrite took.
+FROM jenkins/jenkins:2.568.3-jdk21
 
 # The plugin's own dependencies, resolved from the update centre exactly as they
 # would be for a real installation. Nothing is pinned: the point of this job is

.github/workflows/jenkins-compat.yml

@@ -146,11 +146,21 @@ jobs:
       - name: Package the plugin
         run: ./mvnw -B -ntp -DskipTests -Dspotbugs.skip package
 
+      # The base image used to come from an ARG so this job could override it
+      # with --build-arg. That made it invisible to Dependabot, which only
+      # parses a literal image:tag on a FROM line, so the pinned LTS tag would
+      # never have been bumped. The FROM is literal now and this job rewrites
+      # it -- and then checks the rewrite took, because the failure mode of
+      # getting that wrong is testing LTS twice while reporting it as weekly.
       - name: Build the weekly Jenkins with the plugin installed
         run: |
           set -euo pipefail
           cp target/*.hpi .github/e2e/deploy-dashboard.hpi
-          docker build --build-arg JENKINS_IMAGE=jenkins/jenkins:latest-jdk21 -t dd-e2e-weekly .github/e2e
+          sed 's|^FROM .*|FROM jenkins/jenkins:latest-jdk21|' \
+            .github/e2e/Dockerfile > .github/e2e/Dockerfile.weekly
+          grep -qx 'FROM jenkins/jenkins:latest-jdk21' .github/e2e/Dockerfile.weekly \
+            || { echo "::error::the weekly base image rewrite did not take; this job would silently retest LTS"; exit 1; }
+          docker build -f .github/e2e/Dockerfile.weekly -t dd-e2e-weekly .github/e2e
 
       - name: Start it
         run: docker run -d --name jenkins -p 8080:8080 dd-e2e-weekly