From 100a2945eced651a02da8a781da392566d62312e Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Jan 2026 12:36:09 +0000 Subject: [PATCH 1/3] chore: derive IMAGE_VERSION from Dockerfile Instead of hardcoding the IMAGE_VERSION in the workflow, extract RUST_VERSION and NODE_VERSION from the Dockerfile and construct the image version dynamically. This ensures the workflow always stays in sync with the Dockerfile. --- .github/workflows/docker-build-push.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml index 91c8425..022c738 100644 --- a/.github/workflows/docker-build-push.yml +++ b/.github/workflows/docker-build-push.yml @@ -12,13 +12,22 @@ jobs: build: runs-on: ubuntu-latest - env: - IMAGE_VERSION: bookworm_rust_1.88-node_22.17.1 - steps: - name: Checkout code uses: actions/checkout@v2 + - name: Extract versions from Dockerfile + id: versions + run: | + RUST_VERSION=$(grep -E '^[[:space:]]*RUST_VERSION=' Dockerfile | head -1 | cut -d'=' -f2) + NODE_VERSION=$(grep -E '^ENV NODE_VERSION' Dockerfile | head -1 | awk '{print $3}') + IMAGE_VERSION="bookworm_rust_${RUST_VERSION}-node_${NODE_VERSION}" + echo "rust_version=${RUST_VERSION}" >> $GITHUB_OUTPUT + echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT + echo "image_version=${IMAGE_VERSION}" >> $GITHUB_OUTPUT + echo "Detected versions: Rust ${RUST_VERSION}, Node ${NODE_VERSION}" + echo "Image version: ${IMAGE_VERSION}" + - name: Set up Docker Buildx uses: docker/setup-buildx-action@v1 @@ -32,7 +41,7 @@ jobs: docker buildx create --use if [ "${{ github.event_name }}" = "push" ]; then docker buildx build --push \ - --tag ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ env.IMAGE_VERSION }} \ + --tag ghcr.io/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ steps.versions.outputs.image_version }} \ --platform linux/amd64,linux/arm64 . else docker buildx build \ From 89bab4923c7272cc0c2c0ca9d72c7c1fd1db1b75 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Jan 2026 12:39:19 +0000 Subject: [PATCH 2/3] ci: add validation step for extracted Dockerfile versions Adds a CI step that validates the extracted RUST_VERSION and NODE_VERSION match expected patterns before proceeding with the build. This ensures PRs will fail early if the Dockerfile format changes in a way that breaks version extraction. --- .github/workflows/docker-build-push.yml | 37 +++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml index 022c738..786e832 100644 --- a/.github/workflows/docker-build-push.yml +++ b/.github/workflows/docker-build-push.yml @@ -28,6 +28,43 @@ jobs: echo "Detected versions: Rust ${RUST_VERSION}, Node ${NODE_VERSION}" echo "Image version: ${IMAGE_VERSION}" + - name: Validate extracted versions + run: | + RUST_VERSION="${{ steps.versions.outputs.rust_version }}" + NODE_VERSION="${{ steps.versions.outputs.node_version }}" + IMAGE_VERSION="${{ steps.versions.outputs.image_version }}" + + # Check RUST_VERSION is not empty and matches version pattern + if [ -z "$RUST_VERSION" ]; then + echo "::error::Failed to extract RUST_VERSION from Dockerfile" + exit 1 + fi + if ! echo "$RUST_VERSION" | grep -qE '^[0-9]+\.[0-9]+'; then + echo "::error::RUST_VERSION '$RUST_VERSION' does not match expected pattern (e.g., 1.88)" + exit 1 + fi + + # Check NODE_VERSION is not empty and matches version pattern + if [ -z "$NODE_VERSION" ]; then + echo "::error::Failed to extract NODE_VERSION from Dockerfile" + exit 1 + fi + if ! echo "$NODE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then + echo "::error::NODE_VERSION '$NODE_VERSION' does not match expected pattern (e.g., 22.17.1)" + exit 1 + fi + + # Validate final image version format + if ! echo "$IMAGE_VERSION" | grep -qE '^bookworm_rust_[0-9]+\.[0-9]+-node_[0-9]+\.[0-9]+\.[0-9]+$'; then + echo "::error::IMAGE_VERSION '$IMAGE_VERSION' does not match expected format" + exit 1 + fi + + echo "Validation passed:" + echo " RUST_VERSION: $RUST_VERSION" + echo " NODE_VERSION: $NODE_VERSION" + echo " IMAGE_VERSION: $IMAGE_VERSION" + - name: Set up Docker Buildx uses: docker/setup-buildx-action@v1 From 41862f67a043d0ebca65ac811b815a4b7d484acd Mon Sep 17 00:00:00 2001 From: Ben White Date: Wed, 14 Jan 2026 13:48:45 +0100 Subject: [PATCH 3/3] fix: upgrade Node.js to 22.22.0 for DoS vulnerability (#13) Addresses the async hooks stack space exhaustion vulnerability documented at nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks This is a security release that fixes a denial-of-service issue affecting React, Next.js, and APM users. Co-authored-by: Claude --- Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 31817ef..57b99eb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -45,12 +45,13 @@ RUN ((cat /etc/os-release | grep ID | grep alpine) && apk add --no-cache musl-de && rm -rf $CARGO_HOME/registry/ # ---------------------- -# node 22.17.1 via https://github.com/nodejs/docker-node/blob/main/22/bookworm/Dockerfile +# node 22.22.0 via https://github.com/nodejs/docker-node/blob/main/22/bookworm/Dockerfile +# security fix: https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks # ---------------------- RUN groupadd --gid 1000 node \ && useradd --uid 1000 --gid node --shell /bin/bash --create-home node -ENV NODE_VERSION 22.17.1 +ENV NODE_VERSION 22.22.0 RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \ && case "${dpkgArch##*-}" in \