webgrip/infrastructure
5
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases 102 Packages Wiki Activity Actions

fix(node-ci-runner): pin the base to a digest #107

Merged
ryangr0 merged 1 commit from fix/node-ci-runner-pin-base into main 2026-08-08 12:27:33 +00:00
Conversation 0 Commits 1 Files changed 1 +5 -1
ryangr0 commented 2026-08-08 06:32:12 +00:00
Owner
Copy link

node:24-alpine floated: every upstream rebuild silently changed what this image is built from, so a CVE budget measured against it describes a base that may no longer exist. Pinned at the digest the tag resolves to today — the image is unchanged; this pins what already is. Annotated for the digest-aware Renovate manager (#106).

Part of Phase 1 of the hardening plan: no budget lands on a floating tag.

Generated with Claude Code

node:24-alpine floated: every upstream rebuild silently changed what this image is built from, so a CVE budget measured against it describes a base that may no longer exist. Pinned at the digest the tag resolves to today — the image is unchanged; this pins what already is. Annotated for the digest-aware Renovate manager (#106). Part of Phase 1 of the hardening plan: no budget lands on a floating tag. Generated with [Claude Code](https://claude.com/claude-code)
fix(node-ci-runner): pin the base to a digest
All checks were successful
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 7s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 1m9s
Details
[Workflow] On Source Change / Determine changed images (push) Successful in 0s
Details
[Workflow] On Source Change / Resolve release matrix (push) Successful in 19s
Details
[Workflow] On Source Change / Build check (node-ci-runner, ops/docker/node-ci-runner) (push) Successful in 1m4s
Details
[Workflow] On Source Change / Release (node-ci-runner, ops/docker/node-ci-runner) (push) Has been skipped
Details
0cc2c23722 
node:24-alpine floats: every upstream rebuild silently changes what this image
is built from, so a CVE budget measured against it describes a base that may
no longer exist. Wave 3 sets budgets for every image; a budget on a floating
tag is a number about the past.

Same digest the tag resolves to today, so the image is unchanged — this pins
what already is. Annotated for the digest-aware Renovate manager (#106).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

  
released
No labels
pull-request
released
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/infrastructure!107
No description provided.