gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-26 10:16:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: daily cache-bust the Alpine apk upgrade layer (#491)

Browse Source 
The runtime stage's `apk upgrade --no-cache` layer was being reused from
the buildx gha/registry cache indefinitely, so newly-patched Alpine
packages (e.g. openssl CVE fixes) could sit behind a stale layer until
an unrelated Dockerfile change invalidated it by coincidence. This
surfaced as Trivy hard-failing on CVE-2026-28390 (libcrypto3/libssl3
DoS in CMS) on the github-app-token-migration PR, even though upstream
Alpine had already published 3.5.6-r0 with the fix.

Add an APK_CACHE_BUST build-arg that CI sets to the current UTC date
(YYYY-MM-DD). Each calendar day the arg value changes, which changes
the RUN layer's hash, which forces buildx to re-execute `apk upgrade`
and pick up whatever Alpine has published that day. All three build
invocations (PR docker-validate, release pre-publish scan, release
multi-arch push) pass the same value, so the scan and the published
artifact always share a layer and Trivy never scans stale bits.

Default value `unset` lets local developers `docker build` without
the arg; production CI always supplies the date.
This commit is contained in:
Anso
2026-04-10 15:44:40 -04:00
committed by GitHub
parent f2c13bf02d
commit bed7269c27
3 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+11 -1
View File
@@ -112,9 +112,19 @@ FROM node:22-alpine
ARG DOCKER_VERSION=29.3.1
ARG COMPOSE_VERSION=v5.1.1
# Daily cache-bust for the apk upgrade layer. CI passes the current date
# (YYYY-MM-DD) as a build-arg, so this RUN layer's hash changes at most
# once per calendar day. Without this, buildx reuses the cached layer
# indefinitely and a new Alpine package fix (e.g. an openssl CVE patched
# upstream in alpine 3.23) sits behind the stale cache until an unrelated
# change invalidates this line by coincidence. Default value lets local
# developers build without the arg; production CI always sets it.
ARG APK_CACHE_BUST=unset
# Upgrade all Alpine system packages, install runtime deps, then fetch Docker
# CLI + Compose plugin from official static binaries.
RUN apk upgrade --no-cache && \
RUN echo "apk cache bust: ${APK_CACHE_BUST}" && \
apk upgrade --no-cache && \
apk add --no-cache bash su-exec curl && \
ARCH=$(uname -m) && \
curl -fsSL "https://download.docker.com/linux/static/stable/${ARCH}/docker-${DOCKER_VERSION}.tgz" \