mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
bed7269c27
The runtime stage's `apk upgrade --no-cache` layer was being reused from the buildx gha/registry cache indefinitely, so newly-patched Alpine packages (e.g. openssl CVE fixes) could sit behind a stale layer until an unrelated Dockerfile change invalidated it by coincidence. This surfaced as Trivy hard-failing on CVE-2026-28390 (libcrypto3/libssl3 DoS in CMS) on the github-app-token-migration PR, even though upstream Alpine had already published 3.5.6-r0 with the fix. Add an APK_CACHE_BUST build-arg that CI sets to the current UTC date (YYYY-MM-DD). Each calendar day the arg value changes, which changes the RUN layer's hash, which forces buildx to re-execute `apk upgrade` and pick up whatever Alpine has published that day. All three build invocations (PR docker-validate, release pre-publish scan, release multi-arch push) pass the same value, so the scan and the published artifact always share a layer and Trivy never scans stale bits. Default value `unset` lets local developers `docker build` without the arg; production CI always supplies the date.