fix: bump node from e67514e to 50c8e8c - #656
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
andris9
added a commit
that referenced
this pull request
Sep 13, 2026
… branch ref The image build did `COPY .git/refs/heads/master`, which tied it to one branch name. A checkout with no local master ref failed before the first build step with "failed to compute cache key: /.git/refs/heads/master: not found", and that is every pull_request build, because actions/checkout leaves the merge ref detached. So the docker_scan job had never once passed on a pull request since it was added in ad190d3. It went unnoticed because the only other pull requests are release-please branches, which the job's own `if:` skips - the dependabot node bump in #656 was the first real PR run. The ref was never a dependable file either: a fresh clone packs its refs away. The commit now arrives as EE_COMMIT_HASH, which update-info.sh already preferred. Passing it is not optional anywhere it matters, because the failure mode changes shape: update-info.sh writes `"commit": ""` rather than failing, which is right for its non-Docker callers (render.yaml supplies nothing) and wrong for an image that would then be unable to say what it was built from. So the Dockerfile requires it with a `${EE_COMMIT_HASH:?}` check, which fails a build run by hand just as loudly as one run by a workflow, and docker-smoke-test.sh asks the built image for its commit rather than trusting the wiring. All five build-push-action steps across the three workflows pass it; the two in release.yaml and deploy.yml matter most, since those publish. The ARG sits below `npm ci` on purpose. An ARG's value is part of the cache key of every RUN beneath it, confirmed against BuildKit, so grouping it with the other ARGs at the top of the stage - the obvious tidy-up - would rebuild the install layer on every commit. A guardrail pins the position, the requirement and the absence of any COPY out of .git, and it shares the Dockerfile COPY parser with test/dockerfile-cli-modules-test.js rather than adding a second, looser notion of what a COPY line is. update-info.sh loses its `.git/refs/heads/master` branch outright. It existed for the Docker build alone, nothing can reach it now, and it carried the same hardcoded branch name this change is removing. A .dockerignore comes with it. The Dockerfile copies an allowlist, so this is mostly about not shipping the working tree to the daemon, but two rules do reach the image: `**/.DS_Store` drops the static/.DS_Store that was being published, and keylog.txt - a TLS session key log that `npm run dev` writes - no longer reaches the build context or the layer cache. Verified end to end: a build without the arg fails with a message naming the fix, a build with it produces the right commit and passes the smoke test, and the image carries no .git, .env or keylog.txt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N4oTpFcgoZe2fGDiHQg5Yu
Bumps node from `e67514e` to `50c8e8c`. --- updated-dependencies: - dependency-name: node dependency-version: 24-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/docker/node-50c8e8c
branch
from
September 13, 2026 17:25
ab1e24b to
a91d412
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Cooldown could not be applied because no publication date was available from the registry.
Bumps node from
e67514eto50c8e8c.