feat: publish deploy base images to DockerHub - #4581
Conversation
Deployed task containers will build on triggerdotdev/node:<major>-bookworm and triggerdotdev/bun:<line>-bookworm (plus -build toolchain variants) instead of installing system packages during every project's build, so worker nodes cache one shared package layer for the whole fleet. Tags are mutable and rebuilt weekly for Debian security updates; the CLI pins digests. Packages install from a recorded Debian snapshot timestamp so any published digest can be rebuilt and verified, and every publish carries a GitHub build provenance attestation.
SHA-pin every action and the QEMU binfmt image, scope permissions to the publish job, validate the snapshot dispatch input and images.json values before they reach shell or build args, and stop persisting git credentials in checkouts. Publish with SOURCE_DATE_EPOCH and rewrite-timestamp so published layers are reproducible from the recorded inputs, as the README claims; make the package list build args required so images.json stays the single source of truth. Add GHA layer caching, job timeouts, and skip the digest summary on pull request runs where no digest exists.
…rate verification docs Upgrade all preinstalled packages to the pinned snapshot state so weekly rebuilds refresh every Debian package rather than only the added ones, and so the runtime and -build variants carry the same library versions. Derive SOURCE_DATE_EPOCH from the snapshot so registries show a meaningful created date while builds stay reproducible. Make DEBIAN_FRONTEND a build arg so it stops leaking into task containers, retry apt fetches, name the bun image after its bundled node major, fail the workflow when any matrix leg fails, write the layer cache once, and fix the README verify recipe to use the published epoch and label inspection that works without pulling.
…check Authenticate to Docker Hub before any image pull (and on PR runs) so pulls stop counting against anonymous rate limits, build both targets before pushing either so a mid-run failure can't leave the runtime and -build tags on different snapshots, and verify pushed digests resolve anonymously so an accidentally-private repo can't publish green. Only publish from main (branch dispatches build without pushing), reject future snapshot timestamps that would silently disable timestamp normalization, upgrade with --with-new-pkgs so updates that add dependencies aren't held back, validate images.json entries, drop the per-run GHA cache which could never hit across runs, don't fail a publish on attestation hiccups, and fix the README verify recipe's label inspection to a form that works against multi-platform indexes.
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (11)
WalkthroughAdds pinned Bookworm base-image configurations for Node.js and Bun. Adds runtime and build Docker stages that use Debian snapshots and clean APT data. Adds documentation for image pinning, reproducibility, verification, and publication. Adds a GitHub Actions workflow that validates configuration, builds multi-platform variants, conditionally publishes them, checks anonymous pulls, records provenance, reports digests, and fails when matrix builds fail. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…erify Anchored per-line grep let a multi-line value pass validation on the strength of one valid line; validate NUL-delimited whole records instead. Scope the README's attestation verify to this repository and workflow, and note that provenance is best effort so a Sigstore outage doesn't block publishes.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
… types Write the pinned snapshot sources to a dedicated sources.list.d file and move any upstream sources.list aside during the install alongside debian.sources, restoring both, so a base that ships extra apt entries keeps them byte for byte. Broaden the pullability check's Accept header to Docker and OCI manifest types so it doesn't rely on digest fetches ignoring content negotiation.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
An unattested published digest would otherwise go unnoticed forever; since builds are reproducible, re-running a red publish re-pushes identical digests and re-attests them, so failing loudly is cheap.
2 participants
Publishes the base images deployed task containers will build on:
triggerdotdev/node:{21,22,24,26}-bookwormandtriggerdotdev/bun:1.3-node20-bookworm, each with a-buildtoolchain variant, multi-arch, built from a pinned Debian snapshot so every published layer is reproducible from recorded inputs and carries a GitHub provenance attestation.Publishing runs on manual dispatch and on merges touching
base-images/. Pull requests build without pushing.