Repository navigation
CI: manual no-cache rebuild, fix venv cache, Node 24 actions - #412
Merged
Merged
Conversation
The docker build uses the GHA layer cache, so Debian security fixes (e.g. libbrotli1 for CVE-2026-111497) are not picked up unless the apt layer changes. Add a workflow_dispatch trigger with a no_cache input (default true) that rebuilds from a fresh base image and pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Key the Poetry and venv caches on the full Python version from setup-python. The runner moved to 3.14.8 and the old py3.14 key restored a venv with a broken interpreter link, so lint/test failed. - Bump checkout v7, cache v6, setup-python v7, codecov v7, setup-buildx v4, build-push v7, configure-aws-credentials v6 to remove Node 20 deprecation warnings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removes an unpinned third-party action from the supply chain. pipx is preinstalled on GitHub-hosted runners. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
irvingpop
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
apt-get upgradelayer, so security fixes are not picked up. The images from 2026-10-22 havelibbrotli1 1.1.0-2+b7(vulnerable). A no-cache rebuild gets1.1.0-2+deb13u1(fixed).py3.14. The runner moved to Python 3.14.8, so CI restored a venv with a broken interpreter link (Command not found: ruff/pytest).snok/install-poetry@v1was an unpinned third-party action.What
workflow_dispatchwith ano_cacheboolean input (defaulttrue). On dispatch: build withno-cache+pull, then push.mainpushes:prod, other branches push:staging. Push and PR builds do not change.setup-python(steps.setup-python.outputs.python-version).checkoutv7,cachev6,setup-pythonv7,codecov-actionv7,setup-buildx-actionv4,build-push-actionv7,configure-aws-credentialsv6. Release notes checked: breaking changes are only the runner minimum (v2.327.1) and removed inputs we do not use.snok/install-poetrywithpipx install "poetry==$POETRY_VERSION"(pipx is preinstalled on GitHub runners). This also removes the Poetry install cache.After merge
The merge build uses the layer cache, so it does not fix the CVE. Then run Actions > CI > Run workflow on
mainwithno_cachechecked. Check the new image:dpkg-query -W libbrotli1must show1.1.0-2+deb13u1.Scan
Docker Scout on a local no-cache build: 0 critical, 1 high (zlib CVE-2026-85091, no Debian fix yet, affects the non-blocking
gzwritepath only).🤖 Generated with Claude Code