Skip to content

run CI for #8100 #8101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
n1ru4l wants to merge 2 commits into from
Closed

run CI for #8100 #8101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
10a50d3
fix: apply OS security updates to base images at build time
Jun 2, 2026
3c8f188
chore: use --no-install-recommends for apt upgrade/install
Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/patch-base-image-os-packages.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'hive': patch
---

Apply OS security updates to the base image at build time by adding `apt-get upgrade` to the service, migrations, and CLI Dockerfiles. Previously these only ran `apt-get update` followed by `apt-get install` of a few specific packages, so Debian security patches inherited from the pinned `node:*-slim` base were never applied — leaving published images with known-fixed CVEs. Bumping the base image tag alone does not fix this, since the latest `node` tag can still lag behind Debian's security updates.
2 changes: 1 addition & 1 deletion docker/cli.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM node:24.14.1-slim

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*
RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*

@gemini-code-assist gemini-code-assist Bot Jun 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Running apt-get upgrade can sometimes trigger interactive prompts (e.g., for configuration choices or service restarts), which can cause the Docker build to hang or fail in non-interactive environments like CI. Prepend DEBIAN_FRONTEND=noninteractive to ensure the commands run without prompting.

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates git && rm -rf /var/lib/apt/lists/*


ARG CLI_VERSION

Expand Down
2 changes: 1 addition & 1 deletion docker/migrations.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM node:24.14.1-slim

RUN apt-get update && apt-get install -y ca-certificates
RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*

@gemini-code-assist gemini-code-assist Bot Jun 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Running apt-get upgrade can sometimes trigger interactive prompts, which can cause the Docker build to hang or fail in non-interactive environments like CI. Prepend DEBIAN_FRONTEND=noninteractive to ensure the commands run without prompting.

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*


WORKDIR /usr/src/app

Expand All @@ -9,12 +9,12 @@

ENV ENVIRONMENT=production
ENV NODE_ENV=production
ENV RELEASE=$RELEASE

Check warning on line 12 in docker/migrations.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$RELEASE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 12 in docker/migrations.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$RELEASE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

LABEL org.opencontainers.image.licenses=MIT
LABEL org.opencontainers.image.title=$IMAGE_TITLE

Check warning on line 15 in docker/migrations.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_TITLE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 15 in docker/migrations.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_TITLE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
LABEL org.opencontainers.image.version=$RELEASE
LABEL org.opencontainers.image.description=$IMAGE_DESCRIPTION

Check warning on line 17 in docker/migrations.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_DESCRIPTION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 17 in docker/migrations.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_DESCRIPTION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
LABEL org.opencontainers.image.authors="The Guild"
LABEL org.opencontainers.image.vendor="Kamil Kisiela"
LABEL org.opencontainers.image.url="https://github.com/graphql-hive/platform"
Expand Down
2 changes: 1 addition & 1 deletion docker/services.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM node:24.14.1-slim

RUN apt-get update && apt-get install -y wget ca-certificates && rm -rf /var/lib/apt/lists/*
RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends wget ca-certificates && rm -rf /var/lib/apt/lists/*

@gemini-code-assist gemini-code-assist Bot Jun 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Running apt-get upgrade can sometimes trigger interactive prompts, which can cause the Docker build to hang or fail in non-interactive environments like CI. Prepend DEBIAN_FRONTEND=noninteractive to ensure the commands run without prompting.

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends wget ca-certificates && rm -rf /var/lib/apt/lists/*


ARG SERVICE_DIR_NAME
WORKDIR /usr/src/app/$SERVICE_DIR_NAME
Expand All @@ -9,17 +9,17 @@
COPY --from=shared . /

LABEL org.opencontainers.image.licenses=MIT
LABEL org.opencontainers.image.title=$IMAGE_TITLE

Check warning on line 12 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_TITLE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 12 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_TITLE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
LABEL org.opencontainers.image.version=$RELEASE

Check warning on line 13 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$RELEASE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 13 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$RELEASE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
LABEL org.opencontainers.image.description=$IMAGE_DESCRIPTION

Check warning on line 14 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_DESCRIPTION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 14 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$IMAGE_DESCRIPTION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
LABEL org.opencontainers.image.authors="The Guild"
LABEL org.opencontainers.image.vendor="Kamil Kisiela"
LABEL org.opencontainers.image.url="https://github.com/graphql-hive/platform"
LABEL org.opencontainers.image.source="https://github.com/graphql-hive/platform"

ENV ENVIRONMENT=production
ENV RELEASE=$RELEASE

Check warning on line 21 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$RELEASE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 21 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$RELEASE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ENV PORT=$PORT

Check warning on line 22 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$PORT'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 22 in docker/services.dockerfile

View workflow job for this annotation

GitHub Actions / build / dockerize (linux/amd64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$PORT'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

HEALTHCHECK --interval=5s \
--timeout=5s \
Expand Down
Loading