From 099ea6dbe183803d84f2ad3daecce296910bf33a Mon Sep 17 00:00:00 2001 From: Nick Schuch Date: Tue, 20 Jan 2026 14:34:04 +1000 Subject: [PATCH 1/5] Set Docker bake source --- .github/workflows/build-pr.yml | 4 +++- .github/workflows/build-push.yml | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index ee10cb7..2ebbfa8 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -23,7 +23,9 @@ jobs: uses: docker/setup-buildx-action@v3 - name: 🏗️ Build Docker image - uses: docker/bake-action@v6 + uses: docker/bake-action@v6\ env: NODE_VERSION: ${{ matrix.node }} STREAM: ${{ env.stream }} + with: + source: . diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml index eb402cc..15d3978 100644 --- a/.github/workflows/build-push.yml +++ b/.github/workflows/build-push.yml @@ -68,4 +68,5 @@ jobs: NODE_VERSION: ${{ matrix.node }} STREAM: ${{ inputs.stream }} with: + source: . push: ${{ inputs.push }} From 3dce52f5b824d1af4cc1cdeceff2f7a38074a0c4 Mon Sep 17 00:00:00 2001 From: Nathan ter Bogt Date: Mon, 16 Feb 2026 09:37:56 +1300 Subject: [PATCH 2/5] Adding rsync --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 2ebb588..2dba76d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,6 +19,7 @@ RUN apk add --no-cache \ make \ openssh-client \ python3 \ + rsync \ tar \ # Below are for packages such as https://www.npmjs.com/package/imagemin autoconf \ From 591f4cda88d647dd4a75bc65fe1c7ab3678b0a63 Mon Sep 17 00:00:00 2001 From: Nathan ter Bogt Date: Mon, 16 Feb 2026 10:14:29 +1300 Subject: [PATCH 3/5] pnpm doesnt contain compiled message. (#43) * Updating the pnpm check. * More random issues --- .github/workflows/build-pr.yml | 2 +- Dockerfile | 1 + tests.bats | 4 ++-- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 2ebbfa8..ebed3bd 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -23,7 +23,7 @@ jobs: uses: docker/setup-buildx-action@v3 - name: 🏗️ Build Docker image - uses: docker/bake-action@v6\ + uses: docker/bake-action@v6 env: NODE_VERSION: ${{ matrix.node }} STREAM: ${{ env.stream }} diff --git a/Dockerfile b/Dockerfile index 2dba76d..08c85a1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,6 +16,7 @@ RUN apk add --no-cache \ curl \ g++ \ git \ + jq \ make \ openssh-client \ python3 \ diff --git a/tests.bats b/tests.bats index 40afde8..c01967b 100644 --- a/tests.bats +++ b/tests.bats @@ -18,8 +18,8 @@ setup() { assert_output --partial "DISCLAIMER" } -@test "pnpm --help exits 0 and mentions 'compiled to binary'" { +@test "pnpm --help exits 0 and mentions 'Usage: pnpm [command] [flags]'" { run pnpm --help [ "$status" -eq 0 ] - assert_output --partial "compiled to binary" + assert_output --partial "Usage: pnpm [command] [flags]" } From f374602952763e9c548adfb333e805b0c4f8165e Mon Sep 17 00:00:00 2001 From: Nick Schuch Date: Thu, 19 Feb 2026 12:19:03 +1000 Subject: [PATCH 4/5] Update SKPRMAIL_VERSION to 1.0.3 in Dockerfile --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 08c85a1..662c285 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,7 +31,7 @@ RUN apk add --no-cache \ util-linux \ vips-dev -RUN export SKPRMAIL_VERSION=1.0.1 && \ +RUN export SKPRMAIL_VERSION=1.0.3 && \ curl -sSL https://github.com/skpr/mail/releases/download/v${SKPRMAIL_VERSION}/skprmail_${SKPRMAIL_VERSION}_linux_${TARGETARCH} -o /usr/local/bin/skprmail && \ chmod +rx /usr/local/bin/skprmail From 1097ac2520702f517fecfa48cb8425bd53ad4ab8 Mon Sep 17 00:00:00 2001 From: Lee Rowlands Date: Tue, 30 Jun 2026 16:31:04 +1000 Subject: [PATCH 5/5] feat(core): add Node 26, drop Node 20, bump to Alpine 3.24 (#44) - Install yarn explicitly before wrapping, as Node 26+ no longer ships it in the base image - Latest builds: Node 22, 24, 26 on Alpine 3.24 - Stable builds: Node 22, 24 on Alpine 3.21 (Node 26 excluded until stable moves to 3.24) - Bump Alpine default from 3.21 to 3.24 in `docker-bake.hcl` - Add `node_versions` and `alpine_version` inputs to `build-push.yml` to allow per-stream configuration - Replace Node 20 with Node 26 in the security scan matrix - Bump all GitHub Actions to latest majors (checkout@v7, login-action@v4, setup-buildx-action@v4, bake-action@v7) --- .github/workflows/build-pr.yml | 10 +++++----- .github/workflows/build-push-stable.yml | 2 ++ .github/workflows/build-push.yml | 21 +++++++++++++++------ .github/workflows/security-scan.yml | 6 +++--- Dockerfile | 3 +++ docker-bake.hcl | 2 +- 6 files changed, 29 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index ebed3bd..e0b4882 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -13,17 +13,17 @@ jobs: strategy: fail-fast: false matrix: - node: [ '20', '22', '24' ] + node: [ '22', '24', '26' ] steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: 🐋 Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - - name: 🏗️ Build Docker image - uses: docker/bake-action@v6 + - name: 🏗️ Build Docker image + uses: docker/bake-action@v7 env: NODE_VERSION: ${{ matrix.node }} STREAM: ${{ env.stream }} diff --git a/.github/workflows/build-push-stable.yml b/.github/workflows/build-push-stable.yml index b4bcdfa..0ad56fd 100644 --- a/.github/workflows/build-push-stable.yml +++ b/.github/workflows/build-push-stable.yml @@ -15,4 +15,6 @@ jobs: stream: stable push: true branch: releases + node_versions: '["22","24"]' + alpine_version: '3.21' secrets: inherit diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml index 15d3978..5845819 100644 --- a/.github/workflows/build-push.yml +++ b/.github/workflows/build-push.yml @@ -19,6 +19,14 @@ on: type: string default: main description: Branch name to build from. + node_versions: + type: string + default: '["22","24","26"]' + description: JSON array of Node.js versions to build. + alpine_version: + type: string + default: '3.24' + description: Alpine Linux version to build against. secrets: DOCKERHUB_USERNAME: @@ -38,34 +46,35 @@ jobs: strategy: fail-fast: false matrix: - node: [ '20', '22', '24' ] + node: ${{ fromJson(inputs.node_versions) }} steps: - name: 📥 Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ inputs.branch }} - name: 🔑 Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: 🔑 Log in to the GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: 🐋 Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: 🏗️ Build and push Docker image - uses: docker/bake-action@v6 + uses: docker/bake-action@v7 env: NODE_VERSION: ${{ matrix.node }} + ALPINE_VERSION: ${{ inputs.alpine_version }} STREAM: ${{ inputs.stream }} with: source: . diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 492ddf4..e2ca02e 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -18,16 +18,16 @@ jobs: fail-fast: false matrix: image_ref: + - ghcr.io/skpr/node:26-v3-latest + - ghcr.io/skpr/node:dev-26-v3-latest - ghcr.io/skpr/node:24-v3-latest - ghcr.io/skpr/node:dev-24-v3-latest - ghcr.io/skpr/node:22-v3-latest - ghcr.io/skpr/node:dev-22-v3-latest - - ghcr.io/skpr/node:20-v3-latest - - ghcr.io/skpr/node:dev-20-v3-latest steps: - name: 🔑 Log in to the GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/Dockerfile b/Dockerfile index 662c285..a2dee9b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -41,6 +41,9 @@ RUN mkdir /data && chown skpr:skpr /data WORKDIR /data +# Ensure yarn is available before wrapping (Node 26+ no longer ships yarn). +RUN npm install -g yarn --force + # Replace npm with a wrapper script to enforce security. RUN mv /usr/local/bin/npm /usr/local/bin/npm-unsafe ADD --chown=skpr:skpr bin/npm-wrapper /usr/local/bin/npm diff --git a/docker-bake.hcl b/docker-bake.hcl index 7975dd2..051562e 100644 --- a/docker-bake.hcl +++ b/docker-bake.hcl @@ -3,7 +3,7 @@ variable "NODE_VERSION" { } variable "ALPINE_VERSION" { - default = "3.21" + default = "3.24" } variable "STREAM" {