Expose GIT_COMMIT in next-base's runtime stage - #1
Merged
Conversation
Bakes a safe GIT_COMMIT=unknown default into the runtime stage so a plain FROM next-base doesn't leave the var unset. A consuming site's own Dockerfile re-declares ARG/ENV GIT_COMMIT with its real build-arg, and reads it back via @silverassist/nextjs-core/environment's /api/deploy-info route -- lets a developer without AWS access confirm which commit is live on an environment.
aquasecurity/trivy-action@0.28.0 never existed as a ref -- upstream only
tags "v0.28.0" -- so build-and-scan failed at Set up job before touching
Docker, on every PR and the weekly schedule alike (confirmed against
main's last scheduled run). Pins by commit SHA instead of the tag,
matching this repo's own "everything external pinned by digest" rule.
Also adds DL3006 to .hadolint.yaml's ignore list: next-base's
FROM ${NODE_IMAGE} can't be statically resolved by hadolint, but
NODE_IMAGE's own default is already version+digest-pinned.
v0.28.0 (once its own tag reference was fixed) still failed at Set up job: its action.yaml pins aquasecurity/setup-trivy@v0.2.1, a tag upstream has since deleted -- nothing in this repo can fix that. v0.36.0 pins setup-trivy@v0.2.6, confirmed to exist, and all the inputs this workflow passes (image-ref, format, output, severity, ignore-unfixed) are still present in its action.yaml.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
next-base's runtime stage now declaresARG GIT_COMMIT=unknownand bakes it intoENV GIT_COMMIT, so a plainFROM next-basedoesn't leave the var unset.ARG GIT_COMMIT/ENV GIT_COMMIT=$GIT_COMMIT(anARGdoesn't propagate through a downstreamFROM) and pass--build-arg GIT_COMMIT=$CODEBUILD_RESOLVED_SOURCE_VERSIONfrom its own buildspec.@silverassist/nextjs-core@0.4.0's newenvironmentsubpath, which ships the/api/deploy-inforoute that reads this var back at runtime — lets a developer without AWS access confirm which commit is live on an environment.Test plan
ARG/ENVplacement matches the existingIMAGE_VERSION/VCS_REF/BUILD_DATEpattern in the same stageGIT_COMMIT=unknownbakes correctly with no site override