fix(docker): refresh wolfi-base digest to fix node GLIBC_2.44 crash

[svg153]

What

Refresh the pinned cgr.dev/chainguard/wolfi-base digest in the Dockerfile to the current one, fixing the node GLIBC_2.44 crash after the scan.

Why

The current pin (sha256:70750dfd..., from Apr 2026, added in #156) ships glibc < 2.44. However, entrypoint.sh installs Node at runtime from the live Chainguard APK repos (apk add --update nodejs npm), which today serve nodejs-26 (26.8.1-r1) built against GLIBC_2.44. The resulting node binary cannot start against the old libc:

node: /usr/lib/libm.so.6: version `GLIBC_2.44' not found (required by node)

The scan itself completes fine (findings are not the cause); the crash happens afterwards when the action runs node to post PR comments/annotations. Non-deterministic: it started failing once Chainguard shipped nodejs-26 (reported in #160).

Change

-FROM cgr.dev/chainguard/wolfi-base:latest@sha256:70750dfde91b4c5804b4df269121253fbdff73a9122925c7acc067aa33f9f55e
+FROM cgr.dev/chainguard/wolfi-base:latest@sha256:1cec89e6c040d7a1ff412318d7a5fa89bab2c8b56e44d0a30f1df8acd646e1d0

How the digest was resolved

Queried the Chainguard registry cgr.dev (2026-09-02):

# token endpoint (realm from WWW-Authenticate)
TOKEN=$(curl -s "https://cgr.dev/token?scope=repository:chainguard/wolfi-base:pull&service=cgr.dev" | jq -r '.token')

# manifest index of :latest -> amd64 digest
curl -s -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.oci.image.index.v1+json" \
  "https://cgr.dev/v2/chainguard/wolfi-base/manifests/latest" \
  | jq -r '.manifests[] | select(.platform.architecture=="amd64") | .digest'
# sha256:1cec89e6c040d7a1ff412318d7a5fa89bab2c8b56e44d0a30f1df8acd646e1d0

The digest (and the old one) were verified to exist in the registry (HTTP 200).

Validation

A similar fix (same base image, live latest) validated on an internal GHES fork: fresh KICS run completed successfully — 0 GLIBC_2.44 errors, node post-processing ran fine, same findings reported (with ignore_on_exit: results).

Fixes #160

[cx-artur-ribeiro]

LGTM, thanks for the quick fix!

[ggprod]

Confirming this fixes the failure, with a note on durability.

Verification — the crash is in entrypoint.sh running Node at runtime from the live Chainguard apk repos against a base pinned at build time. Worth noting apk can't self-correct here: in a failing run it installs 12 packages and glibc is not among them, because nodejs-26 declares a shared-object dep (so:libm.so.6) that apk treats as satisfied by the installed glibc without checking symbol versions. Bumping the base digest is what actually resolves it.

The concern: the two inputs still move independently. The base is pinned; apk add --update nodejs npm pulls live. This unblocks today and reopens on the next glibc bump — and since GitHub rebuilds the action image on every run, that apk add is re-executed every run, so the exposure is continuous rather than frozen at merge time.

A durable follow-up: take Node from an image where Node and glibc are built together, and build at image-build time.

FROM docker.io/checkmarx/kics:v2.1.19@sha256:7b0a4d750acd491942ce9de52c1183fbf4451c1c936780ec2cfacd2650e7d84c AS kics-env

# node + glibc ship from one image, so they cannot drift apart
FROM cgr.dev/chainguard/node:latest
USER root

COPY --from=kics-env /app /app
COPY ./ /app

WORKDIR /app
RUN npm ci && npm run build --if-present

COPY ./entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]

…and drop apk add --update nodejs npm, npm ci, npm run build from entrypoint.sh.

Verified locally on linux/amd64: builds; node --version → v26.8.1 (same version apk installs, but with a matching glibc); /app/bin/kics version → v2.1.19; dist/index.js built at image-build time; a scan completes and node dist/index.js starts with no GLIBC error. It then throws TypeError: Cannot read properties of undefined (reading 'split') because I ran it outside Actions without the GitHub context env vars — unrelated to the change; I haven't verified annotation posting in a real workflow. /bin/ash is present, so entrypoint.sh needs no other changes.

One trap if anyone extends this PR to move the Node install into the Dockerfile while staying on wolfi-base: that image's default WORKDIR is /, whereas chainguard/node's is /app. Copying package.json/src/ to ./ without an explicit WORKDIR /app builds to /dist/index.js, while entrypoint.sh does cd /app && node dist/index.js. It builds clean and fails on the last line.

Happy to raise the follow-up as a separate PR if the direction seems useful — this one stands on its own as the immediate fix.