From ef638c217a90e9d3f4e4baec3945f7497dd4c032 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 21:15:33 +0000 Subject: [PATCH 1/3] Refresh gh-aw-node runtime packages Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .changeset/patch-refresh-gh-aw-node.md | 5 +++++ .github/workflows/publish-safe-outputs-node.yml | 15 +++++++++++---- actions/setup/js/Dockerfile.safe-outputs-mcp | 7 ++++++- 3 files changed, 22 insertions(+), 5 deletions(-) create mode 100644 .changeset/patch-refresh-gh-aw-node.md diff --git a/.changeset/patch-refresh-gh-aw-node.md b/.changeset/patch-refresh-gh-aw-node.md new file mode 100644 index 00000000000..bab86bbfc78 --- /dev/null +++ b/.changeset/patch-refresh-gh-aw-node.md @@ -0,0 +1,5 @@ +--- +"gh-aw": patch +--- + +Refresh the `gh-aw-node` image's Alpine and npm packages and publish it for both amd64 and arm64. diff --git a/.github/workflows/publish-safe-outputs-node.yml b/.github/workflows/publish-safe-outputs-node.yml index 5dcd263ca31..bf4fdbfa9df 100644 --- a/.github/workflows/publish-safe-outputs-node.yml +++ b/.github/workflows/publish-safe-outputs-node.yml @@ -41,13 +41,20 @@ jobs: metadata=$(curl -fsSL "$METADATA_URL") echo "Metadata fetched successfully" - digest=$(printf '%s' "$metadata" | jq -r '.images[] | select(.os == "linux" and .architecture == "amd64") | .digest' | head -n 1) + digest=$(printf '%s' "$metadata" | jq -r '.digest') + amd64_digest=$(printf '%s' "$metadata" | jq -r '.images[] | select(.os == "linux" and .architecture == "amd64") | .digest' | head -n 1) + arm64_digest=$(printf '%s' "$metadata" | jq -r '.images[] | select(.os == "linux" and .architecture == "arm64") | .digest' | head -n 1) last_updated=$(printf '%s' "$metadata" | jq -r '.last_updated') - echo "Resolved linux/amd64 digest: ${digest}" + echo "Resolved multi-platform digest: ${digest}" + echo "Resolved linux/amd64 digest: ${amd64_digest}" + echo "Resolved linux/arm64 digest: ${arm64_digest}" echo "Upstream last_updated: ${last_updated}" - if [ -z "$digest" ] || [ "$digest" = "null" ] || [ -z "$last_updated" ] || [ "$last_updated" = "null" ]; then + if [ -z "$digest" ] || [ "$digest" = "null" ] \ + || [ -z "$amd64_digest" ] || [ "$amd64_digest" = "null" ] \ + || [ -z "$arm64_digest" ] || [ "$arm64_digest" = "null" ] \ + || [ -z "$last_updated" ] || [ "$last_updated" = "null" ]; then echo "Failed to resolve node:lts-alpine metadata" exit 1 fi @@ -194,7 +201,7 @@ jobs: with: context: . file: actions/setup/js/Dockerfile.safe-outputs-mcp - platforms: linux/amd64 + platforms: linux/amd64,linux/arm64 pull: true push: true build-args: | diff --git a/actions/setup/js/Dockerfile.safe-outputs-mcp b/actions/setup/js/Dockerfile.safe-outputs-mcp index 4246e00e953..878575b8d4c 100644 --- a/actions/setup/js/Dockerfile.safe-outputs-mcp +++ b/actions/setup/js/Dockerfile.safe-outputs-mcp @@ -7,14 +7,19 @@ ARG NODE_IMAGE ARG NODE_IMAGE_DIGEST="" ARG NODE_IMAGE_UPDATED_AT="" ARG DOCKERFILE_HASH="" +ARG NPM_VERSION=11.18.0 -RUN apk add --no-cache git +RUN apk upgrade --no-cache \ + && apk add --no-cache git \ + && npm install --global "npm@${NPM_VERSION}" \ + && npm cache clean --force LABEL org.opencontainers.image.source="https://github.com/github/gh-aw" \ org.opencontainers.image.description="Node LTS Alpine with git for the local safe-outputs MCP runtime" \ org.opencontainers.image.base.name="${NODE_IMAGE}" \ org.opencontainers.image.base.digest="${NODE_IMAGE_DIGEST}" \ io.github.gh-aw.safe-outputs.node.updated-at="${NODE_IMAGE_UPDATED_AT}" \ + io.github.gh-aw.safe-outputs.npm.version="${NPM_VERSION}" \ io.github.gh-aw.safe-outputs.dockerfile-hash="${DOCKERFILE_HASH}" ENTRYPOINT ["sh", "-lc", "node \"${GITHUB_WORKSPACE:-$PWD}/actions/setup/js/safe_outputs_mcp_server.cjs\""] From 11618d14b07d55eaad6efe74d0d345b6ce204737 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 22:13:23 +0000 Subject: [PATCH 2/3] Add QEMU setup for arm64 cross-platform builds Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/publish-safe-outputs-node.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish-safe-outputs-node.yml b/.github/workflows/publish-safe-outputs-node.yml index bf4fdbfa9df..49ef21e8568 100644 --- a/.github/workflows/publish-safe-outputs-node.yml +++ b/.github/workflows/publish-safe-outputs-node.yml @@ -191,6 +191,10 @@ jobs: echo "should_push=$should_push" >> "$GITHUB_OUTPUT" echo "reason=$reason" >> "$GITHUB_OUTPUT" + - name: Set up QEMU + if: steps.decision.outputs.should_push == 'true' + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - name: Set up Docker Buildx if: steps.decision.outputs.should_push == 'true' uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 From 65cb3f4081ca2730850d7a33f322e49447d01c35 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 22:18:47 +0000 Subject: [PATCH 3/3] Dockerfile: document apk upgrade intent and log installed packages Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- actions/setup/js/Dockerfile.safe-outputs-mcp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/actions/setup/js/Dockerfile.safe-outputs-mcp b/actions/setup/js/Dockerfile.safe-outputs-mcp index 878575b8d4c..81c48834a8e 100644 --- a/actions/setup/js/Dockerfile.safe-outputs-mcp +++ b/actions/setup/js/Dockerfile.safe-outputs-mcp @@ -9,8 +9,10 @@ ARG NODE_IMAGE_UPDATED_AT="" ARG DOCKERFILE_HASH="" ARG NPM_VERSION=11.18.0 +# Intentional: upgrade all packages to pick up security fixes; downstream digest pins the result. RUN apk upgrade --no-cache \ && apk add --no-cache git \ + && apk info -v | sort \ && npm install --global "npm@${NPM_VERSION}" \ && npm cache clean --force