From 5cec548d338a98fabec99d6b4e5e2c225b4632d4 Mon Sep 17 00:00:00 2001 From: Mojtaba Karimi Date: Wed, 30 Sep 2026 17:38:35 +0300 Subject: [PATCH] ci: rebuild the runtime stage so OS security fixes reach the image The image scan failed on a fixable Critical and three High findings in OpenSSL (libssl3 3.0.20-1~deb12u2, fixed in 3.0.22-1~deb12u1). The runtime stage already runs `apt-get upgrade` for exactly this reason. But the build restores layers from the GitHub Actions cache, so that layer was replayed from before the fix existed, and the upgrade never ran again. The pinned base image has not been rebuilt upstream yet, so bumping its digest is not an option. Exclude the runtime stage from the cache (`no-cache-filters: runtime`). The builder stage, where the expensive wheel builds happen, stays cached. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a1c6969..b4e7a3a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -188,6 +188,10 @@ jobs: tags: ironflow:ci cache-from: type=gha cache-to: type=gha,mode=max + # Always rebuild the runtime stage. Its `apt-get upgrade` layer would + # otherwise come back from the cache, so a distribution security fix + # released since then (OpenSSL, 2026-09) would never reach the image. + no-cache-filters: runtime # The restrictions production should apply, so an image that quietly # needs a writable root, root privileges or a capability fails here.