Build the autoindex image from the release checkout; prepare v0.6.8

.github/workflows/scip-docker.yml

@@ -28,12 +28,14 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-
       - run: npm install
-      - run: cd ./packages/pyright-scip/ && npm install && npm run build
+      # npm pack builds the package and creates the tarball Dockerfile.autoindex installs.
+      - run: cd ./packages/pyright-scip/ && npm install && npm pack
       - uses: docker/setup-buildx-action@v2
       - name: Build Dockerfile
         id: docker_build_autoindex
         uses: docker/build-push-action@v4
         with:
+          context: .
           file: Dockerfile.autoindex
           push: false
           tags: |

.github/workflows/scip-release.yml

@@ -18,7 +18,8 @@ jobs:
         with:
           node-version: 24
       - run: npm install
-      - run: cd ./packages/pyright-scip/ && npm install && npm run build
+      # npm pack builds the package and creates the tarball Dockerfile.autoindex installs.
+      - run: cd ./packages/pyright-scip/ && npm install && npm pack
       - run: cd ./packages/pyright-scip/ && npm publish --access public
       - name: Login to DockerHub
         uses: docker/login-action@v2
@@ -29,6 +30,7 @@ jobs:
         id: docker_build_autoindex
         uses: docker/build-push-action@v4
         with:
+          context: .
           file: Dockerfile.autoindex
           push: true
           tags: |

Dockerfile.autoindex

@@ -3,6 +3,10 @@ FROM nikolaik/python-nodejs:python3.11-nodejs24-alpine@sha256:2db8a57a186758d0ca
 # ca-certificates 20261020-r0 distrusts the compromised eMudhra intermediates;
 # the base image ships an older version.
 RUN apk add --no-cache --upgrade git bash curl 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0'
-RUN npm install -g @sourcegraph/scip-python @sourcegraph/src
+# Install scip-python from this checkout (run `npm pack` in packages/pyright-scip
+# first), not from npm: npm holds new versions for malware scanning, so a
+# release build would otherwise install the previous version.
+COPY packages/pyright-scip/sourcegraph-scip-python-*.tgz /tmp/scip-python.tgz
+RUN npm install -g /tmp/scip-python.tgz @sourcegraph/src && rm /tmp/scip-python.tgz
 
 CMD ["/bin/sh"]

packages/pyright-scip/CHANGELOG.md

@@ -1,5 +1,11 @@
 # scip-python CHANGELOG
 
+## v0.6.8
+
+- The autoindex Docker image now installs scip-python built from the
+  release commit instead of from npm. The v0.6.7 image was built while
+  npm was still scanning 0.6.7, so it contains scip-python 0.6.6.
+
 ## v0.6.7
 
 - Updates the autoindex Docker image base to Alpine 3.24, Node 24 and

packages/pyright-scip/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sourcegraph/scip-python",
-    "version": "0.6.7",
+    "version": "0.6.8",
     "description": "SCIP indexer for Python",
     "main": "index.js",
     "scripts": {