[PR #295] [MERGED] chore: bump and digest-pin Bun base image to 1.3.14 #3019

New Issue

GiteaMirror · 2026-05-20T14:51:33-05:00

GiteaMirror commented

2026-05-20 14:51:33 -05:00

📋 Pull Request Information

Original PR: https://github.com/RayLabsHQ/gitea-mirror/pull/295
Author: @arunavo4
Created: 5/19/2026
Status: ✅ Merged
Merged: 5/19/2026
Merged by: @arunavo4

Base: main ← Head: ci/pin-bun-docker

📝 Commits (1)

03fcc57 chore: bump and digest-pin Bun base image to 1.3.14

📊 Changes

1 file changed (+2 additions, -2 deletions)

View changed files

📝 Dockerfile (+2 -2)

📄 Description

Summary

Extends the supply-chain hardening from #293 (GitHub Actions → SHA pins) to the Dockerfile.

Bumps Bun: oven/bun:1.3.13-debian → 1.3.14-debian (released 2026-05-13)
Pins to digest: @sha256:9dba1a1b43ce28c9d7931bfc4eb00feb63b0114720a0277a8f939ae4dfc9db6f (multi-arch manifest list, covers both linux/amd64 and linux/arm64)
Applies to both base and runner stages so every layer derives from the exact same digest

A tag like 1.3.14-debian is mutable on Docker Hub the same way a GH Action tag is mutable on GitHub — the maintainer can re-push it to a different image at any time. Pinning to the digest means even a compromised Docker Hub account can't change what we pull on the next build.

Test plan

Confirmed oven/bun:1.3.14-debian exists on Docker Hub and resolved its multi-arch digest
CI's docker job pulls the new digest and builds successfully (validates the digest is correct and the image is reachable from GitHub runners)

Follow-ups not in this PR

BUN_VERSION: "1.3.13" in e2e-tests.yml and the bare 1.3.13 literal in astro-build-test.yml — those install Bun on the runner via oven-sh/setup-bun, separate concern from the Docker base image. Worth bumping to match, but not strictly part of "pin the image."

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/RayLabsHQ/gitea-mirror/pull/295 **Author:** [@arunavo4](https://github.com/arunavo4) **Created:** 5/19/2026 **Status:** ✅ Merged **Merged:** 5/19/2026 **Merged by:** [@arunavo4](https://github.com/arunavo4) **Base:** `main` ← **Head:** `ci/pin-bun-docker` --- ### 📝 Commits (1) - [`03fcc57`](https://github.com/RayLabsHQ/gitea-mirror/commit/03fcc57c4e5d587f17ff83f1d589928fda136853) chore: bump and digest-pin Bun base image to 1.3.14 ### 📊 Changes **1 file changed** (+2 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `Dockerfile` (+2 -2) </details> ### 📄 Description ## Summary Extends the supply-chain hardening from #293 (GitHub Actions → SHA pins) to the Dockerfile. - **Bumps Bun**: `oven/bun:1.3.13-debian` → `1.3.14-debian` (released 2026-05-13) - **Pins to digest**: `@sha256:9dba1a1b43ce28c9d7931bfc4eb00feb63b0114720a0277a8f939ae4dfc9db6f` (multi-arch manifest list, covers both `linux/amd64` and `linux/arm64`) - Applies to both `base` and `runner` stages so every layer derives from the exact same digest A tag like `1.3.14-debian` is mutable on Docker Hub the same way a GH Action tag is mutable on GitHub — the maintainer can re-push it to a different image at any time. Pinning to the digest means even a compromised Docker Hub account can't change what we pull on the next build. ## Test plan - [x] Confirmed `oven/bun:1.3.14-debian` exists on Docker Hub and resolved its multi-arch digest - [ ] CI's `docker` job pulls the new digest and builds successfully (validates the digest is correct and the image is reachable from GitHub runners) ## Follow-ups not in this PR - `BUN_VERSION: "1.3.13"` in `e2e-tests.yml` and the bare `1.3.13` literal in `astro-build-test.yml` — those install Bun on the runner via `oven-sh/setup-bun`, separate concern from the Docker base image. Worth bumping to match, but not strictly part of "pin the image." --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-20 14:51:33 -05:00

GiteaMirror closed this issue

2026-05-20 14:51:34 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea-mirror#3019