remove dead BASE_TAGS reference in release bake step.
steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses push-by-digest=true so tags are
only set in merge-manifests. Dead code.
replace unsecured curl hadolint download with an official action.
hadolint/hadolint-action uses a Docker-based runner with hadolint
pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian,so no binary
downloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified curl | sudo install.
Split {debian,alpine}: the action takes a single dockerfile argument,
so debian and alpine are linted separately.
pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor.
ubuntu-latest is a moving target that can silently change the runner OS
on the next GitHub-side update. All other jobs in this repo already pin
to ubuntu-24.04; this makes merge-manifests and zizmor consistent.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6991
**Author:** [@TriplEight](https://github.com/TriplEight)
**Created:** 3/22/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `pr/3x8_improve-ci`
---
### 📝 Commits (4)
- [`7653d52`](https://github.com/dani-garcia/vaultwarden/commit/7653d52dab4f9f012397ac26e4f9efb0aac922a9) ci: remove dead BASE_TAGS reference in release bake step
- [`59d1f3b`](https://github.com/dani-garcia/vaultwarden/commit/59d1f3b854222ea97cc12588856577ffffa77da2) ci: replace unsecured curl hadolint download with an official action
- [`1a5d00c`](https://github.com/dani-garcia/vaultwarden/commit/1a5d00c228e3fbcc0e7a833fcbff622cf8656a7c) ci: pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor
- [`bc27e40`](https://github.com/dani-garcia/vaultwarden/commit/bc27e40e6eb4be5f1b210aec784bcd397046a7a5) ci: return BASE_TAGS - it's needed for bake step
### 📊 Changes
**3 files changed** (+13 additions, -12 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/hadolint.yml` (+11 -10)
📝 `.github/workflows/release.yml` (+1 -1)
📝 `.github/workflows/zizmor.yml` (+1 -1)
</details>
### 📄 Description
1. remove dead BASE_TAGS reference in release bake step.
steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses push-by-digest=true so tags are
only set in merge-manifests. Dead code.
2. replace unsecured curl hadolint download with an official action.
hadolint/hadolint-action uses a Docker-based runner with hadolint
pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian,so no binary
downloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified curl | sudo install.
Split {debian,alpine}: the action takes a single dockerfile argument,
so debian and alpine are linted separately.
3. pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor.
ubuntu-latest is a moving target that can silently change the runner OS
on the next GitHub-side update. All other jobs in this repo already pin
to ubuntu-24.04; this makes merge-manifests and zizmor consistent.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6991
Author: @TriplEight
Created: 3/22/2026
Status: 🔄 Open
Base:
main← Head:pr/3x8_improve-ci📝 Commits (4)
7653d52ci: remove dead BASE_TAGS reference in release bake step59d1f3bci: replace unsecured curl hadolint download with an official action1a5d00cci: pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmorbc27e40ci: return BASE_TAGS - it's needed for bake step📊 Changes
3 files changed (+13 additions, -12 deletions)
View changed files
📝
.github/workflows/hadolint.yml(+11 -10)📝
.github/workflows/release.yml(+1 -1)📝
.github/workflows/zizmor.yml(+1 -1)📄 Description
remove dead BASE_TAGS reference in release bake step.
steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses push-by-digest=true so tags are
only set in merge-manifests. Dead code.
replace unsecured curl hadolint download with an official action.
hadolint/hadolint-action uses a Docker-based runner with hadolint
pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian,so no binary
downloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified curl | sudo install.
Split {debian,alpine}: the action takes a single dockerfile argument,
so debian and alpine are linted separately.
ubuntu-latest is a moving target that can silently change the runner OS
on the next GitHub-side update. All other jobs in this repo already pin
to ubuntu-24.04; this makes merge-manifests and zizmor consistent.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.