remove dead BASE_TAGS reference in release bake step.
steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses push-by-digest=true so tags are
only set in merge-manifests. Dead code.
replace unsecured curl hadolint download with an official action. hadolint/hadolint-action uses a Docker-based runner with hadolint
pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian,so no binary
downloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified curl | sudo install.
Split {debian,alpine}: the action takes a single dockerfile argument,
so debian and alpine are linted separately.
pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor. ubuntu-latest is a moving target that can silently change the runner OS
on the next GitHub-side update. All other jobs in this repo already pin
to ubuntu-24.04; this makes merge-manifests and zizmor consistent.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6991
**Author:** [@TriplEight](https://github.com/TriplEight)
**Created:** 3/22/2026
**Status:** ✅ Merged
**Merged:** 7/8/2026
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `pr/3x8_improve-ci`
---
### 📝 Commits (5)
- [`7653d52`](https://github.com/dani-garcia/vaultwarden/commit/7653d52dab4f9f012397ac26e4f9efb0aac922a9) ci: remove dead BASE_TAGS reference in release bake step
- [`59d1f3b`](https://github.com/dani-garcia/vaultwarden/commit/59d1f3b854222ea97cc12588856577ffffa77da2) ci: replace unsecured curl hadolint download with an official action
- [`1a5d00c`](https://github.com/dani-garcia/vaultwarden/commit/1a5d00c228e3fbcc0e7a833fcbff622cf8656a7c) ci: pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor
- [`bc27e40`](https://github.com/dani-garcia/vaultwarden/commit/bc27e40e6eb4be5f1b210aec784bcd397046a7a5) ci: return BASE_TAGS - it's needed for bake step
- [`4090317`](https://github.com/dani-garcia/vaultwarden/commit/409031715f2ad6d8bb0506ec898f306630b89310) Merge branch 'main' into pr/3x8_improve-ci
### 📊 Changes
**3 files changed** (+13 additions, -12 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/hadolint.yml` (+11 -10)
📝 `.github/workflows/release.yml` (+1 -1)
📝 `.github/workflows/zizmor.yml` (+1 -1)
</details>
### 📄 Description
1. remove dead `BASE_TAGS` reference in release bake step.
steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses `push-by-digest=true` so tags are
only set in merge-manifests. Dead code.
2. replace unsecured curl hadolint download with an official action.
`hadolint/hadolint-action` uses a Docker-based runner with hadolint
pre-bundled in `ghcr.io/hadolint/hadolint:v2.14.0-debian`,so no binary
downloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified `curl | sudo install`.
Split `{debian,alpine}`: the action takes a single dockerfile argument,
so debian and alpine are linted separately.
3. pin `ubuntu-latest` to `ubuntu-24.04` in `merge-manifests` and `zizmor`.
`ubuntu-latest` is a moving target that can silently change the runner OS
on the next GitHub-side update. All other jobs in this repo already pin
to `ubuntu-24.04`; this makes `merge-manifests` and `zizmor` consistent.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6991
Author: @TriplEight
Created: 3/22/2026
Status: ✅ Merged
Merged: 7/8/2026
Merged by: @dani-garcia
Base:
main← Head:pr/3x8_improve-ci📝 Commits (5)
7653d52ci: remove dead BASE_TAGS reference in release bake step59d1f3bci: replace unsecured curl hadolint download with an official action1a5d00cci: pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmorbc27e40ci: return BASE_TAGS - it's needed for bake step4090317Merge branch 'main' into pr/3x8_improve-ci📊 Changes
3 files changed (+13 additions, -12 deletions)
View changed files
📝
.github/workflows/hadolint.yml(+11 -10)📝
.github/workflows/release.yml(+1 -1)📝
.github/workflows/zizmor.yml(+1 -1)📄 Description
remove dead
BASE_TAGSreference in release bake step.steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses
push-by-digest=trueso tags areonly set in merge-manifests. Dead code.
replace unsecured curl hadolint download with an official action.
hadolint/hadolint-actionuses a Docker-based runner with hadolintpre-bundled in
ghcr.io/hadolint/hadolint:v2.14.0-debian,so no binarydownloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified
curl | sudo install.Split
{debian,alpine}: the action takes a single dockerfile argument,so debian and alpine are linted separately.
ubuntu-latesttoubuntu-24.04inmerge-manifestsandzizmor.ubuntu-latestis a moving target that can silently change the runner OSon the next GitHub-side update. All other jobs in this repo already pin
to
ubuntu-24.04; this makesmerge-manifestsandzizmorconsistent.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.