From d88767e819d1ef193da625a3faa077130afd6836 Mon Sep 17 00:00:00 2001 From: Alex Ho <154479797@qq.com> Date: Mon, 1 Jun 2026 01:55:33 +0800 Subject: [PATCH] fix(docker): refresh Node base image digests (#84988) Refresh pinned node:24-bookworm and node:24-bookworm-slim manifest-list digests across the root, smoke, and e2e Dockerfiles. Update digest pin assertions to cover the plugin-binding e2e Dockerfile. Verified with live Docker digest inspection, targeted Dockerfile tests, root base-runtime build, install-sh smoke build, and plugin-binding e2e build. Thanks @LibraHo. --- Dockerfile | 6 +++--- scripts/docker/cleanup-smoke/Dockerfile | 2 +- scripts/docker/install-sh-e2e/Dockerfile | 2 +- scripts/docker/install-sh-smoke/Dockerfile | 2 +- scripts/e2e/Dockerfile | 2 +- scripts/e2e/Dockerfile.qr-import | 2 +- scripts/e2e/plugin-binding-command-escape.Dockerfile | 2 +- src/docker-image-digests.test.ts | 1 + src/dockerfile.test.ts | 4 ++-- 9 files changed, 12 insertions(+), 11 deletions(-) diff --git a/Dockerfile b/Dockerfile index 00b4dce3f2dd..a6aae74b50a7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,9 +9,9 @@ # Build stages use full bookworm; the runtime image is always bookworm-slim. ARG OPENCLAW_EXTENSIONS="" ARG OPENCLAW_BUNDLED_PLUGIN_DIR=extensions -ARG OPENCLAW_NODE_BOOKWORM_IMAGE="node:24-bookworm@sha256:3a09aa6354567619221ef6c45a5051b671f953f0a1924d1f819ffb236e520e6b" -ARG OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE="node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb" -ARG OPENCLAW_NODE_BOOKWORM_SLIM_DIGEST="sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb" +ARG OPENCLAW_NODE_BOOKWORM_IMAGE="node:24-bookworm@sha256:8530f76a96d88820d288761f022e318970dda93d01536919fbc16076b7983e63" +ARG OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE="node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf" +ARG OPENCLAW_NODE_BOOKWORM_SLIM_DIGEST="sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf" # Keep in sync with .github/actions/setup-node-env/action.yml bun-version. # To update: docker buildx imagetools inspect oven/bun: and use the manifest-list digest. ARG OPENCLAW_BUN_IMAGE="oven/bun:1.3.13@sha256:87416c977a612a204eb54ab9f3927023c2a3c971f4f345a01da08ea6262ae30e" diff --git a/scripts/docker/cleanup-smoke/Dockerfile b/scripts/docker/cleanup-smoke/Dockerfile index 4a26e9fce856..919d195d2930 100644 --- a/scripts/docker/cleanup-smoke/Dockerfile +++ b/scripts/docker/cleanup-smoke/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb +FROM node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0 diff --git a/scripts/docker/install-sh-e2e/Dockerfile b/scripts/docker/install-sh-e2e/Dockerfile index 3ba13e989654..0383ae7c5a33 100644 --- a/scripts/docker/install-sh-e2e/Dockerfile +++ b/scripts/docker/install-sh-e2e/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb +FROM node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf RUN --mount=type=cache,id=openclaw-install-sh-e2e-apt-cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,id=openclaw-install-sh-e2e-apt-lists,target=/var/lib/apt,sharing=locked \ diff --git a/scripts/docker/install-sh-smoke/Dockerfile b/scripts/docker/install-sh-smoke/Dockerfile index 401ce87479de..06392353b41f 100644 --- a/scripts/docker/install-sh-smoke/Dockerfile +++ b/scripts/docker/install-sh-smoke/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb +FROM node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf # Smoke images are pinned and short-lived, so skip distro upgrades here and # spend the time budget on installer coverage instead. diff --git a/scripts/e2e/Dockerfile b/scripts/e2e/Dockerfile index b141ef6decc7..704c367487c5 100644 --- a/scripts/e2e/Dockerfile +++ b/scripts/e2e/Dockerfile @@ -4,7 +4,7 @@ # `bare` is a clean Node/Git runner for install/update lanes. `functional` # installs the prepared OpenClaw npm tarball into /app for built-app lanes. -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb AS e2e-runner +FROM node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf AS e2e-runner # python3 covers package/plugin install paths that execute helper scripts. # procps provides pgrep for E2E watchdogs that assert no package-manager work is diff --git a/scripts/e2e/Dockerfile.qr-import b/scripts/e2e/Dockerfile.qr-import index 16bbf1897874..2402eccdbf08 100644 --- a/scripts/e2e/Dockerfile.qr-import +++ b/scripts/e2e/Dockerfile.qr-import @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb +FROM node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf RUN corepack enable diff --git a/scripts/e2e/plugin-binding-command-escape.Dockerfile b/scripts/e2e/plugin-binding-command-escape.Dockerfile index b5641081ea3d..49639278c048 100644 --- a/scripts/e2e/plugin-binding-command-escape.Dockerfile +++ b/scripts/e2e/plugin-binding-command-escape.Dockerfile @@ -1,4 +1,4 @@ -FROM node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb +FROM node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates git python3 \ diff --git a/src/docker-image-digests.test.ts b/src/docker-image-digests.test.ts index 9b4600bf998e..de12b517d630 100644 --- a/src/docker-image-digests.test.ts +++ b/src/docker-image-digests.test.ts @@ -16,6 +16,7 @@ const DIGEST_PINNED_DOCKERFILES = [ "scripts/docker/install-sh-smoke/Dockerfile", "scripts/e2e/Dockerfile", "scripts/e2e/Dockerfile.qr-import", + "scripts/e2e/plugin-binding-command-escape.Dockerfile", ] as const; type DependabotDockerGroup = { diff --git a/src/dockerfile.test.ts b/src/dockerfile.test.ts index 166cf3eb5da2..238597ff6119 100644 --- a/src/dockerfile.test.ts +++ b/src/dockerfile.test.ts @@ -30,10 +30,10 @@ describe("Dockerfile", () => { it("uses full bookworm for build stages and slim bookworm for runtime", async () => { const dockerfile = await readFile(dockerfilePath, "utf8"); expect(dockerfile).toContain( - 'ARG OPENCLAW_NODE_BOOKWORM_IMAGE="node:24-bookworm@sha256:3a09aa6354567619221ef6c45a5051b671f953f0a1924d1f819ffb236e520e6b"', + 'ARG OPENCLAW_NODE_BOOKWORM_IMAGE="node:24-bookworm@sha256:8530f76a96d88820d288761f022e318970dda93d01536919fbc16076b7983e63"', ); expect(dockerfile).toContain( - 'ARG OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE="node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb"', + 'ARG OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE="node:24-bookworm-slim@sha256:242549cd46785b480c832479a730f4f2a20865d61ea2e404fdb2a5c3d3b73ecf"', ); expect(dockerfile).toContain("FROM ${OPENCLAW_NODE_BOOKWORM_IMAGE} AS workspace-deps"); expect(dockerfile).toContain("FROM ${OPENCLAW_NODE_BOOKWORM_IMAGE} AS build");