Skip to content

build(deps): bump node from 20-bookworm-slim to 25-bookworm-slim in /packages/orchestration/skills/dev-tools/quality-gate/sandbox #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump node from 20-bookworm-slim to 25-bookworm-slim in /packages/orchestration/skills/dev-tools/quality-gate/sandbox #72

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions packages/orchestration/skills/dev-tools/quality-gate/sandbox/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# Build a hermetic quality-gate image so checks run with reproducible dependencies.
FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0 AS build
FROM node:25-bookworm-slim@sha256:81db02c4b671288a03915da9534dbd54f96d0e7c24d80ccc54f5b36b2e684370 AS build

@codacy-production codacy-production Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW RISK

Suggestion: The Node.js base image and SHA digest are duplicated on lines 2 and 9. This redundancy makes future updates error-prone and can lead to environment drift between the build and runtime stages. Try running the following prompt in your coding agent: > Refactor the Dockerfile to use a global ARG for the Node.js base image version and SHA digest, and reference this ARG in both FROM instructions.

WORKDIR /skill
COPY package.json package-lock.json tsconfig.json ./
RUN npm ci --ignore-scripts
COPY src/ src/
RUN ./node_modules/.bin/tsc

FROM node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0
FROM node:25-bookworm-slim@sha256:81db02c4b671288a03915da9534dbd54f96d0e7c24d80ccc54f5b36b2e684370
RUN groupadd -r skill && useradd -r -g skill skill
WORKDIR /workspace/quality-gate
COPY --from=build /workspace/_shared/dist/ /workspace/_shared/dist/
Expand Down
Loading