Skip to content

fix(ci): build UI images on bookworm and pin desktop security overrides #868

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AbirAbbas merged 3 commits into from
Aug 5, 2026
Merged

fix(ci): build UI images on bookworm and pin desktop security overrides #868

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9ada13f
fix(security): close open npm Dependabot vulnerability alerts
cursoragent Aug 3, 2026
00e8201
fix(ci): build web UI on bookworm to avoid lightningcss musl flake
cursoragent Aug 3, 2026
a671729
Merge remote-tracking branch 'origin/main' into santosh/fix-npm-secur…
AbirAbbas Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion deployments/docker/Dockerfile.control-plane
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
FROM --platform=$BUILDPLATFORM node:20-alpine AS ui-builder
# bookworm-slim (glibc) instead of alpine (musl): Vite's lightningcss
# optional native binding is flaky under npm ci on musl when the lockfile
# lacks libc metadata, which intermittently breaks `vite build` in CI.
FROM --platform=$BUILDPLATFORM node:20-bookworm-slim AS ui-builder
WORKDIR /app/web

COPY control-plane/web/client/package*.json ./
Expand Down
5 changes: 4 additions & 1 deletion deployments/docker/Dockerfile.control-plane-cloud
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,10 @@
# Runs as root: cloud platforms (Railway) mount volumes root-owned, and
# agent installs write venvs/binaries under $AGENTFIELD_HOME=/data.

FROM --platform=$BUILDPLATFORM node:20-alpine AS ui-builder
# bookworm-slim (glibc) instead of alpine (musl): Vite's lightningcss
# optional native binding is flaky under npm ci on musl when the lockfile
# lacks libc metadata, which intermittently breaks `vite build` in CI.
FROM --platform=$BUILDPLATFORM node:20-bookworm-slim AS ui-builder
WORKDIR /app/web

COPY control-plane/web/client/package*.json ./
Expand Down
6 changes: 5 additions & 1 deletion desktop/package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion tests/functional/docker/Dockerfile.test-runner
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
FROM node:20-alpine AS ui-builder
# bookworm (glibc) instead of alpine (musl): Vite's lightningcss optional
# native binding is flaky under npm ci on musl when the lockfile lacks
# libc metadata, which intermittently breaks the UI build in CI.
FROM node:20-bookworm AS ui-builder
WORKDIR /app/web

COPY control-plane/web/client/package*.json ./
Expand Down
Loading