boringbuilder 0.1.0.alpha.6 → 0.1.0.alpha.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 314dda57ef8c80a135ad3feb0c9eb3598d88861b8f95805bee36a723ec527b78
-  data.tar.gz: d5d53c7137844f6fafec9f5f6967ca63ef298a2a876c6879cd4623d3b1039503
+  metadata.gz: 22116f34c754c470cf545293e07c4a80535b5029e6de14a6f0a40b566519df51
+  data.tar.gz: d7ca4d972b06de91ab789e1b40e5d79f066e235211449c67ba10f3aaf36860ed
 SHA512:
-  metadata.gz: e4440471f868c5e3b9d9e45745c6363b5a9dcfd58621f92bdd52b86578f0605acab3fbe27e353a49316984490a3032686cfe31aa7190390c6e2a3fc963492132
-  data.tar.gz: 2346682b6bf256fc647be807fb69719e8a82ddd7d37fe7f7860f76a2a001ffc28f943db56b279acc4907d5db904e628b01203b070a71bc62de2608c7cda0c394
+  metadata.gz: fb825fc16e19697558797e7b6b105af57ccbbf9795bd4515a345e0bdd5885e9ebe76e527386edc471d00d8216c9bd48dab53dc4ad17f93bd9a124e92d77aa60b
+  data.tar.gz: 9f64ea4bbc096137a82a390cbcb2efb71cd20d833b3c999ecc3ffc863b4408837f3b5096b653017f9670245b8f39eb4d0a0d0d798e4ac5ab6a24aa24fbe5603c

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.0.alpha.8 - 2026-10-16
+
+- Update the BoringCache CLI and build images to 1.42.0 with pinned multi-platform digests.
+- Trust copied project Mise configuration inside build containers before installing tools, while retaining
+  paranoid mode.
+
+## 0.1.0.alpha.7 - 2026-10-02
+
+- Require Dagger Ruby 0.11.1 or newer for startup status and Dagger 0.21.9 support.
+- Update development dependencies.
+
 ## 0.1.0.alpha.6 - 2026-08-28
 
 - Run `bin/rails boring:build` as a standalone builder process so Dagger can

data/docs/building.md

@@ -134,6 +134,8 @@ end
 
 `pipeline.mise` prepares the requested tools and application source in a Dagger container. Project versions in
 `mise.toml`, `.mise.toml`, or `.tool-versions` override recipe fallbacks, and `mise.lock` is respected when present.
+The build trusts the copied project configuration files inside its container before installing tools. Mise's
+paranoid mode remains enabled; host-side Mise trust is unchanged.
 Any tool in the [Mise registry](https://mise.jdx.dev/registry.html) can use the same shape.
 
 `pipeline.run` persists the declared path in the local Dagger engine or through BoringCache when shared credentials

data/lib/boringbuilder/boring_cache.rb

@@ -2,10 +2,10 @@
 
 module BoringBuilder
   class BoringCache
-    CLI_IMAGE = "ghcr.io/boringcache/base:bookworm-v1.19.4@" \
-                "sha256:84d1e168a50fd086ecd4fdb2fd96f689982a6f3c61454acd8c7189e336f8f3ae"
-    BUILD_IMAGE = "ghcr.io/boringcache/base:bookworm-build-v1.19.4@" \
-                  "sha256:df4461581214c0052157041238a67b8da420e1399e4024bc857c68c74a9721cb"
+    CLI_IMAGE = "ghcr.io/boringcache/base:bookworm-v1.42.0@" \
+                "sha256:9d663a781f5e2ff07ee430cb73e99b6b01e00584583c78c27062680842673430"
+    BUILD_IMAGE = "ghcr.io/boringcache/base:bookworm-build-v1.42.0@" \
+                  "sha256:0d621a60a42741365f69d991b121e1a1ea3b900c360b11e265d99e27eeaaa311"
     TOKEN_NAMES = %w[BORINGCACHE_RESTORE_TOKEN BORINGCACHE_SAVE_TOKEN].freeze
     ENVIRONMENT_NAMES = %w[BORINGCACHE_API_URL BORINGCACHE_DEFAULT_WORKSPACE BORINGCACHE_WORKSPACE].freeze
 

data/lib/boringbuilder/mise.rb

@@ -7,7 +7,8 @@ module BoringBuilder
     DEFAULT_IMAGE = BoringCache::BUILD_IMAGE
     CACHE_PATH = "/mise/cache"
     INSTALL_COMMAND = %w[mise install].freeze
-    METADATA_FILES = %w[mise.toml .mise.toml .tool-versions mise.lock].freeze
+    CONFIG_FILES = %w[mise.toml .mise.toml .tool-versions].freeze
+    METADATA_FILES = [*CONFIG_FILES, "mise.lock"].freeze
     ENVIRONMENT = {
       "MISE_CACHE_DIR" => CACHE_PATH,
       "MISE_DATA_DIR" => "/mise",
@@ -32,6 +33,11 @@ module BoringBuilder
       container = with_environment(container)
       container = container.with_workdir(workdir)
                            .with_new_file("/etc/mise/config.toml", system_config(tools))
+      CONFIG_FILES.each do |name|
+        next unless project.root.join(name).file?
+
+        container = container.with_exec(["mise", "trust", "--", "#{workdir}/#{name}"])
+      end
       command = [*INSTALL_COMMAND, *Array(only).map(&:to_s)]
       pipeline.run(
         container,

data/lib/boringbuilder/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BoringBuilder
-  VERSION = "0.1.0.alpha.6"
+  VERSION = "0.1.0.alpha.8"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: boringbuilder
 version: !ruby/object:Gem::Version
-  version: 0.1.0.alpha.6
+  version: 0.1.0.alpha.8
 platform: ruby
 authors:
 - BoringCache
@@ -16,6 +16,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.11'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.11.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -23,6 +26,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.11'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.11.1
 description: BoringBuilder turns application source into filesystem artifacts and
   container images. Rails is first class, while Mise-powered Dagger Ruby recipes support
   any workload.
@@ -80,7 +86,7 @@ licenses:
 metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/boringcache/builder
-  source_code_uri: https://github.com/boringcache/builder/tree/v0.1.0.alpha.6
+  source_code_uri: https://github.com/boringcache/builder/tree/v0.1.0.alpha.8
   documentation_uri: https://github.com/boringcache/builder#readme
   changelog_uri: https://github.com/boringcache/builder/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/boringcache/builder/issues