javi-forge 1.21.0 → 1.21.2

package/ci-local/ci-local.ps1

@@ -185,7 +185,7 @@ ENTRYPOINT ["/bin/bash", "-c"]
 @'
 FROM node:22-slim@sha256:689c11043dad91472750cd824c97dd5e2318e9dd6f954e492fe7af0135d33ceb
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN npm install -g pnpm
+RUN npm install -g pnpm@10
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work

package/ci-local/ci-local.sh

@@ -182,7 +182,7 @@ DOCKERFILE
             cat > "$docker_dir/$DOCKERFILE" << 'DOCKERFILE'
 FROM node:22-slim@sha256:689c11043dad91472750cd824c97dd5e2318e9dd6f954e492fe7af0135d33ceb
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN npm install -g pnpm
+RUN npm install -g pnpm@10
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work

package/ci-local/docker/node.Dockerfile

@@ -1,6 +1,6 @@
 FROM node:22-slim
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN npm install -g pnpm
+RUN npm install -g pnpm@10
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work

package/dist/lib/ci-config.js

@@ -77,6 +77,35 @@ const RUNNER_FIELDS = new Set([
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+ * Validate an optional container `image` ref shared by the runner and gate
+ * paths (IMG-1). Rejects non-string / empty-after-trim and leading-dash refs
+ * (an image like "--privileged" or "-v /:/host" would be parsed by `docker run`
+ * as a FLAG, not an image, if it reached argv — JDB-004) with a named error at
+ * `fieldPath`. Returns the TRIMMED value to store, so a whitespace-padded ref
+ * fails cleanly at validation instead of reaching docker argv untrimmed.
+ * Returns undefined when the field is absent or invalid.
+ */
+function validateImageRef(value, fieldPath, errors) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !value.trim()) {
+        errors.push({
+            path: fieldPath,
+            message: "image must be a non-empty string",
+        });
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (trimmed.startsWith("-")) {
+        errors.push({
+            path: fieldPath,
+            message: "image must not start with '-' (would be parsed as a docker flag)",
+        });
+        return undefined;
+    }
+    return trimmed;
+}
 function normalizeCommands(value, fieldPath, errors) {
     if (value === undefined)
         return [];
@@ -159,18 +188,7 @@ function validateRunner(raw, index, errors) {
             }
         }
     }
-    let image;
-    if (raw.image !== undefined) {
-        if (typeof raw.image !== "string" || !raw.image.trim()) {
-            errors.push({
-                path: `${base}.image`,
-                message: "image must be a non-empty string",
-            });
-        }
-        else {
-            image = raw.image;
-        }
-    }
+    const image = validateImageRef(raw.image, `${base}.image`, errors);
     let buildContext;
     if (raw["build-context"] !== undefined) {
         if (typeof raw["build-context"] !== "string" ||
@@ -319,28 +337,7 @@ function validateGate(raw, index, errors) {
             env = raw.env;
         }
     }
-    let image;
-    if (raw.image !== undefined) {
-        if (typeof raw.image !== "string" || !raw.image.trim()) {
-            errors.push({
-                path: `${base}.image`,
-                message: "image must be a non-empty string",
-            });
-        }
-        else if (raw.image.trim().startsWith("-")) {
-            // Harden against docker-flag injection: an image ref like "--privileged"
-            // or "-v /:/host" would be parsed by `docker run` as a FLAG, not an
-            // image argument, if it reached argv. Reject leading-dash refs at
-            // validation with a named error (JDB-004).
-            errors.push({
-                path: `${base}.image`,
-                message: "image must not start with '-' (would be parsed as a docker flag)",
-            });
-        }
-        else {
-            image = raw.image;
-        }
-    }
+    const image = validateImageRef(raw.image, `${base}.image`, errors);
     let timeout;
     if (raw.timeout !== undefined) {
         if (typeof raw.timeout !== "number" ||

package/dist/lib/docker.js

@@ -40,7 +40,10 @@ export function getDockerfileContent(stack) {
             return [
                 "FROM node:22-slim",
                 "RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*",
-                "RUN npm install -g pnpm",
+                // Pin pnpm to major 10 to match ci.yml (pnpm/action-setup version:
+                // 10) and the lockfileVersion 9.0 lockfile. Unpinned drifts to
+                // pnpm 11, breaking the frozen install with LOCKFILE_CONFIG_MISMATCH.
+                "RUN npm install -g pnpm@10",
                 "RUN useradd -m -s /bin/bash runner",
                 "USER runner",
                 "WORKDIR /home/runner/work",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.21.0",
+	"version": "1.21.2",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {