javi-forge 1.21.2 → 1.22.0

package/ci-local/docker/node.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-slim
+FROM node:22-slim@sha256:689c11043dad91472750cd824c97dd5e2318e9dd6f954e492fe7af0135d33ceb
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
 RUN npm install -g pnpm@10
 RUN useradd -m -s /bin/bash runner

package/dist/commands/ci.js

@@ -139,6 +139,26 @@ async function buildCICommands(stack, buildTool, projectDir) {
             return { lintCmd: null, compileCmd: null, testCmd: null };
     }
 }
+/**
+ * Prefer the REPO-LOCAL `ci-local/docker/` over the CLI's bundled Dockerfiles.
+ *
+ * A globally-installed javi-forge bundles its own `ci-local/docker/*.Dockerfile`,
+ * which can lag the fixes committed in the repo being CI'd (the stale-global
+ * pnpm-11 image incident). When the project ships its OWN Dockerfile for the
+ * detected stack, that committed file must win.
+ *
+ * Resolution is PER-STACK on purpose: the repo dir is returned ONLY when
+ * `ci-local/docker/${stack}.Dockerfile` actually exists. If the repo has the
+ * directory but not the specific stack Dockerfile, this returns `undefined` so
+ * `ensureImage` falls back to the bundled dir — which avoids `ensureImage`'s
+ * first-run write-through (docker.ts) generating a Dockerfile INTO the user's
+ * repo. `undefined` means "use the bundled default", exactly as before.
+ */
+async function resolveRepoDockerfilesDir(projectDir, stack) {
+    const repoDockerDir = path.join(projectDir, "ci-local", "docker");
+    const stackDockerfile = path.join(repoDockerDir, `${stack}.Dockerfile`);
+    return (await fs.pathExists(stackDockerfile)) ? repoDockerDir : undefined;
+}
 function freezeRunner(runner) {
     return Object.freeze({
         ...runner,
@@ -398,9 +418,11 @@ export async function runCI(options, onStep, onGateOutcome) {
                 });
             }
             else {
+                const dockerfilesDir = await resolveRepoDockerfilesDir(projectDir, stackInfo.stackType);
                 shellImage = await ensureImage({
                     stack: stackInfo.stackType,
                     javaVersion: stackInfo.javaVersion,
+                    ...(dockerfilesDir ? { dockerfilesDir } : {}),
                 });
             }
             report(onStep, "docker-image", "Docker image ready", "done");
@@ -435,9 +457,11 @@ export async function runCI(options, onStep, onGateOutcome) {
             const stepImage = "docker-image";
             report(onStep, stepImage, `Building image for ${stackInfo.stackType}`, "running");
             try {
+                const dockerfilesDir = await resolveRepoDockerfilesDir(projectDir, stackInfo.stackType);
                 autoImage = await ensureImage({
                     stack: stackInfo.stackType,
                     javaVersion: stackInfo.javaVersion,
+                    ...(dockerfilesDir ? { dockerfilesDir } : {}),
                 });
                 report(onStep, stepImage, "Docker image ready", "done");
             }
@@ -586,9 +610,11 @@ async function runRunner(runner, ctx) {
                 }
                 else {
                     report(onStep, stepImage, `Building image for ${runner.name} (${runner.stack})`, "running");
+                    const dockerfilesDir = await resolveRepoDockerfilesDir(projectDir, runner.stack);
                     imageName = await ensureImage({
                         stack: runner.stack,
                         javaVersion: runner.javaVersion,
+                        ...(dockerfilesDir ? { dockerfilesDir } : {}),
                     });
                 }
                 if (!runner.image) {
@@ -1122,10 +1148,12 @@ docker, onOutcome) {
         // SAME relpaths in the SAME order, newline-joined, only for scope:changed
         // (gateChangedFiles defined). path.join for native normalizes a trailing
         // slash; the container form is a POSIX join under a known-absolute root.
-        const nativeAbs = gateChangedFiles &&
-            gateChangedFiles.map((rel) => path.join(projectDir, rel)).join("\n");
-        const containerAbs = gateChangedFiles &&
-            gateChangedFiles.map((rel) => `${CONTAINER_WORKDIR}/${rel}`).join("\n");
+        const nativeAbs = gateChangedFiles
+            ?.map((rel) => path.join(projectDir, rel))
+            .join("\n");
+        const containerAbs = gateChangedFiles
+            ?.map((rel) => `${CONTAINER_WORKDIR}/${rel}`)
+            .join("\n");
         const nativeEnv = {
             ...baseEnv,
             ...injected,

package/dist/lib/docker.js

@@ -27,6 +27,10 @@ export function getDockerfileContent(stack) {
     switch (stack) {
         case "java-gradle":
         case "java-maven":
+            // Java is intentionally NOT digest-pinned: the JAVA_VERSION build
+            // arg lets the user pick a JDK version, so a per-version digest
+            // can't be hardcoded. The ci-local.sh/.ps1 heredocs leave it
+            // floating too, keeping the dockerfile-hash cache consistent.
             return [
                 "ARG JAVA_VERSION=21",
                 "FROM eclipse-temurin:${JAVA_VERSION}-jdk-noble",
@@ -38,7 +42,7 @@ export function getDockerfileContent(stack) {
             ].join("\n");
         case "node":
             return [
-                "FROM node:22-slim",
+                "FROM node:22-slim@sha256:689c11043dad91472750cd824c97dd5e2318e9dd6f954e492fe7af0135d33ceb",
                 "RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*",
                 // Pin pnpm to major 10 to match ci.yml (pnpm/action-setup version:
                 // 10) and the lockfileVersion 9.0 lockfile. Unpinned drifts to
@@ -51,7 +55,7 @@ export function getDockerfileContent(stack) {
             ].join("\n");
         case "python":
             return [
-                "FROM python:3.12-slim",
+                "FROM python:3.12-slim@sha256:401f6e1a67dad31a1bd78e9ad22d0ee0a3b52154e6bd30e90be696bb6a3d7461",
                 "RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*",
                 "RUN pip install --no-cache-dir pytest ruff pylint poetry",
                 "RUN useradd -m -s /bin/bash runner",
@@ -61,7 +65,7 @@ export function getDockerfileContent(stack) {
             ].join("\n");
         case "go":
             return [
-                "FROM golang:1.23-bookworm",
+                "FROM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db",
                 "RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*",
                 "RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.0 && mv /root/go/bin/golangci-lint /usr/local/bin/",
                 "RUN useradd -m -s /bin/bash runner",
@@ -71,7 +75,7 @@ export function getDockerfileContent(stack) {
             ].join("\n");
         case "rust":
             return [
-                "FROM rust:1.83-slim",
+                "FROM rust:1.83-slim@sha256:540c902e99c384163b688bbd8b5b8520e94e7731b27f7bd0eaa56ae1960627ab",
                 "RUN apt-get update && apt-get install -y git pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*",
                 "RUN rustup component add clippy rustfmt",
                 "RUN useradd -m -s /bin/bash runner",
@@ -81,7 +85,7 @@ export function getDockerfileContent(stack) {
             ].join("\n");
         default:
             return [
-                "FROM ubuntu:24.04",
+                "FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b",
                 "RUN apt-get update && apt-get install -y git curl && rm -rf /var/lib/apt/lists/*",
                 "RUN useradd -m -s /bin/bash runner",
                 "USER runner",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.21.2",
+	"version": "1.22.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {