npm - passbolt-styleguide - Versions diffs - 5.14.0-alpha.2 → 5.14.0-alpha.4 - Mend

@@ -10,6 +10,36 @@ RUN chmod 0644 /etc/profile.d/safe-chain-shims.sh \
     >> /etc/bash.bashrc
 ENV PATH="/home/node/.safe-chain/shims:${PATH}"
-RUN curl -fsSL https://claude.ai/install.sh | bash -s stable \
-    && cp /root/.local/bin/claude /usr/local/bin/claude
+# Install Claude Code CLI by downloading the release binary directly and verifying it
+# against Anthropic's GPG-signed manifest — no remote install script is ever executed.
+# Bump CLAUDE_VERSION to upgrade (>= 2.1.89 required for signed manifests).
+# Key fingerprint + manifest scheme: https://code.claude.com/docs/en/setup#binary-integrity-and-code-signing
+# The per-version binary URL ("$base/$CLAUDE_VERSION/$platform/claude") is the path the
+# official installer uses to fetch the binary (de-facto stable; not formally documented).
+ARG CLAUDE_VERSION=2.1.176
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg jq; \
+    rm -rf /var/lib/apt/lists/*; \
+    case "$(dpkg --print-architecture)" in \
+      amd64) platform=linux-x64 ;; \
+      arm64) platform=linux-arm64 ;; \
+      *) echo "Unsupported architecture" >&2; exit 1 ;; \
+    esac; \
+    export GNUPGHOME="$(mktemp -d)"; \
+    curl -fsSL https://downloads.claude.ai/keys/claude-code.asc | gpg --batch --import; \
+    gpg --batch --fingerprint security@anthropic.com \
+      | grep -q '31DD DE24 DDFA B679 F42D  7BD2 BAA9 29FF 1A7E CACE'; \
+    base=https://downloads.claude.ai/claude-code-releases; \
+    curl -fsSL "$base/$CLAUDE_VERSION/manifest.json"     -o /tmp/manifest.json; \
+    curl -fsSL "$base/$CLAUDE_VERSION/manifest.json.sig" -o /tmp/manifest.json.sig; \
+    gpg --batch --verify /tmp/manifest.json.sig /tmp/manifest.json; \
+    expected="$(jq -r ".platforms[\"$platform\"].checksum" /tmp/manifest.json)"; \
+    curl -fsSL "$base/$CLAUDE_VERSION/$platform/claude" -o /tmp/claude; \
+    echo "$expected  /tmp/claude" | sha256sum -c -; \
+    install -d -o node -g node /home/node/.local/bin; \
+    install -o node -g node -m 0755 /tmp/claude /home/node/.local/bin/claude; \
+    gpgconf --kill all; \
+    rm -rf "$GNUPGHOME" /tmp/manifest.json /tmp/manifest.json.sig /tmp/claude; \
+    /home/node/.local/bin/claude --version
+ENV PATH="/home/node/.local/bin:${PATH}"

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "1.3.5",
+      "resolved": "ghcr.io/devcontainers/features/git@sha256:27905dc196c01f77d6ba8709cb82eeaf330b3b108772e2f02d1cd0d826de1251",
+      "integrity": "sha256:27905dc196c01f77d6ba8709cb82eeaf330b3b108772e2f02d1cd0d826de1251"
+    }
+  }
+}

@@ -15,6 +15,5 @@ if [ "$ERRORS" -gt 0 ]; then
   echo "WARNING: $ERRORS mount(s) missing. Claude Code may not work correctly."
 fi
-echo "==> Updating Claude Code..."
-curl -fsSL https://claude.ai/install.sh | bash -s stable
+echo "==> Claude Code version:"
 claude --version

@@ -3,11 +3,12 @@ on:
   push:
     tags:
       - "*"
-permissions:
-  contents: write
+permissions: {}
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout 🛎️
         uses: actions/checkout@v3

@@ -1,3 +1 @@
-# v5.14.0-alpha.2
-This is a tag to test new CI implementation
+# v5.14.0-alpha.3

@@ -1,7 +1,7 @@
 /*!
 * @name					passbolt-styleguide
-* @version			v5.14.0-alpha.2
-* @date					2026-06-12
+* @version			v5.14.0-alpha.4
+* @date					2026-06-24
 * @copyright		Copyright 2023 Passbolt SA
 * @source				https://github.com/passbolt/passbolt_styleguide
 * @license			AGPL-3.0

passbolt-styleguide 5.14.0-alpha.2 → 5.14.0-alpha.4