Skip to content

Commit 8b93e66

Browse files
mark-e-deyoungmark-e-deyoung
committed
refresh release base image and actions
1 parent 5668f55 commit 8b93e66

16 files changed

Lines changed: 101 additions & 54 deletions

‎.github/workflows/approved-issues-only.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Enforce invite-only issue participation
21-
uses: actions/github-script@v7
21+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
2222
with:
2323
script: |
2424
const owner = context.repo.owner;

‎.github/workflows/approved-prs-only.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Enforce invite-only PR participation
22-
uses: actions/github-script@v7
22+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
2323
with:
2424
script: |
2525
const owner = context.repo.owner;

‎.github/workflows/base-image.yml‎

Lines changed: 41 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
workflow_dispatch:
55
inputs:
66
base_version:
7-
description: Base image version tag (e.g. base-2026-02-09)
7+
description: Base image version tag (e.g. base-2026-05-04)
88
required: true
99
update_base_stable:
1010
description: Also move base-stable tag
@@ -26,9 +26,9 @@ jobs:
2626
runs-on: ubuntu-latest
2727
timeout-minutes: 90
2828
steps:
29-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
30-
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
31-
- uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
30+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
31+
- uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
3232
with:
3333
registry: ghcr.io
3434
username: ${{ github.repository_owner }}
@@ -37,12 +37,15 @@ jobs:
3737
- name: Prepare base tags
3838
id: meta
3939
run: |
40-
image="ghcr.io/${{ github.repository_owner }}/winebot-base"
40+
owner_lc="$(printf '%s' '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
41+
image="ghcr.io/${owner_lc}/winebot-base"
4142
version="${{ github.event.inputs.base_version }}"
4243
if [[ ! "$version" =~ ^[A-Za-z0-9._-]{1,128}$ ]]; then
4344
echo "Invalid base_version: $version" >&2
4445
exit 1
4546
fi
47+
echo "image=${image}" >> "$GITHUB_OUTPUT"
48+
echo "version=${version}" >> "$GITHUB_OUTPUT"
4649
{
4750
echo "tags<<EOF"
4851
echo "${image}:${version}"
@@ -53,13 +56,39 @@ jobs:
5356
echo "EOF"
5457
} >> "$GITHUB_OUTPUT"
5558
56-
- name: Build & push base-runtime
59+
- name: Build base image for validation
60+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
61+
with:
62+
context: .
63+
file: docker/base.Dockerfile
64+
target: final
65+
load: true
66+
push: false
67+
tags: winebot-base:${{ steps.meta.outputs.version }}
68+
cache-from: type=gha
69+
cache-to: type=gha,mode=max
70+
71+
- name: Scan base image (Trivy)
72+
run: |
73+
mkdir -p "${GITHUB_WORKSPACE}/.cache/trivy"
74+
docker run --rm \
75+
-v /var/run/docker.sock:/var/run/docker.sock \
76+
-v "${GITHUB_WORKSPACE}/.cache/trivy:/root/.cache/trivy" \
77+
aquasec/trivy:0.65.0 image \
78+
--scanners vuln \
79+
--format table \
80+
--exit-code 1 \
81+
--ignore-unfixed \
82+
--severity CRITICAL,HIGH \
83+
"winebot-base:${{ steps.meta.outputs.version }}"
84+
85+
- name: Build & push base image
5786
id: build
58-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
87+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
5988
with:
6089
context: .
61-
file: docker/Dockerfile
62-
target: base-ready
90+
file: docker/base.Dockerfile
91+
target: final
6392
push: true
6493
tags: ${{ steps.meta.outputs.tags }}
6594
cache-from: type=gha
@@ -68,14 +97,15 @@ jobs:
6897
sbom: true
6998

7099
- name: Install cosign
71-
uses: sigstore/cosign-installer@430b6a704fe0c92f1b1261d84376a900f38d90ff
100+
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003
72101

73102
- name: Sign base digest
74103
env:
104+
IMAGE: ${{ steps.meta.outputs.image }}
75105
DIGEST: ${{ steps.build.outputs.digest }}
76106
run: |
77107
if [ -z "$DIGEST" ]; then
78108
echo "Missing base digest from build" >&2
79109
exit 1
80110
fi
81-
cosign sign --yes "ghcr.io/${{ github.repository_owner }}/winebot-base@${DIGEST}"
111+
cosign sign --yes "${IMAGE}@${DIGEST}"

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
name: Pre-flight (Lint & Unit)
3030
runs-on: ubuntu-latest
3131
steps:
32-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
3333
- name: Verify capability matrix references
3434
run: python3 scripts/ci/verify-capability-matrix.py
3535
- name: Build lint runner

‎.github/workflows/nightly-soak.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,17 @@ jobs:
2121
runs-on: ubuntu-latest
2222
timeout-minutes: 90
2323
steps:
24-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
25-
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
25+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
2626

2727
- name: Build REL image
28-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
28+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
2929
with:
3030
context: .
3131
file: docker/Dockerfile
3232
target: intent-rel
3333
build-args: |
34-
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/mark-e-deyoung/winebot-base:base-2026-02-09' }}
34+
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/sempersupra/winebot-base:base-2026-05-04' }}
3535
BUILD_INTENT=rel
3636
load: true
3737
push: false
@@ -85,7 +85,7 @@ jobs:
8585
scripts/ci/generate-trust-pack.sh artifacts/trust-pack-nightly
8686
8787
- name: Upload trust pack
88-
uses: actions/upload-artifact@v4
88+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
8989
with:
9090
name: trust-pack-nightly
9191
path: artifacts/trust-pack-nightly
@@ -118,7 +118,7 @@ jobs:
118118
119119
- name: Upload failure diagnostics artifact
120120
if: failure()
121-
uses: actions/upload-artifact@v4
121+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
122122
with:
123123
name: nightly-failure-diagnostics
124124
path: ${{ github.workspace }}/artifacts/nightly-failure

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
timeout-minutes: 5
2727
steps:
2828
- name: Validate release guardrails
29-
uses: actions/github-script@v7
29+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
3030
with:
3131
script: |
3232
if (context.eventName !== "release") {
@@ -101,8 +101,8 @@ jobs:
101101
sudo rm -rf "/usr/local/share/boost"
102102
sudo rm -rf /usr/share/swift
103103
df -h
104-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
105-
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
104+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
105+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
106106
- name: Set image tags (REL)
107107
id: meta_rel
108108
run: |
@@ -179,20 +179,20 @@ jobs:
179179
echo "${image}:sha-${GITHUB_SHA::7}-rel-runner"
180180
echo "EOF"
181181
} >> "$GITHUB_OUTPUT"
182-
- uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
182+
- uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
183183
with:
184184
registry: ghcr.io
185185
username: ${{ github.repository_owner }}
186186
password: ${{ secrets.GITHUB_TOKEN }}
187187
- name: Build & push
188188
id: build
189-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
189+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
190190
with:
191191
context: .
192192
file: docker/Dockerfile
193193
target: intent-rel
194194
build-args: |
195-
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/mark-e-deyoung/winebot-base:base-2026-02-13' }}
195+
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/sempersupra/winebot-base:base-2026-05-04' }}
196196
BUILD_INTENT=rel
197197
VCS_REF=${{ github.sha }}
198198
BUILD_DATE=${{ github.run_id }}
@@ -205,13 +205,13 @@ jobs:
205205
sbom: true
206206
- name: Build & push REL-RUNNER
207207
id: build_runner
208-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
208+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
209209
with:
210210
context: .
211211
file: docker/Dockerfile
212212
target: intent-rel-runner
213213
build-args: |
214-
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/mark-e-deyoung/winebot-base:base-2026-02-13' }}
214+
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/sempersupra/winebot-base:base-2026-05-04' }}
215215
BUILD_INTENT=rel-runner
216216
VCS_REF=${{ github.sha }}
217217
BUILD_DATE=${{ github.run_id }}
@@ -223,7 +223,7 @@ jobs:
223223
provenance: mode=max
224224
sbom: true
225225
- name: Install cosign
226-
uses: sigstore/cosign-installer@430b6a704fe0c92f1b1261d84376a900f38d90ff
226+
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003
227227
- name: Sign image digest (keyless OIDC)
228228
env:
229229
IMAGE: ${{ steps.meta_rel.outputs.image }}
@@ -261,7 +261,7 @@ jobs:
261261
sudo rm -rf /usr/share/swift
262262
df -h
263263
- name: Install cosign
264-
uses: sigstore/cosign-installer@430b6a704fe0c92f1b1261d84376a900f38d90ff
264+
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003
265265
- name: Verify signature
266266
env:
267267
IMAGE: ${{ needs.publish.outputs.image }}

‎.github/workflows/reusable-build-smoke-gate.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -78,22 +78,22 @@ jobs:
7878
sudo rm -rf /usr/share/swift
7979
df -h
8080
81-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
81+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
8282

8383
- name: Verify capability matrix references
8484
if: ${{ inputs.verify_capability_matrix }}
8585
run: python3 scripts/ci/verify-capability-matrix.py
8686

87-
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
87+
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
8888

8989
- name: Build image for validation
90-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
90+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
9191
with:
9292
context: .
9393
file: docker/Dockerfile
9494
target: ${{ inputs.image_target }}
9595
build-args: |
96-
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/mark-e-deyoung/winebot-base:base-2026-02-13' }}
96+
BASE_IMAGE=${{ vars.WINEBOT_BASE_IMAGE || 'ghcr.io/sempersupra/winebot-base:base-2026-05-04' }}
9797
BUILD_INTENT=${{ inputs.build_intent }}
9898
VCS_REF=${{ github.sha }}
9999
BUILD_DATE=${{ github.run_id }}
@@ -181,7 +181,7 @@ jobs:
181181

182182
- name: Upload trust pack
183183
if: ${{ inputs.generate_trust_pack }}
184-
uses: actions/upload-artifact@v4
184+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
185185
with:
186186
name: ${{ inputs.trust_pack_artifact_name }}
187187
path: ${{ inputs.trust_pack_dir }}

‎README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,12 @@ See [docs/feature-capability-commit-map.md](docs/feature-capability-commit-map.m
9494
Auto-generate a draft from recent commit subjects:
9595
`./scripts/wb feature-map 200`
9696

97+
Daily status / handoff:
98+
99+
See latest status note: [archive/status/STATUS-2026-03-12.md](archive/status/STATUS-2026-03-12.md)
100+
101+
Status history: [archive/status/](archive/status/)
102+
97103
Test capability coverage matrix:
98104

99105
See [docs/test-capability-matrix.md](docs/test-capability-matrix.md).
@@ -139,7 +145,7 @@ Base runtime can be pinned independently:
139145

140146
`BASE_IMAGE=ghcr.io/<owner>/winebot-base:<base-version>`
141147

142-
CI/release builds read repository variable `WINEBOT_BASE_IMAGE` (fallback is `ghcr.io/SemperSupra/winebot-base:base-2026-02-09`).
148+
CI/release builds read repository variable `WINEBOT_BASE_IMAGE` (fallback is `ghcr.io/sempersupra/winebot-base:base-2026-05-04`).
143149

144150
In `rel` and `rel-runner`, default logging is capped (`WARN`). Enable bounded support mode for triage:
145151

‎compose/docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ x-winebot-base: &winebot_base
4343
dockerfile: docker/Dockerfile
4444
target: intent-${BUILD_INTENT:-rel}
4545
args:
46-
BASE_IMAGE: ${BASE_IMAGE:-ghcr.io/mark-e-deyoung/winebot-base:base-2026-02-13}
46+
BASE_IMAGE: ${BASE_IMAGE:-ghcr.io/sempersupra/winebot-base:base-2026-05-04}
4747
VCS_REF: ${VCS_REF:-local}
4848
BUILD_DATE: ${BUILD_DATE:-local}
4949
SOURCE_REPO: ${SOURCE_REPO:-https://github.com/sempersupra/winebot}

‎docker/Dockerfile‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# Pinned to debian:trixie-slim as of 2026-02-08
2-
ARG BASE_IMAGE=ghcr.io/sempersupra/winebot-base:base-2026-02-13
1+
# Pinned to digest-based Debian Trixie base published by .github/workflows/base-image.yml.
2+
ARG BASE_IMAGE=ghcr.io/sempersupra/winebot-base:base-2026-05-04
33
ARG VCS_REF=unknown
44
ARG BUILD_DATE=unknown
55
ARG SOURCE_REPO="https://github.com/SemperSupra/WineBot"
@@ -27,8 +27,8 @@ RUN bash /download_tool.sh "AutoHotkey" \
2727

2828
FROM tool-base AS builder-python
2929
RUN bash /download_tool.sh "Python" \
30-
"https://www.python.org/ftp/python/3.13.12/python-3.13.12-embed-amd64.zip" \
31-
"76f238f606250c87c6beac75dccd35ee99070a13490555936abb6cb64ecce3d0" \
30+
"https://www.python.org/ftp/python/3.13.13/python-3.13.13-embed-amd64.zip" \
31+
"8766a8775746235e23cf5aee5027ab1060bb981d93110577adcf3508aa0cbd55" \
3232
"/opt/winebot/windows-tools/Python" \
3333
&& find /opt/winebot/windows-tools -name "*.txt" -delete
3434

@@ -53,8 +53,18 @@ RUN id -u winebot >/dev/null 2>&1 || useradd -m -u 1000 -s /bin/bash winebot \
5353
# Keep base OS packages at patched security levels for release gates.
5454
RUN apt-get update \
5555
&& apt-get install -y --no-install-recommends --only-upgrade \
56+
imagemagick \
57+
imagemagick-7-common \
58+
imagemagick-7.q16 \
59+
libmagickcore-7.q16-10 \
60+
libmagickwand-7.q16-10 \
61+
libngtcp2-16 \
5662
libpng16-16t64 \
63+
libssl3t64 \
64+
libtiff6 \
5765
libvpx9 \
66+
openssl \
67+
openssl-provider-legacy \
5868
&& apt-get clean \
5969
&& rm -rf /var/lib/apt/lists/*
6070

0 commit comments

Comments
 (0)