[PM-39586] Bump self-host image version and switch to hash pinning

[jprusik]

🎟️ Tracking

PM-39586

Summary

There is a known issue with node-fetch. I fixed it in BIT's shell script for account creation by dropping cross-fetch and using the native node fetch, but the cipher seeding script still fails because it uses the CLI API, and the CLI bundles node-fetch 2.7.0 : https://github.com/bitwarden/clients/blob/main/apps/cli/package.json#L84

But, that's been pinned there for quite some time, and this bad interaction is recent. (a self-host image rewrite happened some time between Jun 25, 4:53 AM EDT (last good BIT run with 2026.6.0 ) and Jun 25, 5:05 AM EDT (the first failure with this error on the rewritten 2026.6.0 image).

Because 2026.6.0 was working, and then broke when 2026.6.1 was tagged, I'm presuming the breaking change came with 2026.6.1 and not 2026.6.0

I was able to get BIT working again by ad-hoc patching node-fetch bundled with the CLI in the test workflows, but local usage will continue to be bugged until addressed either by the server or CLI client

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed a test-infrastructure PR that bumps the self-host lite image to 2026.6.1 and switches both image references to digest (hash) pinning, adds a Renovate custom regex manager to keep hash-pinned images current, bumps the @bitwarden/cli to 2026.6.0, and removes the cross-fetch dependency in favor of Node 24's native fetch. It also adds a temporary CI workaround that patches the CLI's bundled node-fetch v2 for the PM-39403 premature-close bug, plus a step that waits for admin DB migrations before seeding.

Code Review Details

No blocking findings.

Notes from analysis (no action required):

• cross-fetch removal is complete — all three import fetch from "cross-fetch" sites are gone and no references remain; Node 24 provides global fetch (generate-installation.ts already relied on it).
• The Renovate custom regex matches the final docker-compose.yml digest-plus-comment format for both the lite and mariadb images.
• The node-fetch sed patch is explicitly marked FIXME/temporary, scoped to CI test tooling, and includes a self-checking guard that warns if the bundled file shape changes — pragmatic for the stated bug.

Dependency Changes

Package	Change	Ecosystem
cross-fetch	Removed	npm
@bitwarden/cli	2026.4.1 → 2026.6.0	npm

[jprusik]

This PR addresses a shared root cause in bitwarden/clients#21431

[jprusik]

hash pinning since tagged images are not immutable; as things currently stand, this may mean targeted images go away unceremoniously if this falls out of date

[jprusik]

meant to ensure renovate keeps the images up-to-date on the basis of their hash, and not tag

[jprusik]

Server returns a success signal before migrations have finished. We previously solved this by retrying account creation over and over; that's still in, but now we wait for a more authoritative success signal. This remains unaddressed for local runs.

[audreyality]

♻️ This PR is taking on a pile of tech debt. I recommend we track that somewhere.

💭 It's very clever to patch node-fetch to work around the premature close.