* perf(ci): cache packaged dependency reify in the docker e2e functional image
Split the shared functional E2E image into manifest -> deps -> app stages so
the 328-package npm reify is layer-keyed on package.json + npm-shrinkwrap.json
alone. Per-PR tarballs (changed dist bytes, unchanged deps) now hit the cached
dependency layer on warm builders (Blacksmith sticky docker layers, local
buildkit) instead of re-running npm install on every build; the per-PR work
drops to manifest extract + package extract + packaged postinstall.
The deps stage reify also matches the shipped shrinkwrap exactly; the previous
npm install -g <tarball> path silently drifted ~15 transitive packages to newer
registry versions and lost the node-domexception -> @nolyfill/domexception
alias. npm install (not npm ci) because the generated shrinkwrap does not
guarantee npm ci's strict manifest sync (p-retry pins @types/retry@0.12.0 while
the shrinkwrap resolves 0.12.5).
Local proof (Apple Silicon, docker-container builder): per-PR warm image build
59s -> 43s with the 29s npm layer CACHED; lane total 164s -> 139s warm,
229s -> 160s cold; system-agent-first-run lane passes end to end, and the
installed tree matches the old image structure except for the documented
version-drift fixes.
* test: update e2e image guard for the staged dependency layer
The guard pinned the retired npm install -g invocation; assert the new
invariants instead: manifest-keyed deps layer, no global-prefix install,
deps COPY into /app, and postinstall ordered before the self-link so its
prune walks cannot cycle.
Refresh pinned node:24-bookworm and node:24-bookworm-slim manifest-list digests across the root, smoke, and e2e Dockerfiles. Update digest pin assertions to cover the plugin-binding e2e Dockerfile.
Verified with live Docker digest inspection, targeted Dockerfile tests, root base-runtime build, install-sh smoke build, and plugin-binding e2e build.
Thanks @LibraHo.
* fix(docker): pin base images to SHA256 digests for supply chain security
Pin all 9 Dockerfiles to immutable SHA256 digests to prevent supply chain
attacks where a compromised upstream image could be silently pulled into
production builds.
Also add Docker ecosystem to Dependabot configuration for automated
digest updates.
Images pinned:
- node:22-bookworm@sha256:cd7bcd2e7a1e6f72052feb023c7f6b722205d3fcab7bbcbd2d1bfdab10b1e935
- node:22-bookworm-slim@sha256:3cfe526ec8dd62013b8843e8e5d4877e297b886e5aace4a59fec25dc20736e45
- debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
- ubuntu:24.04@sha256:cd1dba651b3080c3686ecf4e3c4220f026b521fb76978881737d24f200828b2b
Fixes#7731
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(docker): add digest pinning regression coverage
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
