fix(build): force no-cache so images stop shipping stale ca-certificates by bedatty · Pull Request #954 · LerianStudio/github-actions-shared-workflows

bedatty · 2026-10-21T16:32:44Z

Description

Hotfix for the image builds: with cache-from: type=gha, BuildKit replays the cached apk/apt layer, so a rebuild resolves no packages and the published image keeps shipping the vulnerable ca-certificates (https://emudhra.we-have-a-problem.com/). Rebuilding a consumer repo today does not actually fix its image.

no-cache: true and pull: true are set on the three publishing steps:

.github/workflows/build.yml — Build image for verification
.github/workflows/build.yml — Build and push Docker image
src/build/docker-build-ts/action.yml — Build and push Docker image

no-cache covers the first path: it marks every vertex non-cacheable, so the imported gha cache is ignored and the apk/apt step actually runs. It does not re-resolve the base image, so a ca-certificates that ships inside FROM would survive it — on an ephemeral runner the base usually is pulled fresh, but that is incidental, not a guarantee. pull closes that second path.

cache-to: type=gha,mode=max is kept on purpose: the clean layers are still exported, so the first build after the revert starts from a healthy cache instead of the poisoned one.

Not touched, because neither publishes an image and neither reads the gha cache: pr-security-scan.yml (scan build) and frontend-pr-analysis.yml (smoke-test build).

This is temporary, and it is not cheap. build.yml runs two builds per component — the verification build (load: true) exists precisely so its layers land in the gha cache and the multi-arch push build reuses them (see the comment at build.yml:714). With no-cache on both, that reuse is gone: every job now compiles the image twice from scratch. Revert tracked in #953, to be applied once every consumer repo has been rebuilt and redeployed.

Type of Change

feat: New workflow or new input/output/step in an existing workflow
fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
perf: Performance improvement (e.g. caching, parallelism, reduced steps)
refactor: Internal restructuring with no behavior change
docs: Documentation only (README, docs/, inline comments)
ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
chore: Dependency bumps, config updates, maintenance
test: Adding or updating tests
BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None. No input, output or default changes for callers — only build duration is affected.

Testing

YAML syntax validated locally
Triggered a real workflow run on a caller repository using @this-branch or the beta tag
Verified all existing inputs still work with default values
Confirmed no secrets or tokens are printed in logs
Checked that unrelated workflows are not affected

Caller repo / workflow run: none yet — no run was triggered on a consumer repo before opening this PR.

Related Issues

Tracking: #953 (revert of this mitigation — must NOT be closed by this PR)

The gha cache replays the old apk/apt layer, so a rebuild resolves no packages and the published image keeps the vulnerable ca-certificates. Set no-cache on the three publishing build-push steps. cache-to is kept on purpose: the clean layers are still exported, so the first build after the revert starts from a healthy cache. Temporary - revert once every repo is rebuilt and redeployed (#953).

coderabbitai · 2026-10-21T16:32:58Z

Walkthrough

Docker build steps in the verification workflow, publish workflow, and TypeScript build action now set no-cache: true. The TypeScript action retains its GHA cache import and export configuration.

Changes

Docker build cache behavior

Layer / File(s)	Summary
Disable Docker layer-cache reuse `.github/workflows/build.yml`, `src/build/docker-build-ts/action.yml`	The verification and publish workflow steps and the TypeScript build action set `no-cache: true`. The workflow steps include comments about the affected cached certificate layer. The action retains GHA cache import and export configuration.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Possibly related issues

LerianStudio/streaming-hub issue 172 describes an unresolved runtime CA-image gate associated with stale package layers. This PR disables layer-cache reuse for the listed Docker builds, matching the issue’s stated objective of bypassing cached layers.

Suggested reviewers: fredcamaral

Merge Risk: 🔵 Low · up to 22e53

The change is mergeable, but the workaround comments should clearly distinguish cached rebuilds from the no-cache mitigation.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: it sets no-cache on image build steps so published images stop shipping stale ca-certificates. It follows the fix(build) convention and is specific enough for a teamma…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description includes all required sections, identifies the affected workflows, explains the fix and temporary behavior, states that there are no breaking changes, documents testing status, and ref…

Full details: Title check

Explanation

The title names the main change: it sets no-cache on image build steps so published images stop shipping stale ca-certificates. It follows the fix(build) convention and is specific enough for a teammate scanning history.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Description check

Explanation

The description includes all required sections, identifies the affected workflows, explains the fix and temporary behavior, states that there are no breaking changes, documents testing status, and references issue #953. No caller workflow run was performed, but the description clearly records this limitation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

lerian-studio · 2026-10-21T16:33:25Z

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	2 file(s)	✅ success
Action Lint	1 file(s)	✅ success
Pinned Actions	2 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	2 file(s)	✅ success
Shell Check	2 file(s)	✅ success
README Check	2 file(s)	✅ success
Composite Schema	1 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

_{🔍 View full scan logs}

lerian-studio · 2026-10-21T16:33:35Z

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 1 issue(s): 1 Medium

Severity	Rule	File	Message
🟡 Medium	`actions/untrusted-checkout/medium`	`.github/workflows/build.yml:327`	Potential unsafe checkout of untrusted pull request on non-privileged workflow.

_{🔍 View full scan logs | 🛡️ Security tab}

lerian-studio · 2026-10-21T16:33:43Z

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
Commit Signatures	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

_{🔍 View workflow run}

no-cache re-runs every Dockerfile step, but it does not re-resolve the base image: a ca-certificates that ships inside FROM survives it. On an ephemeral runner the base usually is pulled fresh, which makes the gap incidental rather than guaranteed. Set pull on the same three publishing steps so both paths are closed. Temporary - reverted together with no-cache (#953).

The note was in the present tense next to the line that disables the behaviour it describes, so it could read as if the no-cache build were the one keeping the bad package. Scope it to the cached rebuild.

lerian-studio · 2026-10-21T16:42:34Z

@coderabbitai review

coderabbitai · 2026-10-21T16:42:43Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-10-21T16:43:16Z

❌ Action failed

Review failed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

bedatty requested a review from a team as a code owner October 21, 2026 16:32

lerian-studio assigned bedatty Oct 21, 2026

lerian-studio added size/XS PR changes < 50 lines workflow Changes to one or more reusable workflow files composite Changes to any composite action manifest (src/**/*.yml) build Changes to build and artifact composite actions (src/build/) labels Oct 21, 2026

This comment has been minimized.

Sign in to view

lerian-studio added the review-ready Required checks passed — CodeRabbit is cleared to review label Oct 21, 2026

This comment has been minimized.

Sign in to view

This comment was marked as resolved.

Sign in to view

bedatty mentioned this pull request Oct 21, 2026

feat: revert the temporary no-cache on docker builds once every repo is rebuilt #953

Open

2 tasks done

This comment has been minimized.

Sign in to view

docs(build): say which rebuild ships the stale ca-certificates

7ef33b4

The note was in the present tense next to the line that disables the behaviour it describes, so it could read as if the no-cache build were the one keeping the bad package. Scope it to the cached rebuild.

ferr3ira-gabriel approved these changes Oct 21, 2026

View reviewed changes

bedatty merged commit e49a88f into main Oct 21, 2026
48 checks passed

bedatty mentioned this pull request Oct 21, 2026

docs(build): document the temporary no-cache on docker builds #955

Merged

5 of 14 tasks

Navigation Menu

Repository navigation

fix(build): force no-cache so images stop shipping stale ca-certificates - #954

fix(build): force no-cache so images stop shipping stale ca-certificates#954
bedatty merged 3 commits into
mainfrom
hotfix/docker-build-no-cache

bedatty commented Oct 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Oct 21, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Oct 21, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Oct 21, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment was marked as resolved.

Uh oh!

This comment has been minimized.

lerian-studio commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bedatty commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of Change

Breaking Changes

Testing

Related Issues

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

lerian-studio commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Lint Analysis

Uh oh!

lerian-studio commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ CodeQL Analysis Results

Uh oh!

lerian-studio commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment was marked as resolved.

Uh oh!

This comment has been minimized.

lerian-studio commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bedatty commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

lerian-studio commented Oct 21, 2026 •

edited

Loading

lerian-studio commented Oct 21, 2026 •

edited

Loading

lerian-studio commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading