[VS-NfD] Pin the Node version #236

New Issue

fable-5 · 2026-07-30T01:44:02+02:00

fable-5 commented

2026-07-30 01:44:02 +02:00

Plan reference: n/a — 10-ist-aufnahme.md -> I-26
ADR: ADR 0024
Effort: S (0,5 AT)
Depends on: —

Context

A reproducible offline build cannot rest on "any Node ≥ 22". This is a
precondition for the reproducibility claim in #219, which is why it lands
before the offline milestone.

Current state

package.json:7–10: "engines": { "node": ">=22" } — a lower bound, not
a pin. "packageManager": "pnpm@11.9.0" is exact, so the pattern for
pinning is already established in the same file.
Dockerfiles and CI (.gitea/workflows/ci.yml, actions/setup-node@v4)
each select a version independently.

Acceptance criteria

One authoritative Node version is declared and consumed by CI, the
Dockerfiles and local development; a drift between them fails CI.
The update procedure for that version is documented (it will need
raising for security fixes).
The version is stated in #228 alongside the other toolchain
versions.

Out of scope

Changing the Node major, and pinning image digests (#203).

**Plan reference:** n/a — `10-ist-aufnahme.md` -> I-26 **ADR:** ADR 0024 **Effort:** S (0,5 AT) **Depends on:** — ## Context A reproducible offline build cannot rest on "any Node ≥ 22". This is a precondition for the reproducibility claim in #219, which is why it lands before the offline milestone. ## Current state - `package.json:7–10`: `"engines": { "node": ">=22" }` — a lower bound, not a pin. `"packageManager": "pnpm@11.9.0"` is exact, so the pattern for pinning is already established in the same file. - Dockerfiles and CI (`.gitea/workflows/ci.yml`, `actions/setup-node@v4`) each select a version independently. ## Acceptance criteria - [ ] One authoritative Node version is declared and consumed by CI, the Dockerfiles and local development; a drift between them fails CI. - [ ] The update procedure for that version is documented (it will need raising for security fixes). - [ ] The version is stated in #228 alongside the other toolchain versions. ## Out of scope Changing the Node major, and pinning image digests (#203).

fable-5 added this to the M25 — VS-NfD: hardening & supply chain milestone 2026-07-30 01:44:02 +02:00

fable-5 added the

vs-nfd

effort:S

area:supply-chain

labels 2026-07-30 01:44:02 +02:00

fable-5 referenced this issue from a commit

2026-07-31 04:14:56 +02:00

#236: pin the Node version

fable-5 referenced this issue

2026-07-31 04:15:07 +02:00

#236: pin the Node version #257

fable-5 referenced this issue from a commit

2026-07-31 04:16:09 +02:00

#236: also pin the node helper images in workflows

fable-5 referenced this issue

2026-07-31 04:22:13 +02:00

#202: SBOM and license report in CI #258

fable-5 referenced this issue

2026-07-31 04:32:42 +02:00

#199: SHA-256 integrity hashes for attachments #259

fable-5 commented

2026-07-31 04:33:07 +02:00

Implemented in PR #257 (commits 6a520e2 + 9326177, CI run 520 green, fast-forward merged per Stefan's standing go-ahead for this issue block).

Evidence against the acceptance criteria:

One authoritative version: .node-version (22.15.1 — the patch the previously floating 22.15 tag already resolved to). Consumed by CI/CD via node-version-file (3 ci.yml jobs + cd.yml), by all four Dockerfiles (node:22.15.1-alpine), by the throwaway helper containers in release.yml/drill.yml, and offered to local development via the .node-version convention (engines floor raised to >=22.15.1, open-ended upwards).
Drift fails CI: new early step 'Node version pin is consistent' checks Dockerfile tags, forbids literal node-version: in workflows, checks helper-image refs and the engines floor; positive and negative case tested locally.
Update procedure documented in docs/architecture/operations.md (Update strategy).
Toolchain versions for #228: Node 22.15.1 (.node-version), pnpm 11.9.0 (packageManager), postgres 17.5-alpine (CI service/stage compose), pandoc/core:3.6 (fixtures), gotenberg 8 (compose; digest pinning is #203).

CD verification follows on the main-push run.

Implemented in PR #257 (commits 6a520e2 + 9326177, CI run 520 green, fast-forward merged per Stefan's standing go-ahead for this issue block). Evidence against the acceptance criteria: - One authoritative version: .node-version (22.15.1 — the patch the previously floating 22.15 tag already resolved to). Consumed by CI/CD via node-version-file (3 ci.yml jobs + cd.yml), by all four Dockerfiles (node:22.15.1-alpine), by the throwaway helper containers in release.yml/drill.yml, and offered to local development via the .node-version convention (engines floor raised to >=22.15.1, open-ended upwards). - Drift fails CI: new early step 'Node version pin is consistent' checks Dockerfile tags, forbids literal node-version: in workflows, checks helper-image refs and the engines floor; positive and negative case tested locally. - Update procedure documented in docs/architecture/operations.md (Update strategy). - Toolchain versions for #228: Node 22.15.1 (.node-version), pnpm 11.9.0 (packageManager), postgres 17.5-alpine (CI service/stage compose), pandoc/core:3.6 (fixtures), gotenberg 8 (compose; digest pinning is #203). CD verification follows on the main-push run.

fable-5 closed this issue

2026-07-31 04:33:08 +02:00

fable-5 referenced this issue

2026-07-31 04:33:22 +02:00

[VS-NfD] Write the security documentation (architecture, data flows, network plan, ports, trust boundaries) #228

fable-5 referenced this issue from a commit

2026-07-31 05:13:14 +02:00

#203: pin all third-party deploy images by digest

fable-5 referenced this issue

2026-07-31 05:13:26 +02:00

#203: pin all third-party deploy images by digest #262

fable-5 referenced this issue