[DOCS]: Pin npm packages with their commit hash in Dockerfile#848
[DOCS]: Pin npm packages with their commit hash in Dockerfile#848MacOS wants to merge 11 commits into
Conversation
MacOS
added
documentation
There was a problem hiding this comment.
Pull request overview
This PR aims to improve the supply-chain security posture of the documentation build container by pinning the Node tooling installed in docs/.docker/Dockerfile, aligning with issue #847’s goal of reducing mutable dependency references and improving OpenSSF Scorecard signals.
Changes:
- Replaces semver/tag-based npm installs for Antora/Mermaid/Kroki tooling with commit-SHA-like specifiers.
- Adds inline comments documenting the intended mapping from SHA to package version.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @antora/cli@aa33c8283f9cbc76df93201bec5f8421e8f59a43 \ | ||
| @antora/site-generator@aa33c8283f9cbc76df93201bec5f8421e8f59a43 \ | ||
| @antora/lunr-extension@41975fc8f62cb2219a2de2f618de1ae1482bd0ce \ | ||
| @mermaid-js/mermaid-cli@a85b11df7064498d5b6b97ee9b2d4a7c10cb42ae \ | ||
| asciidoctor-kroki@d02fbf06cdb837524f5e4e12537c05e0bb83c715 \ |
There was a problem hiding this comment.
I will fix this tomorrow.
There was a problem hiding this comment.
Fixed this by using URLs
| # @antora/cli@aa33c8283f9cbc76df93201bec5f8421e8f59a43 -> v3.1.15 | ||
| # @antora/site-generator@aa33c8283f9cbc76df93201bec5f8421e8f59a43 -> v3.1.15 | ||
| # @antora/lunr-extension@41975fc8f62cb2219a2de2f618de1ae1482bd0ce -> v1.0.0-alpha.8 | ||
| # @mermaid-js/mermaid-cli@a85b11df7064498d5b6b97ee9b2d4a7c10cb42ae -> v11.16.0 | ||
| # asciidoctor-kroki@d02fbf06cdb837524f5e4e12537c05e0bb83c715 -> v0.18 |
There was a problem hiding this comment.
npm pack mathjax@3 is a good point - will be a separate PR because it is not an install but a download.
documenation.yml will be a separate PR.
michalharakal
left a comment
michalharakal
left a comment
There was a problem hiding this comment.
Thank you @MacOS
Note: the failing preview-documentation check is not related to this change — it's a known limitation where fork PRs get a read-only GITHUB_TOKEN, so the "post preview comment" step can't run. Docs build fine and the artifact uploads correctly. Safe to ignore here; a fix to skip that step on fork PRs is coming separately.
…ing with the commit hash works
…he referencing with the commit hash works
…he referencing with the commit hash works
…cing with the commit hash works
…eferencing with the commit hash works
This
PRpins allnpmpackage installations in theDockerfileused in thedocsdirectory with their commit hash to increase security (#847).The OpenSSF Score should increase after this
PRhas been merged.