I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
Verify the Node download and pin pnpm in the Actions image
Check the Node tarball against the digest nodejs.org publishes for it, as the runner already is, and install an exact pnpm version so rebuilds of the image match. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Seto Elkahfi committed
Nov 1, 2026 at 11:01 UTC
ae7bc07d6174a59ad5ddbe98b2801f784e4cf082
2 files changed
+13
-5
packaging/actions-runner/Dockerfile
+11
-5
@@ -29,7 +29,9 @@ ARG RUNNER_VERSION=2.338.2
29
# sha256 of actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz, from the release notes.
30
ARG RUNNER_SHA256=baebf204307bac6193480852732f0aba2ae97b6c5597c244f4d5558390147c40
31
ARG NODE_VERSION=24.12.0
32
-ARG PNPM_VERSION=10
32
+# sha256 of node-v${NODE_VERSION}-linux-x64.tar.xz, from SHASUMS256.txt in the same dist directory.
33
+ARG NODE_SHA256=bdebee276e58d0ef5448f3d5ac12c67daa963dd5e0a9bb621a53d1cefbc852fd
34
+ARG PNPM_VERSION=10.34.9
35
36
ENV DEBIAN_FRONTEND=noninteractive
37
@@ -52,10 +54,14 @@ RUN install -d -m 0755 /etc/apt/keyrings \
54
&& apt-get install -y --no-install-recommends gh \
55
&& rm -rf /var/lib/apt/lists/*
56
55
-# Node from nodejs.org, then pnpm.
56
-RUN curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
57
- | tar -xJ -C /usr/local --strip-components=1 \
58
- && npm install -g "pnpm@${PNPM_VERSION}"
57
+# Node from nodejs.org, checked against its published digest, then pnpm at an exact version.
58
+RUN set -eu; \
59
+ curl -fsSL --retry 2 -o /tmp/node.tar.xz \
60
+ "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"; \
61
+ echo "${NODE_SHA256} /tmp/node.tar.xz" | sha256sum -c -; \
62
+ tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1; \
63
+ rm /tmp/node.tar.xz; \
64
+ npm install -g "pnpm@${PNPM_VERSION}"
65
66
# The Actions runner, checked against the published digest, with its system dependencies. The
67
# runner refuses to start as root unless RUNNER_ALLOW_RUNASROOT is set; the host sets it, since
packaging/actions-runner/README.md
+2
@@ -7,6 +7,8 @@ two targets.
7
8
- The Actions runner at `/opt/actions-runner`, pinned by version and sha256. Bump
9
`RUNNER_VERSION` and `RUNNER_SHA256` together; the digest is in the release notes.
10
+ Node is pinned the same way (`NODE_VERSION` with `NODE_SHA256` from `SHASUMS256.txt`),
11
+ and pnpm to an exact version.
12
- git, node, pnpm, jq, gh, python3 and a C toolchain.
13
- systemd as init. The microVM boots it, and the guest agent that talks to the host is installed
14
as a unit when the root filesystem is baked.