fix: refresh generated JVM runtime packages on every build

Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

README.md

@@ -6,7 +6,7 @@ Latin: *munitor* (fortifier, protector) -- KofTwentyTwo's unified CircleCI orb f
 | --- | --- |
 | **Tier** | Internal until classified -- listed under *Awaiting classification* in the KofTwentyTwo standards [MAINTAINERS.md](https://github.com/KofTwentyTwo/standards/blob/main/MAINTAINERS.md); Product-tier requirements are being adopted |
 | **Standards** | Targets [KofTwentyTwo standards](https://github.com/KofTwentyTwo/standards) 1.0.0 |
-| **Orb** | [`kof22/munitor`](https://circleci.com/developer/orbs/orb/kof22/munitor), latest stable `0.3.5` |
+| **Orb** | [`kof22/munitor`](https://circleci.com/developer/orbs/orb/kof22/munitor), latest stable `0.3.6` |
 | **Security** | [SECURITY.md](SECURITY.md) |
 | **Contributing** | [CONTRIBUTING.md](CONTRIBUTING.md) |
 
@@ -70,16 +70,16 @@ Munitor validates branch names and will fail on non-conforming names.
 
 Munitor is a public CircleCI orb: any CircleCI organization can use it without forking. This checklist covers what a new consumer needs, for example a Java/Maven web service. A QQQ application should also read the [QQQ adoption checklist](https://github.com/QRun-IO/qqq/blob/develop/docs/migration/adoption-checklist.adoc) (section 7 covers release tooling).
 
-**Version.** Use `kof22/munitor@0.3.5` (or `@0.3` to float on the 0.3 line) in `.circleci/config.yml`, and the same value as `orb_version` in `.munitor.yml`. Keep the setup orb and the generated pipeline on the same line.
+**Version.** Use `kof22/munitor@0.3.6` (or `@0.3` to float on the 0.3 line) in `.circleci/config.yml`, and the same value as `orb_version` in `.munitor.yml`. Keep the setup orb and the generated pipeline on the same line.
 
 ### 1. Repository files
 
-- `.circleci/config.yml`: the setup config from [Quick Start](#quick-start), pinned to `kof22/munitor@0.3.5`.
+- `.circleci/config.yml`: the setup config from [Quick Start](#quick-start), pinned to `kof22/munitor@0.3.6`.
 - `.munitor.yml`: pick a [pipeline type](#pipeline-types). A Java service is `java-webapp`. KofTwentyTwo's Website-Backend is a working example; a generalized version:
 
 ```yaml
 pipeline: java-webapp
-orb_version: "0.3.5"
+orb_version: "0.3.6"
 image_name: my-service
 java_version: "21"
 docker:
@@ -372,7 +372,7 @@ contexts:
 
 **What runs:** Maven build/test, Checkstyle, SpotBugs, PMD, JaCoCo coverage, OWASP + Trivy security, Docker build/push (Dockerfile auto-generated), gitleaks. OWASP dependency check requires the `nvd` context; if omitted, the security scan runs without NVD database enrichment.
 
-**Dockerfile:** Auto-generated production-ready image using Eclipse Temurin JRE Alpine. Includes non-root user (uid 1001), JVM container tuning flags, Docker HEALTHCHECK, and configurable port via `health.port`. The pre-built JAR from CI is copied directly (no redundant Maven build stage).
+**Dockerfile:** Auto-generated production-ready image using Eclipse Temurin JRE Alpine. Includes non-root user (uid 1001), JVM container tuning flags, Docker HEALTHCHECK, and configurable port via `health.port`. The pre-built JAR from CI is copied directly (no redundant Maven build stage). PR and release image builds pull the current base and bypass Docker layer caching for generated Java/Gradle runtime images, ensuring the Alpine package upgrade runs on every build. Node builds retain their layer cache. Trivy gates remain required.
 
 ### `terraform`
 

docs/SESSION-STATE.md

@@ -1,5 +1,17 @@
 # Munitor session state
 
+## JVM runtime package freshness (2026-10-19)
+
+Website-Backend release6258 and PR scans6266/6277 reused a cached apk upgrade
+layer containing vulnerable libexpat. The shared docker_build command now pulls
+the base and bypasses layer caching for generated Java/Gradle runtimes, while
+Node caching and all Trivy gates remain intact. Narrow behavioral tests cover
+both pipeline types, alternate/missing manifests, tags, provenance, and both
+PR/release job routes. All eight focused shell cases passed via the coordinating
+agent; ShellCheck and git diff --check passed. Full make/BATS/orb validation and
+real-image scanning remain pending. Stable release and consumer adoption remain
+pending; no unchanged vulnerable image should be retried.
+
 ## PR container scanning (2026-10-13)
 
 Uncommitted work on `feature/pr-image-scan` adds `docker_scan` after
@@ -84,3 +96,5 @@ after Java installation. APT now receives noninteractive debconf and automatic
 needrestart settings; a stubbed integration test verifies both APT invocations.
 These fixes require normal feature-to-develop review and stable tag publication
 from main before website consumers can select the new version. Nothing deployed.
+
+Runtime freshness validation: coordinating agent completed make all (lint, pack, orb validation, scripts,277template assertions) and all7BATS tests in Ubuntu. Real consumer image scan remains required after release.

docs/TODO.md

@@ -2,6 +2,8 @@
 
 ## Pending
 
+- [ ] Release JVM runtime cache fix and adopt the stable orb in Website-Backend; verify fresh image Trivy before release.
+
 - [ ] Run PR image-scan script/template/BATS tests on Linux and verify a consumer PR with Docker/Trivy before publishing.
 - [x] Add PR-only image scans for the four application templates, supplemental scan-only mode, JSON artifacts, and regression tests (uncommitted).
 

src/scripts/build_push_supplemental.sh

@@ -27,7 +27,16 @@ IMAGE="${IMAGE_NAME:?IMAGE_NAME not set}"
 REGISTRY="${REGISTRY:-ghcr.io/KofTwentyTwo}"
 VERSION="${PROJECT_VERSION:?PROJECT_VERSION not set -- run export_version_vars first}"
 ENV_TAG="${DOCKER_ENV_TAG:-}"
-PUSH_IMAGES="${PUSH_IMAGES:-true}"
+# CircleCI renders a boolean orb parameter as "1"/"0" in a step environment, not
+# "true"/"false", so accept both spellings. Unset means push (release builds).
+case "$(echo "${PUSH_IMAGES-true}" | tr '[:upper:]' '[:lower:]')" in
+  true | 1 | yes | on) PUSH_IMAGES=true ;;
+  false | 0 | no | off | "") PUSH_IMAGES=false ;;
+  *)
+    echo "ERROR: PUSH_IMAGES must be true/false (or 1/0), got '${PUSH_IMAGES}'" >&2
+    exit 1
+    ;;
+esac
 # run_trivy_image installs here in a previous CircleCI step.
 export PATH="${HOME}/bin:${PATH}"
 mkdir -p /tmp/trivy-supplemental-results

src/scripts/docker_build.sh

@@ -23,7 +23,16 @@ munitor_header "docker_build (${FULL_IMAGE}:${VERSION})"
 munitor_check_tool docker --version
 
 # Build with version tag; add env tag when set (e.g., develop, staging)
-BUILD_CMD=(docker build -f "${DOCKERFILE}" -t "${FULL_IMAGE}:${VERSION}")
+BUILD_CMD=(docker build --pull -f "${DOCKERFILE}" -t "${FULL_IMAGE}:${VERSION}")
+# Generated JVM images only copy a prebuilt JAR. Re-run their package upgrades:
+# a cached apk upgrade layer can retain vulnerable packages indefinitely.
+CONFIG_FILE="${MUNITOR_CONFIG:-.munitor.yml}"
+if [[ -f "${CONFIG_FILE}" ]]; then
+  munitor_check_tool yq --version
+  case "$(yq -r '.pipeline' "${CONFIG_FILE}")" in
+    java-webapp|gradle-webapp) BUILD_CMD+=(--no-cache) ;;
+  esac
+fi
 if [[ -n "${ENV_TAG}" ]]; then
   BUILD_CMD+=(-t "${FULL_IMAGE}:${ENV_TAG}")
 fi

tests/docker_build.bats

@@ -0,0 +1,6 @@
+#!/usr/bin/env bats
+
+@test "PR and release JVM builds refresh packages without disabling Node caching or Trivy" {
+  run bash "${BATS_TEST_DIRNAME}/test_docker_build.sh"
+  [ "$status" -eq 0 ]
+}

tests/test_docker_build.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Assert the actual shared PR/release build command without a Docker daemon.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+WORK=$(mktemp -d)
+trap 'rm -rf "${WORK}"' EXIT
+mkdir -p "${WORK}/bin" "${WORK}/repo"
+cat > "${WORK}/bin/docker" <<'MOCK'
+#!/usr/bin/env bash
+[[ "$1" == --version ]] && exit 0
+printf '%s\n' "$@" > "${CALL_LOG}"
+MOCK
+cat > "${WORK}/bin/yq" <<'MOCK'
+#!/usr/bin/env bash
+[[ "$1" == --version ]] && exit 0
+[[ "$1" == -r && "$2" == .pipeline ]] || exit 2
+sed -n 's/^pipeline: //p' "$3"
+MOCK
+chmod +x "${WORK}/bin/docker" "${WORK}/bin/yq"
+export PATH="${WORK}/bin:${PATH}"
+export CALL_LOG="${WORK}/calls" BASH_ENV="${WORK}/env"
+export IMAGE_NAME=app REGISTRY=ghcr.io/example PROJECT_VERSION=1.2.3
+export CIRCLE_SHA1=abc123 DOCKER_ENV_TAG=develop
+cd "${WORK}/repo"
+for pipeline in java-webapp gradle-webapp node-api node-webapp; do
+  printf 'pipeline: %s\n' "${pipeline}" > .munitor.yml
+  bash "${PROJECT_DIR}/src/scripts/docker_build.sh" > "${WORK}/output"
+  grep -qx -- '--pull' "${CALL_LOG}"
+  if [[ "${pipeline}" == java-webapp || "${pipeline}" == gradle-webapp ]]; then
+    grep -qx -- '--no-cache' "${CALL_LOG}"
+  else
+    ! grep -qx -- '--no-cache' "${CALL_LOG}"
+  fi
+  grep -qx 'org.opencontainers.image.revision=abc123' "${CALL_LOG}"
+  grep -qx 'ghcr.io/example/app:1.2.3' "${CALL_LOG}"
+  grep -qx 'ghcr.io/example/app:develop' "${CALL_LOG}"
+  echo "PASS: ${pipeline} cache policy, provenance and tags"
+done
+mv .munitor.yml 'custom config.yml'
+printf 'pipeline: java-webapp\n' > 'custom config.yml'
+MUNITOR_CONFIG='custom config.yml' bash "${PROJECT_DIR}/src/scripts/docker_build.sh" > "${WORK}/output"
+grep -qx -- '--no-cache' "${CALL_LOG}"
+echo 'PASS: alternate manifest path'
+bash "${PROJECT_DIR}/src/scripts/docker_build.sh" > "${WORK}/output"
+grep -qx -- '--pull' "${CALL_LOG}"
+! grep -qx -- '--no-cache' "${CALL_LOG}"
+echo 'PASS: standalone build without manifest'
+for job in docker_scan docker_build_push; do
+  grep -q '^  - docker_build:' "${PROJECT_DIR}/src/jobs/${job}.yml"
+  grep -q '^  - run_trivy_image:' "${PROJECT_DIR}/src/jobs/${job}.yml"
+  echo "PASS: ${job} uses shared builder and retains Trivy"
+done

tests/test_docker_scan.sh

@@ -80,6 +80,43 @@ else
   fail
 fi
 
+# Regression (0.3.5): CircleCI renders the boolean "push" parameter as "1"/"0" in
+# the step environment, and release builds silently skipped the push.
+for push in 1 true TRUE; do
+  echo -n "  TEST: push=${push} (release builds) publishes every supplemental image... "
+  : > "${CALL_LOG}"
+  if PUSH_IMAGES="${push}" bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
+    [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]] &&
+    grep -q '^docker push ghcr.io/example/app-migrations:' "${CALL_LOG}" &&
+    grep -q '^docker push ghcr.io/example/app-worker:' "${CALL_LOG}" &&
+    grep -q 'push=true' "${WORK}/supplemental.log"; then
+    pass
+  else
+    fail
+  fi
+done
+
+for push in 0 false ""; do
+  echo -n "  TEST: push='${push}' (PR scans) publishes nothing... "
+  : > "${CALL_LOG}"
+  if PUSH_IMAGES="${push}" bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
+    ! grep -Eq '^docker (push|tag) ' "${CALL_LOG}"; then
+    pass
+  else
+    fail
+  fi
+done
+
+echo -n "  TEST: an unrecognised push value fails instead of guessing... "
+: > "${CALL_LOG}"
+if PUSH_IMAGES=maybe bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" 2>&1; then
+  fail
+elif ! grep -Eq '^docker (build|tag|push) ' "${CALL_LOG}" && grep -q "must be true/false" "${WORK}/supplemental.log"; then
+  pass
+else
+  fail
+fi
+
 for push in false true; do
   echo -n "  TEST: push=${push} fails on HIGH/CRITICAL findings before any push... "
   : > "${CALL_LOG}"