From 9c487cfa0407e1ce4d7b97a67eaf8c188eeb66ab Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Wed, 23 Sep 2026 17:51:08 -0500
Subject: [PATCH] fix(#14): use distroless debian13 runtime for node-webapp

debian12 ships libssl3 3.0.18 with open HIGH/CRITICAL CVEs that fail the Trivy gate; debian13 scans clean.

Closes #14
---
 CLAUDE.md                                 |  6 ++--
 src/scripts/generate_dockerfile.sh        |  7 +++--
 src/scripts/packed_generate_dockerfile.sh |  7 +++--
 tests/test_generate_dockerfile.sh         | 35 +++++++++++++++++++++--
 4 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index c51629f..c180de1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -29,12 +29,14 @@ GitHub Issues (org: KofTwentyTwo). Commit format: `feat(#N): description` or `Cl
 
 - Namespace: `kof22`
 - Orb: `kof22/munitor`
-- Latest stable: `kof22/munitor@0.3.0`
+- Latest stable: `kof22/munitor@0.3.1`
 - Dev snapshot: `kof22/munitor@dev:snapshot`
 
 `0.3.0` includes first-class pnpm support, repository-owned Dockerfiles for
 `node-webapp`, and consolidated Kustomize GitOps write-back with optional
-production-only behavior and bounded push-race retries.
+production-only behavior and bounded push-race retries. `0.3.1` moves the
+generated `node-webapp` runtime to `distroless/nodejs<N>-debian13` (debian12
+failed the Trivy gate on OpenSSL CVEs).
 
 ## Session Continuity
 
diff --git a/src/scripts/generate_dockerfile.sh b/src/scripts/generate_dockerfile.sh
index 67571c0..c0f7fc5 100755
--- a/src/scripts/generate_dockerfile.sh
+++ b/src/scripts/generate_dockerfile.sh
@@ -269,6 +269,9 @@ DOCKERFILE
       fi
     else
       echo "Generating Dockerfile for node-webapp (node ${MUNITOR_NODE_VERSION})"
+      # Single source for the runtime base. debian12 ships libssl3 3.0.18 with
+      # open HIGH/CRITICAL CVEs that fail the Trivy gate; debian13 scans clean.
+      NODE_WEBAPP_RUNTIME_IMAGE="gcr.io/distroless/nodejs${MUNITOR_NODE_VERSION}-debian13"
       case "${MUNITOR_PACKAGE_MANAGER}" in
       pnpm)
         cat > Dockerfile <<DOCKERFILE
@@ -282,7 +285,7 @@ ARG GIT_COMMIT_SHA
 ENV GIT_COMMIT_SHA=\${GIT_COMMIT_SHA}
 RUN pnpm run build
 
-FROM gcr.io/distroless/nodejs${MUNITOR_NODE_VERSION}-debian12 AS runner
+FROM ${NODE_WEBAPP_RUNTIME_IMAGE} AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=builder /app/.next/standalone ./
@@ -303,7 +306,7 @@ ARG GIT_COMMIT_SHA
 ENV GIT_COMMIT_SHA=\${GIT_COMMIT_SHA}
 RUN npm run build
 
-FROM gcr.io/distroless/nodejs${MUNITOR_NODE_VERSION}-debian12 AS runner
+FROM ${NODE_WEBAPP_RUNTIME_IMAGE} AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=builder /app/.next/standalone ./
diff --git a/src/scripts/packed_generate_dockerfile.sh b/src/scripts/packed_generate_dockerfile.sh
index abb2bec..cc9c5b2 100755
--- a/src/scripts/packed_generate_dockerfile.sh
+++ b/src/scripts/packed_generate_dockerfile.sh
@@ -613,6 +613,9 @@ DOCKERFILE
       fi
     else
       echo "Generating Dockerfile for node-webapp (node ${MUNITOR_NODE_VERSION})"
+      # Single source for the runtime base. debian12 ships libssl3 3.0.18 with
+      # open HIGH/CRITICAL CVEs that fail the Trivy gate; debian13 scans clean.
+      NODE_WEBAPP_RUNTIME_IMAGE="gcr.io/distroless/nodejs${MUNITOR_NODE_VERSION}-debian13"
       case "${MUNITOR_PACKAGE_MANAGER}" in
       pnpm)
         cat > Dockerfile <<DOCKERFILE
@@ -626,7 +629,7 @@ ARG GIT_COMMIT_SHA
 ENV GIT_COMMIT_SHA=\${GIT_COMMIT_SHA}
 RUN pnpm run build
 
-FROM gcr.io/distroless/nodejs${MUNITOR_NODE_VERSION}-debian12 AS runner
+FROM ${NODE_WEBAPP_RUNTIME_IMAGE} AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=builder /app/.next/standalone ./
@@ -647,7 +650,7 @@ ARG GIT_COMMIT_SHA
 ENV GIT_COMMIT_SHA=\${GIT_COMMIT_SHA}
 RUN npm run build
 
-FROM gcr.io/distroless/nodejs${MUNITOR_NODE_VERSION}-debian12 AS runner
+FROM ${NODE_WEBAPP_RUNTIME_IMAGE} AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=builder /app/.next/standalone ./
diff --git a/tests/test_generate_dockerfile.sh b/tests/test_generate_dockerfile.sh
index 65a2c87..1d93363 100755
--- a/tests/test_generate_dockerfile.sh
+++ b/tests/test_generate_dockerfile.sh
@@ -472,10 +472,25 @@ image_name: my-webapp
 node_version: "22"
 EOF
 run_generate > /dev/null
-if grep -q "gcr.io/distroless/nodejs22-debian12" "${WORK_DIR}/Dockerfile"; then
+if grep -q "FROM gcr.io/distroless/nodejs22-debian13 AS runner" "${WORK_DIR}/Dockerfile"; then
   pass
 else
-  fail "expected distroless runner image in Dockerfile"
+  fail "expected distroless debian13 runner image in Dockerfile"
+fi
+teardown
+
+echo -n "  TEST: does not use the debian12 runner (open OpenSSL CVEs)... "
+setup
+cat > "${WORK_DIR}/.munitor.yml" <<'EOF'
+pipeline: node-webapp
+image_name: my-webapp
+node_version: "22"
+EOF
+run_generate > /dev/null
+if ! grep -q "debian12" "${WORK_DIR}/Dockerfile"; then
+  pass
+else
+  fail "expected no debian12 base image"
 fi
 teardown
 
@@ -589,6 +604,22 @@ else
 fi
 teardown
 
+echo -n "  TEST: pnpm node-webapp uses distroless debian13 runner... "
+setup
+cat > "${WORK_DIR}/.munitor.yml" <<'EOF'
+pipeline: node-webapp
+image_name: my-webapp
+node_version: "22"
+package_manager: pnpm
+EOF
+run_generate > /dev/null
+if grep -q "FROM gcr.io/distroless/nodejs22-debian13 AS runner" "${WORK_DIR}/Dockerfile"; then
+  pass
+else
+  fail "expected distroless debian13 runner image in pnpm Dockerfile"
+fi
+teardown
+
 # =============================================================================
 # Test: node-api (nextjs) with pnpm generates correct Dockerfile
 # =============================================================================
-- 
2.54.0