fix: refresh generated JVM runtime packages on every build #39

2026-10-19T12:50:57Z

KofTwentyTwo commented

2026-10-19 12:50:57 +00:00

(Migrated from github.com)

Website-Backend release job6258 and PR image scans6266/6277 reused a cached apk upgrade layer, retaining libexpat2.8.5-r0 after2.9.0-r0 became available. The generated runtime belongs to Munitor; the application's repository Dockerfile is not used by this pipeline.

The shared docker_build command now pulls the current base and disables layer caching for generated Java/Gradle runtimes, which copy a prebuilt JAR. Node builds retain layer caching. This covers both docker_scan and docker_build_push; Trivy findings still fail both jobs. Version tags, provenance labels and registry guards are unchanged.

Validation:

Eight focused shell regression cases passed (executed by the coordinating agent): Java/Gradle and Node cache policies, alternate/missing manifest paths, tags/provenance, and both PR/release scan routes.
ShellCheck passed for the changed build script and new shell test.
git diff --check passed.
Full make all passed in local Ubuntu with BATS available, including lint, generated-script packing, CircleCI orb validation, script suites and 277 template assertions. All seven BATS tests passed separately. A real runtime image build and Trivy scan remain required in consumer CI; stubbed tests do not prove a clean image.

Release/adoption: merge to develop, follow the normal stable-orb release/tag workflow, then update both Website-Backend orb pins. An unchanged0.3.6 workflow rerun cannot pick up this fix. Preserve immutable version guards and use a new backend pipeline/version if the prior tag is already owned elsewhere.

AI-assisted implementation and tests by GPT-6.

Website-Backend release job6258 and PR image scans6266/6277 reused a cached `apk upgrade` layer, retaining libexpat2.8.5-r0 after2.9.0-r0 became available. The generated runtime belongs to Munitor; the application's repository Dockerfile is not used by this pipeline. The shared `docker_build` command now pulls the current base and disables layer caching for generated Java/Gradle runtimes, which copy a prebuilt JAR. Node builds retain layer caching. This covers both `docker_scan` and `docker_build_push`; Trivy findings still fail both jobs. Version tags, provenance labels and registry guards are unchanged. Validation: - Eight focused shell regression cases passed (executed by the coordinating agent): Java/Gradle and Node cache policies, alternate/missing manifest paths, tags/provenance, and both PR/release scan routes. - ShellCheck passed for the changed build script and new shell test. - `git diff --check` passed. - Full `make all` passed in local Ubuntu with BATS available, including lint, generated-script packing, CircleCI orb validation, script suites and 277 template assertions. All seven BATS tests passed separately. A real runtime image build and Trivy scan remain required in consumer CI; stubbed tests do not prove a clean image. Release/adoption: merge to develop, follow the normal stable-orb release/tag workflow, then update both Website-Backend orb pins. An unchanged0.3.6 workflow rerun cannot pick up this fix. Preserve immutable version guards and use a new backend pipeline/version if the prior tag is already owned elsewhere. AI-assisted implementation and tests by GPT-6.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Munitor#39