archetech / archon / 31900976265

87%

push

github

deps: Upgrade Node to 22.23.2 and move images to Debian trixie (#892)

Re-lands #891 against main. That PR was opened with its base set to the
#890 branch to keep the stacked diff readable, and #890 was merged without
deleting its branch -- so GitHub never retargeted #891, and merging it put
the change on feat/bookworm-base-images instead of main. The work was
intact but unreachable; this branch carries the identical tree, taken
straight from that branch, onto main.

Original description follows.

#890 moved the images to bookworm as remediation, which was as far as the
Node pin reached: the official node images only publish trixie variants
from about 22.22.x, so Debian 13 was unreachable at 22.15.0. Node 22.15.0
was also well behind its own line -- 22.x is at 22.23.2 -- a patch-level
lag on the runtime.

The version is pinned in more places than the Dockerfiles, and they move
together:

- 24 Dockerfile FROM lines -> node:22.23.2-trixie-slim
- the Rust gatekeeper's two stages -> rust:1.90-trixie and
  debian:trixie-slim, in lockstep, since a builder newer than its runtime
  reintroduces the glibc failure across the stage boundary
- 9 workflow node-version pins, and 5 step labels naming the old version
- package.json engines: 22.15.x -> 22.23.x
- package-lock.json, which mirrors the root engines block. The
  lockfile-consistency check fails when a dependency-relevant field
  changes in a manifest without the lockfile changing, and engines is on
  its list.
- README

npm is deliberately untouched: the trixie image ships 10.9.8, which
satisfies the unchanged 10.9.x constraint. engines will not break local
dev either -- there is no engine-strict in .npmrc, so a machine still on
22.15 gets a warning rather than a failure.

Verified by starting the two riskiest images on trixie, not just building:

- gatekeeper-rust: glibc 2.41, zero unresolved shared libraries, binary
  runs and stops only on an absent redis (cross-stage case)
- gatekeeper-ts: node 22.23.2... (continued)

3744 of 4212 branches covered (88.89%)

Branch coverage included in aggregate %.

8391 of 8680 relevant lines covered (96.67%)

680.26 hits per line