Skip to content

Commit 6b91659

Browse files
codegeist-aicodegeist-ai
committed
docs(tasks): plan pinned base image refresh
Record audited version targets and constraints for GraalVM, Hugo, VHS, and Tea. Advance .devcontainer to the runtime release published from the preceding completed task, as required by the shared save workflow.
1 parent ef663d5 commit 6b91659

2 files changed

Lines changed: 147 additions & 1 deletion

File tree

‎.devcontainer‎

‎docs/tasks/T014_refresh_pinned_base_image_tools.md‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
# Refresh Pinned Base Image Tools
2+
3+
- ID: `T014`
4+
- Type: `chore`
5+
- Status: `planned`
6+
- Parent: `none`
7+
- Public Tracking: `https://github.com/codegeist-ai/codegeist-devcontainer-kit/issues/20`
8+
- Tracking Key: `ee840b41-1970-4996-b555-301faff68424`
9+
10+
## Goal
11+
12+
Update the explicitly pinned GraalVM, Hugo, VHS, and Tea installations in the
13+
base devcontainer image to their current compatible releases while preserving
14+
the existing Java, operating-system, Node.js, and Helm major-version contracts.
15+
16+
## Context
17+
18+
An update audit on 2026-09-15 compared every directly managed application in
19+
`Dockerfile.base` with its authoritative package or release source. Floating
20+
APT, npm, PyPI, GitHub-latest, and installer-script dependencies already resolve
21+
their configured current candidates during an uncached build. Five of the nine
22+
explicit application pins are current, while these four have newer compatible
23+
releases:
24+
25+
- GraalVM Community JDK 25: `25.0.2` to JDK `25.0.4.1` in Graal release
26+
`25.3.4.1`.
27+
- Hugo Extended: `0.147.9` to `0.166.0`.
28+
- VHS: `0.11.0` to `0.12.0`.
29+
- Tea: `0.14.2` to `0.15.0`.
30+
31+
GraalVM's current release tag and archive name no longer derive from one plain
32+
JDK version value. The Linux x64 archive is published under tag
33+
`graal-25.3.4.1` as
34+
`graalvm-community-jdk-25i3-25.0.4.1_linux-x64_bin.tar.gz`. Hugo likewise
35+
changed its Linux archive suffix from `Linux-64bit` to `linux-amd64`.
36+
37+
The parent repository currently has an intentional uncommitted `.devcontainer`
38+
gitlink update from the preceding release workflow. This task must not absorb,
39+
reset, or otherwise change that existing user state unless a later explicit
40+
save instruction includes it.
41+
42+
## Scope
43+
44+
In scope:
45+
46+
- Update the four pinned application versions in `Dockerfile.base`.
47+
- Represent GraalVM's release tag and archive version separately so the current
48+
official Linux x64 asset URL is explicit and reviewable.
49+
- Update the Hugo asset path for the current official Linux amd64 naming.
50+
- Keep the existing Tea and VHS installation mechanisms while changing their
51+
pinned versions.
52+
- Extend the existing image smoke test to assert the four installed versions,
53+
not only that the commands start.
54+
- Review source and consumer documentation for stale exact-version statements
55+
and update only those affected by these pins.
56+
- Run the full real integration suite because the generated runtime image and
57+
several user-facing CLI binaries change.
58+
59+
Out of scope:
60+
61+
- Migrating `debian:bookworm-slim` to Debian 13 `trixie`.
62+
- Moving Node.js from the `node_24.x` channel to Node.js 26.
63+
- Moving from Helm 3 to Helm 4.
64+
- Pinning every currently floating APT, npm, PyPI, installer-script, or
65+
GitHub-latest dependency.
66+
- Changing current pins for ttyd `1.7.7`, Trivy `0.74.0`, Gitleaks `8.30.1`,
67+
whisper.cpp `1.9.4`, or ssh-audit `3.9.0`.
68+
- Editing generated release content directly inside `.devcontainer/`.
69+
- Editing the `.opencode/` submodule directly; version-specific shared tool
70+
guidance must be changed in the agent-kit source repository through its own
71+
workflow.
72+
- Publishing a runtime release before this task is saved and fully verified.
73+
74+
## Acceptance Criteria
75+
76+
- The image installs GraalVM Community JDK `25.0.4.1` from Graal release
77+
`25.3.4.1`, and both `java` and `native-image` start successfully.
78+
- The image installs Hugo Extended `0.166.0` from the official
79+
`linux-amd64` archive.
80+
- The image installs VHS `0.12.0` and Tea `0.15.0` from their official Linux
81+
amd64 artifacts.
82+
- `tests/docker-build.sh` checks the exact installed versions for GraalVM, Hugo,
83+
VHS, and Tea through the existing built-image smoke path.
84+
- Existing image tools, devcontainer lifecycle behavior, browser support,
85+
QEMU/KVM, microphone recording, and release-copy behavior remain functional.
86+
- Debian Bookworm, Node.js 24, and Helm 3 remain unchanged.
87+
- Any affected exact-version documentation is current, while historical solved
88+
task records remain unchanged.
89+
- The pre-existing parent `.devcontainer` gitlink change is preserved and is
90+
not included accidentally in implementation-only edits.
91+
92+
## Verification
93+
94+
- `bash -n tests/docker-build.sh`
95+
- `task check`
96+
- `task tests-run`
97+
- `tests/release-build.sh`
98+
- `git diff --check`
99+
- Inspect the built image outputs for exact GraalVM, Hugo, VHS, and Tea versions.
100+
101+
## File Targets
102+
103+
- `Dockerfile.base`
104+
- `tests/docker-build.sh`
105+
- `README.md`
106+
- `README_release.md`
107+
- `docs/tasks/T014_refresh_pinned_base_image_tools.md`
108+
109+
## Dependencies
110+
111+
- Authoritative upstream Linux amd64 release artifacts for GraalVM release
112+
`25.3.4.1`, Hugo `0.166.0`, VHS `0.12.0`, and Tea `0.15.0`.
113+
- A separate upstream agent-kit documentation change if its version-specific
114+
GraalVM or Hugo inventory still reflects the old image after this task lands.
115+
116+
## Implementation Notes
117+
118+
- Keep the smallest source change: split only the GraalVM release identity from
119+
its archive identity, and change the Hugo filename template only where the
120+
upstream naming requires it.
121+
- Do not introduce new checksums for previously unhashed downloads as part of a
122+
version-only refresh. Treat download-verification hardening as separate work.
123+
- Use the existing `tests/docker-build.sh` image rather than creating a parallel
124+
update-audit harness.
125+
- Do not infer a successful update from Dockerfile text alone; exact runtime
126+
version output from the rebuilt image is required.
127+
128+
## Implementation Plan
129+
130+
1. Revalidate all four release identities and Linux amd64 asset names immediately
131+
before editing because the source URLs are external moving dependencies.
132+
2. Update GraalVM, Hugo, VHS, and Tea arguments and download paths in
133+
`Dockerfile.base` without changing unrelated installation policies.
134+
3. Extend `tests/docker-build.sh` with exact runtime version assertions for the
135+
four changed tools.
136+
4. Review `README.md` and `README_release.md` for affected current-version facts;
137+
keep historical task records untouched.
138+
5. Run syntax and fast checks, then rebuild and execute the complete real
139+
`task tests-run` suite.
140+
6. Run the release-copy smoke test and diff checks, record concrete results in
141+
this task, close the linked Issue as completed, and set the task to `solved`
142+
only after all verification succeeds.
143+
144+
## Cancellation Reason
145+
146+
- `none`

0 commit comments

Comments
 (0)