From f2b457d4d2162db2e56f61d411f7f3e9a0d6f391 Mon Sep 17 00:00:00 2001
From: Marco D'Aleo <marco@marcodaleo.com>
Date: Fri, 9 Oct 2026 09:27:08 +0100
Subject: [PATCH] Harden image and fail CI on fixable vulnerabilities, update
 Node 22 docker image

---
 .gitea/workflows/build-scan-push.yml | 15 ++++++++-------
 Dockerfile                           | 13 ++++++++++++-
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/build-scan-push.yml b/.gitea/workflows/build-scan-push.yml
index d91507f..b919798 100644
--- a/.gitea/workflows/build-scan-push.yml
+++ b/.gitea/workflows/build-scan-push.yml
@@ -1,9 +1,10 @@
 name: Build, Scan & Publish Image
 
 # Publishing a Gitea release (for example with tag 2026.09.25) builds the image,
-# scans it with Grype (report only), and pushes it to this repository's registry.
-# A release pushes the release tag plus "latest" (non-prereleases only).
-# A manual run builds and pushes only the tag supplied in the input.
+# scans it with Grype (fails on fixable HIGH/CRITICAL findings), and pushes it to
+# this repository's registry. A release pushes the release tag plus "latest"
+# (non-prereleases only). A manual run builds and pushes only the tag supplied
+# in the input.
 on:
   release:
     types: [published]
@@ -118,9 +119,8 @@ jobs:
           tar -xzf "${FILE}"
           mv grype /usr/local/bin/
 
-      - name: Scan image with Grype (report only)
+      - name: Scan image with Grype
         id: grype
-        continue-on-error: true
         run: |
           grype "${IMAGE_REF}" -o json > grype.json
 
@@ -140,7 +140,7 @@ jobs:
             | "\(.artifact.name)@\(.artifact.version) -> \(.vulnerability.id) [\(.vulnerability.severity)] | fixed: \(.vulnerability.fix.versions[0])"
           ' grype.json
 
-          # Report fixable HIGH/CRITICAL without failing the build.
+          # Fail the build on fixable HIGH/CRITICAL vulnerabilities.
           COUNT=$(jq '
             [
               .matches[]
@@ -159,7 +159,8 @@ jobs:
           ' grype.json)
           echo "Fixable HIGH/CRITICAL count: ${COUNT}"
           if [ "$COUNT" != "0" ]; then
-            echo "::warning::Grype found ${COUNT} fixable HIGH/CRITICAL vulnerabilities."
+            echo "::error::Grype found ${COUNT} fixable HIGH/CRITICAL vulnerabilities."
+            exit 1
           fi
 
       - name: Push image
diff --git a/Dockerfile b/Dockerfile
index 55447ec..d152765 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4
+FROM node:22-trixie-slim@sha256:154ba2f4d6fec323d28e4f4bb86bba4677f1223391a1979cf521304e03a98dfa
 
 # kovi does not vendor or copy Calibre code. The container installs Debian's
 # unmodified Calibre package and calls its fetch-ebook-metadata CLI as a separate
@@ -9,6 +9,17 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends calibre ca-certificates \
  && rm -rf /var/lib/apt/lists/*
 
+# Remove npm/Corepack so their bundled dependency trees are not shipped in the
+# runtime image and flagged by image scanners.
+RUN rm -rf /usr/local/lib/node_modules/npm \
+           /usr/local/lib/node_modules/corepack \
+           /usr/local/bin/npm \
+           /usr/local/bin/npx \
+           /usr/local/bin/corepack \
+           /usr/local/bin/yarn \
+           /usr/local/bin/yarnpkg \
+           /usr/local/bin/pnpm
+
 WORKDIR /app
 COPY package.json server.mjs ./
 COPY lib ./lib