Merge branch 'main-enterprise' into feat/github-action-mode-pr-comments

Author: decyjphr

.devcontainer/Dockerfile

@@ -14,9 +14,7 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
 # [Optional] Uncomment if you want to install more global node modules
 # RUN su node -c "npm install -g <your-package-list-here>"
 
-# Update npm
-RUN npm install -g npm
-# Intall aws cli
+# Install aws cli
 RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && \
   unzip awscliv2.zip && \
   sudo ./aws/install && \

.github/workflows/create-pre-release.yml

@@ -48,7 +48,7 @@ jobs:
         with:
           node-version: 22.x
           cache: 'npm'
-      - run: npm install
+      - run: npm ci
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
       - name: Log in to the Container registry
@@ -58,7 +58,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image Locally
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: .
           file: ./Dockerfile
@@ -71,9 +71,10 @@ jobs:
       - name: Run Functional Tests
         id: functionaltest
         run: |
-          docker run --env APP_ID=${{ secrets.APP_ID }} --env PRIVATE_KEY=${{ secrets.PRIVATE_KEY }} --env WEBHOOK_SECRET=${{ secrets.WEBHOOK_SECRET }} -d -p 3000:3000 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main-enterprise
+          CONTAINER_ID=$(docker run --env APP_ID=${{ secrets.APP_ID }} --env PRIVATE_KEY=${{ secrets.PRIVATE_KEY }} --env WEBHOOK_SECRET=${{ secrets.WEBHOOK_SECRET }} --env NODE_ENV=development -d -p 3000:3000 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main-enterprise)
           sleep 10
-          curl http://localhost:3000
+          docker logs $CONTAINER_ID || true
+          curl --fail --retry 5 --retry-delay 3 --retry-connrefused http://localhost:3000
       - run: echo "${{ github.ref }}"
       - name: Tag a final release 
         id: prerelease
@@ -85,7 +86,7 @@ jobs:
           commitish: ${{ github.ref }}
       - name: Push Docker Image
         if: ${{ success() }}
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: .
           file: ./Dockerfile

.github/workflows/create-release.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           node-version: 22.x
           cache: "npm"
-      - run: npm install
+      - run: npm ci
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
       - name: Log in to the Container registry
@@ -36,7 +36,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image Locally
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: .
           file: ./Dockerfile
@@ -59,7 +59,7 @@ jobs:
           bump: final
       - name: Push Docker Image
         if: ${{ success() }}
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: .
           file: ./Dockerfile

.github/workflows/node-ci.yml

@@ -20,7 +20,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
-      - run: npm install
+      - run: npm ci
       - run: npm run test:unit:ci
     strategy:
       matrix:

.github/workflows/rc-release.yml

@@ -76,7 +76,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
       - name: Build and push Docker image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: .
           push: true

Dockerfile

@@ -1,6 +1,7 @@
-FROM node:22-alpine
+FROM node:22-alpine@sha256:4d64b49e6c891c8fc821007cb1cdc6c0db7773110ac2c34bf2e6960adef62ed3
 WORKDIR /opt/safe-settings
 ENV NODE_ENV production
+ENV HOST=0.0.0.0
 ## Set the Labels
 LABEL version="1.0" \
       description="Probot app which is a modified version of Settings Probot GitHub App" \

app.yml

@@ -115,7 +115,7 @@ default_permissions:
     organization_administration: write
 
     # Manage Actions variables.
-    # https://docs.github.com/en/rest/actions/variables?apiVersion=2022-11-28
+    # https://docs.github.com/en/rest/actions/variables?apiVersion=2026-03-10
     actions_variables: write
 
 

docs/deploy.md

@@ -88,6 +88,9 @@ This will start the container in the background and detached.
   - `docker exec -it safe-settings /bin/sh`
 - You will now be inside the running **Docker** container and can perform any troubleshooting needed
 
+### Troubleshooting Docker Build and Runtime Issues
+For detailed guidance on debugging Docker image builds, runtime failures, and comparing local vs. GHCR images, see [docker-debugging.md](docker-debugging.md).
+
 ## Deploy the app to AWS Lambda
 
 ### Production-Ready Template 

docs/docker-debugging.md

@@ -0,0 +1,181 @@
+
+# Docker Build and Test Debugging Runbook
+
+This document summarizes the Docker experiments done for this repo and converts them into a repeatable workflow for debugging local image builds and GHCR images.
+
+## Goals
+
+- Build and test the app image from local source.
+- Compare behavior with the published image from GHCR.
+- Quickly diagnose common failures (container startup, shell access, port exposure, env setup).
+
+## What We Learned From The Experiments
+
+- The image is Alpine-based, so use /bin/sh, not /bin/bash.
+- Use docker rm (or docker container rm) to remove containers. Commands like docker delete, docker destroy, or docker remove do not exist.
+- To pass host binding correctly, use HOST=0.0.0.0 (equal sign), not HOST:0.0.0.0.
+- Port mapping is required for host access: -p 3000:3000.
+- Supplying .env values is required for realistic startup testing.
+- Testing both local and GHCR images with the same runtime flags makes behavior comparisons easier.
+
+## Prerequisites
+
+- Docker is installed and running.
+- A valid .env file exists at repo root.
+- You are in repo root.
+
+## 1) Build And Test Local Image
+
+Build the local image:
+
+```bash
+docker build -t safe-settings:local .
+```
+
+Run container in foreground with explicit runtime env and port mapping:
+
+```bash
+docker run --name safe-settings-local \
+	--env-file ./.env \
+	--env NODE_ENV=development \
+	--env HOST=0.0.0.0 \
+	-p 3000:3000 \
+	-it safe-settings:local
+```
+
+If startup fails, inspect logs:
+
+```bash
+docker logs safe-settings-local
+```
+
+Shell into running container for investigation:
+
+```bash
+docker exec -it safe-settings-local /bin/sh
+```
+
+Clean up:
+
+```bash
+docker rm -f safe-settings-local
+```
+
+## 2) Pull And Test GHCR Image
+
+Pull published image:
+
+```bash
+docker pull ghcr.io/github/safe-settings:2.1.19
+```
+
+Run with the same env and port flags used for local testing:
+
+```bash
+docker run --name safe-settings-ghcr \
+	--env-file ./.env \
+	--env NODE_ENV=development \
+	--env HOST=0.0.0.0 \
+	-p 3000:3000 \
+	-it ghcr.io/github/safe-settings:2.1.19
+```
+
+Inspect logs:
+
+```bash
+docker logs safe-settings-ghcr
+```
+
+Debug inside container:
+
+```bash
+docker exec -it safe-settings-ghcr /bin/sh
+```
+
+Clean up:
+
+```bash
+docker rm -f safe-settings-ghcr
+```
+
+## 3) Fast Differential Debug (Local vs GHCR)
+
+Use this when one image works and the other does not.
+
+1. Run both images with identical flags (env, HOST, port mapping).
+2. Compare startup logs side-by-side.
+3. Compare environment inside each container:
+
+```bash
+docker exec -it safe-settings-local /bin/sh -c 'env | sort'
+docker exec -it safe-settings-ghcr /bin/sh -c 'env | sort'
+```
+
+4. Confirm app process is listening on expected port inside container:
+
+```bash
+docker exec -it safe-settings-local /bin/sh -c 'netstat -lntp 2>/dev/null || ss -lntp'
+docker exec -it safe-settings-ghcr /bin/sh -c 'netstat -lntp 2>/dev/null || ss -lntp'
+```
+
+5. Validate host reachability:
+
+```bash
+curl -i http://localhost:3000/
+```
+
+## 4) Common Failure Patterns And Fixes
+
+Symptom: container exits immediately.
+Likely causes:
+- Missing required variables in .env.
+- Invalid app credentials.
+Checks:
+- docker logs <container-name>
+- Confirm .env has required app settings.
+
+Symptom: cannot connect from host to localhost:3000.
+Likely causes:
+- Missing -p 3000:3000.
+- App not binding to all interfaces.
+Checks:
+- Ensure HOST=0.0.0.0 is set.
+- Ensure port mapping is present.
+
+Symptom: cannot shell into container with bash.
+Likely cause:
+- Alpine image does not include bash.
+Fix:
+- Use /bin/sh.
+
+Symptom: name conflict when re-running tests.
+Likely cause:
+- Old container still exists.
+Fix:
+- docker rm -f <container-name>
+
+## 5) Minimal Known-Good Commands
+
+Local:
+
+```bash
+docker build -t safe-settings:local . && \
+docker run --rm --name safe-settings-local \
+	--env-file ./.env \
+	--env NODE_ENV=development \
+	--env HOST=0.0.0.0 \
+	-p 3000:3000 \
+	-it safe-settings:local
+```
+
+GHCR:
+
+```bash
+docker pull ghcr.io/github/safe-settings:2.1.19 && \
+docker run --rm --name safe-settings-ghcr \
+	--env-file ./.env \
+	--env NODE_ENV=development \
+	--env HOST=0.0.0.0 \
+	-p 3000:3000 \
+	-it ghcr.io/github/safe-settings:2.1.19
+```

docs/github-settings/1. repository-settings.md

@@ -50,8 +50,8 @@ repository:
 
 >[!TIP]
 >GitHub's API documentation defines these inputs and types:
->1. [Update an environment](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#update-a-repository)
->2. [Replace all repository topics](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#replace-all-repository-topics)
+>1. [Update an environment](https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10#update-a-repository)
+>2. [Replace all repository topics](https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10#replace-all-repository-topics)
 
 <table>
 <tr><td>