From f538addc660ed0a5a6033f3a7c6c01d34aafac93 Mon Sep 17 00:00:00 2001 From: Alix-007 Date: Thu, 16 Jul 2026 19:08:47 +0800 Subject: [PATCH] fix(ci): bound non-root NodeSource setup download (#108911) --- scripts/docker/install-sh-nonroot/Dockerfile | 5 ++++- test/scripts/test-install-sh-docker.test.ts | 7 +++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/scripts/docker/install-sh-nonroot/Dockerfile b/scripts/docker/install-sh-nonroot/Dockerfile index ab3f7e9a97ff..faa4ae805aff 100644 --- a/scripts/docker/install-sh-nonroot/Dockerfile +++ b/scripts/docker/install-sh-nonroot/Dockerfile @@ -28,7 +28,10 @@ RUN --mount=type=cache,id=openclaw-install-sh-nonroot-apt-cache,target=/var/cach RUN --mount=type=cache,id=openclaw-install-sh-nonroot-apt-cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,id=openclaw-install-sh-nonroot-apt-lists,target=/var/lib/apt,sharing=locked \ set -eux; \ - curl -fsSL https://deb.nodesource.com/setup_24.x | bash -; \ + installer="$(mktemp)"; \ + curl -fsSL --connect-timeout 10 --max-time 120 -o "$installer" https://deb.nodesource.com/setup_24.x; \ + bash "$installer"; \ + rm -f "$installer"; \ DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends nodejs RUN useradd -m -s /bin/bash app \ diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts index 955316e46299..91994e8a474e 100644 --- a/test/scripts/test-install-sh-docker.test.ts +++ b/test/scripts/test-install-sh-docker.test.ts @@ -463,6 +463,13 @@ describe("test-install-sh-docker", () => { expect(nonrootDockerfile).toContain("USER app"); expect(nonrootDockerfile).toContain("WORKDIR /home/app"); expect(nonrootDockerfile).toContain("NPM_CONFIG_UPDATE_NOTIFIER=false"); + expect(nonrootDockerfile).toContain('installer="$(mktemp)"'); + expect(nonrootDockerfile).toContain( + 'curl -fsSL --connect-timeout 10 --max-time 120 -o "$installer" https://deb.nodesource.com/setup_24.x', + ); + expect(nonrootDockerfile).toContain('bash "$installer"'); + expect(nonrootDockerfile).toContain('rm -f "$installer"'); + expect(nonrootDockerfile).not.toMatch(/curl[^\n]+\|\s*bash/u); }); it("keeps shared install helpers parsing and verifying installed CLI versions", () => {