From 00359fe76f99298b0610983f1a7c44420442180f Mon Sep 17 00:00:00 2001
From: Gray Gilmore <graygilmore@gmail.com>
Date: Tue, 7 Apr 2026 10:23:14 -0700
Subject: [PATCH] Bump base image to Node 20 and add ghcr.io build workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Shopify CLI 3.93+ requires Node >=20.10.0 with engine-strict, which breaks the action's Node 18 base image (fixes #103).

This is part 1 of 2 — it updates the base image recipe and adds a workflow to build/push it to ghcr.io. A follow-up PR will update the Dockerfile to reference the new ghcr.io image once it exists.

Changes:

- Dockerfile.base: node:18-buster -> node:20-bookworm (Buster reached EOL June 2024)

- Dockerfile.base: Replace deprecated apt-key with signed-by keyring for Chrome repo

- New workflow (build-base-image.yml): Builds and pushes the base image to ghcr.io/shopify/lighthouse-ci-action:3.0.0 on Dockerfile.base changes or manual dispatch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/build-base-image.yml | 34 ++++++++++++++++++++++++++
 Dockerfile.base                        | 10 ++++----
 2 files changed, 39 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/build-base-image.yml

diff --git a/.github/workflows/build-base-image.yml b/.github/workflows/build-base-image.yml
new file mode 100644
index 0000000..431ea6f
--- /dev/null
+++ b/.github/workflows/build-base-image.yml
@@ -0,0 +1,34 @@
+name: Build and Push Base Image
+
+on:
+  push:
+    branches: [main]
+    paths: [Dockerfile.base]
+  workflow_dispatch:
+
+env:
+  IMAGE_NAME: ghcr.io/shopify/lighthouse-ci-action
+  IMAGE_TAG: "3.0.0"
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build base image
+        run: docker build -t ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} -f Dockerfile.base .
+
+      - name: Push base image
+        run: docker push ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
diff --git a/Dockerfile.base b/Dockerfile.base
index 0af7c4a..a9deac1 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -1,4 +1,4 @@
-FROM node:18-buster
+FROM node:20-bookworm
 
 ENV PATH="/root/.rbenv/shims:${PATH}"
 
@@ -11,10 +11,10 @@ RUN apt-get update \
     && rbenv install 3.2.0 \
     && rbenv global 3.2.0
 
-# Install latest chrome stable package.
-RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -
-RUN sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
-RUN apt-get update \
+# Install latest chrome stable package (using signed-by for Bookworm compatibility).
+RUN wget -q -O /usr/share/keyrings/google-chrome.gpg https://dl-ssl.google.com/linux/linux_signing_key.pub \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list \
+    && apt-get update \
     && apt-get install -y google-chrome-stable --no-install-recommends \
     && apt-get clean