From 57d7d8e98ee05da1721b64839222cf8cea950ecc Mon Sep 17 00:00:00 2001
From: basmith7 <basmith7@gmail.com>
Date: Sun, 1 Nov 2026 10:22:10 -0700
Subject: [PATCH] Node 24, drop the TEMP CA fix, current action majors

- templates/next-prisma: node:24-alpine (active LTS); the eMudhra CA workaround comes out
  because nodejs/node#66871 shipped (22.23.4 / 24.22.1).
- node-ci: node-version defaults to 24.
- build-image: actions/checkout v7, docker/setup-buildx v4, login v4, build-push v7
  (Node 24 action runtime; no inputs this workflow uses were removed).
- check-drift test: the "changed" case no longer hardcodes the template's Node version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build-image.yml | 8 ++++----
 .github/workflows/node-ci.yml     | 2 +-
 templates/next-prisma/Dockerfile  | 7 ++-----
 tests/check-drift.test.sh         | 4 ++--
 4 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index e05493b..3797493 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -61,7 +61,7 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runs-on) }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Image name, tags and labels
         id: meta
@@ -94,17 +94,17 @@ jobs:
             echo "EOT"
           } >>"$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
         with:
           driver-opts: ${{ inputs.buildx-driver-opts }}
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.context }}/${{ inputs.file }}
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 73e3020..e3675bc 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -14,7 +14,7 @@ on:
       node-version:
         description: Node version for actions/setup-node
         type: string
-        default: "22"
+        default: "24"
       packages-read:
         description: Authenticate npm to GitHub Packages for @basmith7 packages (the caller grants packages read)
         type: boolean
diff --git a/templates/next-prisma/Dockerfile b/templates/next-prisma/Dockerfile
index 3d7ad33..8c0c940 100644
--- a/templates/next-prisma/Dockerfile
+++ b/templates/next-prisma/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 # Canonical Next+Prisma image: basmith7/workflows templates/next-prisma. Keep this file a copy
 # of the template; mark app-only lines with `# app:` and check with `check-drift <repo-dir>`.
-FROM node:22-alpine AS base
+FROM node:24-alpine AS base
 WORKDIR /app
 # python3/make/g++ compile better-sqlite3's native addon for this image's
 # platform - it can't be reused from a host build.
@@ -25,12 +25,9 @@ COPY . .
 RUN npx prisma generate
 RUN npm run build
 
-FROM node:22-alpine AS runner
+FROM node:24-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# TEMP: revert when nodejs/node#66871 ships (eMudhra CA: use the patched OS store, not Node's roots)
-RUN apk upgrade --no-cache ca-certificates-bundle
-ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=builder /app/.next ./.next
diff --git a/tests/check-drift.test.sh b/tests/check-drift.test.sh
index 001c2a7..fc17bc0 100755
--- a/tests/check-drift.test.sh
+++ b/tests/check-drift.test.sh
@@ -63,8 +63,8 @@ insert_before "$d/Dockerfile" 'EXPOSE 3000' 'RUN apk add --no-cache curl'
 expect 1 unmarked '+RUN apk add --no-cache curl'
 
 d=$(app changed)
-sed -i 's/^FROM node:22-alpine AS runner$/FROM node:24-alpine AS runner/' "$d/Dockerfile"
-expect 1 changed '+FROM node:24-alpine AS runner'
+sed -i -E 's/^FROM node:[0-9]+-alpine AS runner$/FROM node:0-alpine AS runner/' "$d/Dockerfile"
+expect 1 changed '+FROM node:0-alpine AS runner'
 
 d=$(app missing-line)
 grep -vxF 'COPY --from=builder /app/public ./public' "$TPL/Dockerfile" >"$d/Dockerfile"