Node 24, drop the TEMP CA fix, current action majors

.github/workflows/build-image.yml

@@ -61,7 +61,7 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runs-on) }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Image name, tags and labels
         id: meta
@@ -94,17 +94,17 @@ jobs:
             echo "EOT"
           } >>"$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
         with:
           driver-opts: ${{ inputs.buildx-driver-opts }}
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.context }}/${{ inputs.file }}

.github/workflows/node-ci.yml

@@ -14,7 +14,7 @@ on:
       node-version:
         description: Node version for actions/setup-node
         type: string
-        default: "22"
+        default: "24"
       packages-read:
         description: Authenticate npm to GitHub Packages for @basmith7 packages (the caller grants packages read)
         type: boolean

templates/next-prisma/Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 # Canonical Next+Prisma image: basmith7/workflows templates/next-prisma. Keep this file a copy
 # of the template; mark app-only lines with `# app:` and check with `check-drift <repo-dir>`.
-FROM node:22-alpine AS base
+FROM node:24-alpine AS base
 WORKDIR /app
 # python3/make/g++ compile better-sqlite3's native addon for this image's
 # platform - it can't be reused from a host build.
@@ -25,12 +25,9 @@ COPY . .
 RUN npx prisma generate
 RUN npm run build
 
-FROM node:22-alpine AS runner
+FROM node:24-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# TEMP: revert when nodejs/node#66871 ships (eMudhra CA: use the patched OS store, not Node's roots)
-RUN apk upgrade --no-cache ca-certificates-bundle
-ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=builder /app/.next ./.next

tests/check-drift.test.sh

@@ -63,8 +63,8 @@ insert_before "$d/Dockerfile" 'EXPOSE 3000' 'RUN apk add --no-cache curl'
 expect 1 unmarked '+RUN apk add --no-cache curl'
 
 d=$(app changed)
-sed -i 's/^FROM node:22-alpine AS runner$/FROM node:24-alpine AS runner/' "$d/Dockerfile"
-expect 1 changed '+FROM node:24-alpine AS runner'
+sed -i -E 's/^FROM node:[0-9]+-alpine AS runner$/FROM node:0-alpine AS runner/' "$d/Dockerfile"
+expect 1 changed '+FROM node:0-alpine AS runner'
 
 d=$(app missing-line)
 grep -vxF 'COPY --from=builder /app/public ./public' "$TPL/Dockerfile" >"$d/Dockerfile"