Sync Develop With Current Production

.github/workflows/ci.yaml

@@ -21,10 +21,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [22, 24]
+        node-version: [26]
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -35,10 +35,10 @@ jobs:
     name: Lint and audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 26
           cache: npm
       - run: npm ci
       - run: npm run lint
@@ -48,22 +48,30 @@ jobs:
     name: Helm lint and render
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: azure/setup-helm@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       - run: helm lint chart
       - run: helm template docker-node-app chart --set autoscaling.enabled=true --set ingress.enabled=true
 
   container:
     name: Build container
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
       - name: Build test target
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           target: test
           push: false
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=test
+          cache-to: type=gha,mode=max,scope=test
+      - name: Build production target
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          target: production
+          push: false
+          cache-from: type=gha,scope=production
+          cache-to: type=gha,mode=max,scope=production

.github/workflows/codeql.yml

@@ -18,8 +18,8 @@ jobs:
     name: Analyze JavaScript
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: github/codeql-action/init@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: javascript-typescript
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1

.github/workflows/publish.yaml

@@ -61,7 +61,7 @@ jobs:
           if [ "$RELEASE_BRANCH" = master ]; then
             required='["Test (Node 26)","Lint and audit","Helm lint and render","Build container","Open Source and Container","Analyze JavaScript"]'
           else
-            required='["Test (Node 22)","Test (Node 24)","Lint and audit","Helm lint and render","Build container","Open Source","Analyze JavaScript"]'
+            required='["Test (Node 26)","Lint and audit","Helm lint and render","Build container","Open Source and Container","Analyze JavaScript"]'
           fi
 
           for attempt in {1..60}; do
@@ -76,7 +76,10 @@ jobs:
             ' <<< "$checks")"
             if [ -z "$missing" ]; then
               current_sha="$(gh api "repos/$GH_REPO/commits/$RELEASE_BRANCH" --jq .sha)"
-              test "$current_sha" = "$RELEASE_SHA"
+              if [ "$current_sha" != "$RELEASE_SHA" ]; then
+                echo "Branch advanced while checks were running; release blocked." >&2
+                exit 1
+              fi
               echo "sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
               echo "branch=$RELEASE_BRANCH" >> "$GITHUB_OUTPUT"
               exit 0
@@ -92,15 +95,15 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.verify.outputs.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
@@ -109,7 +112,7 @@ jobs:
         run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
       - name: Generate image metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: jonfairbanks/docker-node-app
           tags: |
@@ -118,7 +121,7 @@ jobs:
             type=raw,value=latest,enable=${{ needs.verify.outputs.branch == 'master' }}
             type=raw,value=${{ steps.package.outputs.version }},enable=${{ needs.verify.outputs.branch == 'master' }}
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           target: production
@@ -134,27 +137,32 @@ jobs:
     needs: verify
     if: needs.verify.outputs.branch == 'master'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.verify.outputs.sha }}
-      - uses: azure/setup-helm@v4
-      - name: Check out chart repository
-        uses: actions/checkout@v6
+          fetch-depth: 2
+      - name: Set up Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          repository: jonfairbanks/helm-charts
-          token: ${{ secrets.HELM_CHARTS_PAT }}
-          path: helm-charts
-      - name: Package chart
-        run: helm package chart --destination helm-charts/_releases
-      - name: Publish chart package
-        working-directory: helm-charts
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add _releases
-          git diff --cached --quiet && exit 0
-          git commit -m "Publish docker-node-app chart ${SOURCE_SHA::7}"
-          git push
+          version: v4.2.3
+      - name: Publish chart to GHCR
         env:
-          SOURCE_SHA: ${{ needs.verify.outputs.sha }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version=$(awk '/^version:/ { print $2; exit }' chart/Chart.yaml)
+          chart=oci://ghcr.io/jonfairbanks/charts/docker-node-app
+          if helm show chart "$chart" --version "$version" >/dev/null 2>&1; then
+            if git diff --quiet HEAD^ HEAD -- chart; then
+              echo "${chart}:${version} already exists and this change does not modify the chart."
+              exit 0
+            fi
+            echo "${chart}:${version} already exists; increment chart/Chart.yaml." >&2
+            exit 1
+          fi
+          echo "$GHCR_TOKEN" | helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+          helm package chart --destination /tmp/charts
+          helm push "/tmp/charts/docker-node-app-${version}.tgz" oci://ghcr.io/jonfairbanks/charts

.github/workflows/snyk.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   open-source:
-    name: Open Source
+    name: Open Source and Container
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -33,10 +33,10 @@ jobs:
           fi
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use Node.js 24.x
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
           cache: npm
@@ -51,3 +51,22 @@ jobs:
             --file=package.json
             --package-manager=npm
             --severity-threshold=high
+
+      - name: Build production image
+        run: docker build --target production --tag docker-node-app:snyk .
+
+      - name: Scan production image
+        run: |
+          # snyk/actions/docker invokes the legacy `snyk test --docker` path.
+          # Use Snyk's current container command with the current immutable
+          # scanner runtime so scanner updates cannot silently change CI.
+          docker run --rm \
+            --env SNYK_TOKEN \
+            --volume /var/run/docker.sock:/var/run/docker.sock \
+            --volume "$GITHUB_WORKSPACE:/workspace" \
+            --workdir /workspace \
+            snyk/snyk@sha256:3c6fbd3e70dea2792d6bc2a080335fafdccd243ad9c0b7faa91002caac7d7851 \
+            snyk container test docker-node-app:snyk \
+              --exclude-app-vulns \
+              --file=Dockerfile \
+              --severity-threshold=high

.npmrc

@@ -0,0 +1 @@
+min-release-age=7

Dockerfile

@@ -1,7 +1,8 @@
 # syntax=docker/dockerfile:1.7
 
-FROM node:24-alpine AS base
-RUN apk add --no-cache tini
+FROM node:26-alpine AS base
+ENV NPM_CONFIG_ENGINE_STRICT=true
+RUN apk add --no-cache tini tzdata
 WORKDIR /app
 
 FROM base AS dependencies

README.md

@@ -11,7 +11,7 @@
 
 ## A sample Node.js app in Docker
 
-- Uses Node.js 24 LTS
+- Uses Node.js 26
 - Reproducible npm installs from the committed lockfile
 - Runs as a non-root user for enhanced security
 - Multi-stage development, test, and production images
@@ -20,7 +20,7 @@
 
 ### Local development
 
-With Node.js 24 installed:
+With Node.js 26 installed:
 
 ```shell
 npm ci
@@ -68,6 +68,13 @@ helm lint chart
 helm upgrade --install docker-node-app chart
 ```
 
+The chart sets the pod timezone to `America/Los_Angeles`. Override it with an
+IANA timezone name when deploying elsewhere:
+
+```shell
+helm upgrade --install docker-node-app chart --set timezone=Europe/London
+```
+
 For testing that pods are balancing correctly, you can make multiple requests to your app to verify.
 
 To make 50 requests and write them to a file, you can run the following with your endpoint:

__tests__/app.test.js

@@ -1,9 +1,11 @@
 const assert = require('node:assert/strict');
 const { describe, test } = require('node:test');
 const request = require('supertest');
-const app = require('../app');
+const { app, setDraining } = require('../app');
 
 describe('Verify the site loads', () => {
+  test.after(() => setDraining(false));
+
   test('Response should equal HTTP 200', async () => {
     const response = await request(app).get('/');
     assert.equal(response.statusCode, 200);
@@ -14,4 +16,11 @@ describe('Verify the site loads', () => {
     assert.equal(response.statusCode, 200);
     assert.match(response.body.response.msg, /up and running/);
   });
+
+  test('Readiness check rejects traffic while draining', async () => {
+    assert.equal((await request(app).get('/readyz')).statusCode, 200);
+
+    setDraining(true);
+    assert.equal((await request(app).get('/readyz')).statusCode, 503);
+  });
 });

__tests__/shutdown.test.js

@@ -0,0 +1,59 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { once } = require('node:events');
+const { test } = require('node:test');
+const { createGracefulShutdown } = require('../index');
+
+test('graceful shutdown drains an in-flight request before closing', async (t) => {
+  let markRequestStarted;
+  let releaseResponse;
+  const requestStarted = new Promise((resolve) => {
+    markRequestStarted = resolve;
+  });
+  const responseReleased = new Promise((resolve) => {
+    releaseResponse = resolve;
+  });
+
+  const server = http.createServer(async (_request, response) => {
+    markRequestStarted();
+    await responseReleased;
+    response.end('ok');
+  });
+  server.keepAliveTimeout = 10;
+
+  t.after(() => {
+    server.closeAllConnections?.();
+    if (server.listening) {
+      server.close();
+    }
+  });
+
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  const { port } = server.address();
+  const responsePromise = fetch(`http://127.0.0.1:${port}`);
+  await requestStarted;
+
+  const messages = [];
+  const logger = {
+    log: (message) => messages.push(message),
+    error: (message) => messages.push(message),
+  };
+  const shutdown = createGracefulShutdown(server, { timeoutMs: 1000, logger });
+  let shutdownComplete = false;
+  const shutdownPromise = shutdown('SIGTERM').then(() => {
+    shutdownComplete = true;
+  });
+
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(shutdownComplete, false);
+
+  releaseResponse();
+  const response = await responsePromise;
+  assert.equal(await response.text(), 'ok');
+  await shutdownPromise;
+
+  assert.equal(shutdownComplete, true);
+  assert.equal(server.listening, false);
+  assert.deepEqual(messages, ['Received SIGTERM; draining active connections...']);
+});

app.js

@@ -4,6 +4,7 @@ const app = express();
 const os = require('os');
 const dayjs = require('dayjs');
 const advancedFormat = require('dayjs/plugin/advancedFormat');
+let isDraining = false;
 
 app.set('view engine', 'ejs');
 dayjs.extend(advancedFormat);
@@ -49,7 +50,18 @@ app.get('/healthz', (req, res) => {
         host: os.hostname(),
         clientSourceIP: ip,
       },
-    });
+  });
+});
+
+// During termination, keep the container alive long enough for in-flight
+// requests to finish, but tell Kubernetes and load balancers not to send it
+// any new requests.
+app.get('/readyz', (_req, res) => {
+  res.sendStatus(isDraining ? 503 : 200);
 });
 
-module.exports = app;
+function setDraining(value) {
+  isDraining = value;
+}
+
+module.exports = { app, setDraining };