Added
- Explicit
docker pull / FROM snippets and tag/architecture sections in the root and
per-image READMEs
sf-bulk/.dockerignore (previously missing; sf-ci and sf-devcontainer already had one)- CI: Docker Hub README/description sync on release (
peter-evans/dockerhub-description)
- CI: keyless cosign signing (GitHub OIDC) of every pushed image; verification commands
documented in the root and per-image READMEs
- Release notes now include per-image tool-version tables (Node, npm, SF CLI, user plugins)
read from the built images
Changed
- GitHub repo metadata: description, topics, and Docker Hub homepage link set
- CI: dropped the unused
packages: write permission (images push to Docker Hub, not GHCR)
- CI: the per-image build → test → push pipeline moved to the shared
docker-build-test-push reusable workflow in shared-github-actions;
build-and-push.yml is now a thin matrix caller with a local release job
- Docker tag scheme: releases publish
X.Y.Z + latest only — rolling :1 / :1.6
tags are no longer pushed (existing ones stay frozen at 1.6.1); pin an exact version or
track latest
Security
- All Dockerfiles: base images now pinned by tag plus multi-arch index digest
(ubuntu:22.04@sha256:…, node:24-alpine@sha256:…) for reproducible, tamper-evident
builds; refresh command documented above each FROM
Fixed
- All Dockerfiles:
org.opencontainers.image.source now points to the real repo org
(Gforce-Innovation-Kft, was gforceinnovation)
- Docs: remaining stale "under 500 MB" sf-bulk claims corrected to the 600 MB budget
(root/sf-bulk READMEs, CONTRIBUTING, PR template, tests/README, repo skills, AGENTS.md)
- Docs: removed stale "dependency review runs on PRs" claims (README, SECURITY.md) and the
stale "push to main builds" trigger description (CLAUDE.md, references)
- CHANGELOG: added the missing
[1.6.1] compare link; [Unreleased] now compares from
v1.6.1
Image tool versions
sf-ci
| Component |
Version |
| Node.js |
v24.18.0 |
| npm |
11.16.0 |
| Salesforce CLI |
@salesforce/cli/2.142.7 linux-arm64 node-v24.18.0 |
| Plugin |
Version |
| sfdx-git-delta |
6.45.1 |
sf-devcontainer
| Component |
Version |
| Node.js |
v24.18.0 |
| npm |
11.16.0 |
| Salesforce CLI |
@salesforce/cli/2.142.7 linux-arm64 node-v24.18.0 |
| Plugin |
Version |
| sfdx-git-delta |
6.45.1 |
| @salesforce/plugin-code-analyzer |
5.14.0 |
| sfdx-browserforce-plugin |
6.3.2 |
sf-bulk
| Component |
Version |
| Node.js |
v24.18.0 |
| npm |
11.16.0 |
| Salesforce CLI |
@salesforce/cli/2.142.7 linux-arm64 node-v24.18.0 |
| Plugin |
Version |
| sfdx-git-delta |
6.45.1 |
What's Changed
- chore: consumer-readiness audit — docs, Hub README sync, .dockerignore, label fixes by @gambe94 in #6
- chore: pin base images by tag plus multi-arch manifest digest by @gambe94 in #7
- refactor: call shared docker-build-test-push reusable workflow by @gambe94 in #8
- docs: add GitHub Actions usage examples to image READMEs by @gambe94 in #9
- docs: normalize badges across image READMEs by @gambe94 in #10
- docs: changelog for v1.7.0 by @gambe94 in #11
Full Changelog: v1.6.1...v1.7.0
