mirror of
https://github.com/apache/superset.git
synced 2026-07-20 21:55:46 +00:00
dfd1a76978
Adds a cron-triggered workflow that re-runs the Docker image build against the most-recent published release every Monday at 06:00 UTC (and on manual workflow_dispatch when an operator wants to force it). The Superset code being built doesn't change — but the base image layers (python:*-slim-trixie and the Debian OS packages underneath) DO receive upstream security patches between Superset releases. Without a rebuild, apache/superset:<latest> ships those CVEs unfixed for as long as the inter-release gap (typically 3–6 weeks). Why this approach over the alternatives: - Tied to releases: defeats the purpose — the gap we're trying to close IS the inter-release window. Release-triggered rebuilds happen exactly when we already get them. - Swap to Chainguard / distroless: would also close the gap, but at the cost of a backward-incompatible package-manager change for downstream operators who extend `apache/superset:<tag>` with their own apt install lines for custom drivers. A scheduled rebuild captures most of the CVE-cycling benefit without that breakage. - Daily cadence: probably overkill — Debian's security tree updates on a roughly weekly rhythm and a daily rebuild would just churn the registry without adding much. Implementation: deliberately reuses the same `supersetbot docker` invocation as `tag-release.yml` (same matrix of build presets, same `--context release --context-ref <tag> --force-latest` flags), so the resulting tags are byte-equivalent to what a manual release dispatch would produce — only the base layer changes. Concurrency group shared with the release publisher so the two can't race each other on the Docker Hub push. Tag mutability note: the rebuild overwrites both the rolling tags (`apache/superset:latest`) AND the version-specific tag of the latest release (e.g. `apache/superset:5.0.0`). This is intentional and matches how the upstream `python:*-slim-trixie` images themselves behave — version tags reflect content + latest patches, not a frozen SHA. Users who need a frozen reference should pin by image digest.