chore: collect node checksum at build time

.github/workflows/build-docker-full.yml

@@ -18,6 +18,11 @@ jobs:
       - name: Check out the repo
         uses: actions/checkout@v3
 
+      - uses: actions/setup-node@v3
+        id: setup-node
+        with:
+          node-version: ${{ vars.NODE_VERSION_OVERRIDE || 'lts/*' }}
+
       - name: Log in to Docker Hub
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
         with:
@@ -30,6 +35,21 @@ jobs:
         with:
           images: salesforce/cli
 
+      - name: Collect Node checksum
+        id: node-checksum
+        uses: salesforcecli/github-workflows/.github/actions/retry@main
+        with:
+          command: |
+            NODE_VERSION="${{ steps.setup-node.outputs.node-version }}"
+
+            URL="https://nodejs.org/dist/$NODE_VERSION/SHASUMS256.txt"
+            echo "Retrieving SHA data from: $URL"
+
+            SHA=$(curl -s "$URL" | awk "/[0-9a-f]{64}  node-$NODE_VERSION-linux-x64.tar.gz/ { print \$1 }")
+            echo "Checksum found: $SHA"
+
+            echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+
       - name: Build and push Docker image
         uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
         with:
@@ -38,6 +58,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           file: dockerfiles/Dockerfile_full
           build-args: |
+            NODE_VERSION=${{ steps.setup-node.outputs.node-version }}
+            NODE_CHECKSUM=${{ steps.node-checksum.outputs.sha }}
             SF_CLI_VERSION=${{ inputs.version }}
           tags: salesforce/cli:${{ inputs.channel }}-full, salesforce/cli:${{ inputs.version }}-full
 

.github/workflows/make-pr-for-nightly.yml

@@ -88,18 +88,3 @@ jobs:
         run: sf-release cli:release:build --start-from-github-ref main --patch ${{ inputs.only && format('--only {0}', inputs.only) || '' }} --label nightly-automerge --release-channel nightly
         # If the package.json 'minor' IS GREATER THAN the latest-rc 'minor', we want to bump 'patch'
         if: ${{ steps.package-json-semver-info.outputs.minor > steps.latest-rc-semver-info.outputs.minor }}
-
-      - name: Update node version in dockerfile_full
-        uses: salesforcecli/github-workflows/.github/actions/retry@main
-        with:
-          command: node ./dockerfiles/update-docker-node-version.cjs
-
-      # Push Dockerfile changes if 'git status' is not empty
-      - run: |
-          if [[ -n $(git status --short) ]]; then
-            git add dockerfiles/Dockerfile_full
-            git commit -m "chore: update node in dockerfile_full" --no-verify
-            git push --no-verify
-          else
-            echo "Already up to date"
-          fi

.github/workflows/make-pr-for-release.yml

@@ -67,19 +67,3 @@ jobs:
             ${{ inputs.patch && '--patch' || '' }} \
             ${{ inputs.only && format('--only {0}', inputs.only) || '' }} \
             ${{ inputs.empty && '--empty' || '' }}
-
-      - name: Update node version in dockerfile_full
-        uses: salesforcecli/github-workflows/.github/actions/retry@main
-        with:
-          command: node ./dockerfiles/update-docker-node-version.cjs
-
-      # Push Dockerfile changes if 'git status' is not empty
-      - run: |
-          if [[ -n $(git status --short) ]]; then
-            git add dockerfiles/Dockerfile_full
-            git commit -m "chore: update node in dockerfile_full" --no-verify
-            sleep 300
-            git push --no-verify
-          else
-            echo "Already up to date"
-          fi

dockerfiles/Dockerfile_full

@@ -2,11 +2,15 @@ FROM heroku/heroku:22
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# this will typically be nightly
+# This will typically be nightly
 ARG SF_CLI_VERSION=nightly
+# Full semver version with `v` prefix. e.g. v20.9.0
+ARG NODE_VERSION
+# sha256 checksum for the nodejs.tar.gz file
+ARG NODE_CHECKSUM
 
-RUN echo 'f0919f092fbf74544438907fa083c21e76b2d7a4bc287f0607ada1553ef16f60  ./nodejs.tar.gz' > node-file-lock.sha \
-  && curl -s -o nodejs.tar.gz https://nodejs.org/dist/v20.9.0/node-v20.9.0-linux-x64.tar.gz \
+RUN echo '${NODE_CHECKSUM}  ./nodejs.tar.gz' > node-file-lock.sha \
+  && curl -s -o nodejs.tar.gz https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.gz \
   && shasum --check node-file-lock.sha
 RUN mkdir /usr/local/lib/nodejs \
   && tar xf nodejs.tar.gz -C /usr/local/lib/nodejs/ --strip-components 1 \