fix(ci): patch CI container vulnerability toolchain (#959)

Author: johntmyers

deploy/docker/Dockerfile.ci

@@ -10,6 +10,7 @@ FROM nvcr.io/nvidia/base/ubuntu:noble-20251013
 
 ARG DOCKER_VERSION=29.4.1
 ARG BUILDX_VERSION=v0.33.0
+ARG NPM_VERSION=11.13.0
 ARG TARGETARCH
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -65,7 +66,7 @@ RUN case "$TARGETARCH" in \
     | tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"
 
 # Install mise
-ARG MISE_VERSION=v2026.4.18
+ARG MISE_VERSION=v2026.4.20
 RUN curl https://mise.run | MISE_VERSION=$MISE_VERSION sh
 
 # Copy mise.toml and task includes, then install all tools via mise
@@ -77,6 +78,8 @@ RUN --mount=type=secret,id=MISE_GITHUB_TOKEN \
     mise trust /opt/mise/mise.toml && \
     env -u RUSTC_WRAPPER mise install && \
     mise reshim && \
+    npm install -g "npm@${NPM_VERSION}" && \
+    mise reshim && \
     (/root/.cargo/bin/rustup component remove rust-docs || true) && \
     rm -rf /root/.rustup/toolchains/*/share/doc /root/.rustup/toolchains/*/share/man
 

mise.toml

@@ -13,15 +13,15 @@ experimental = true
 python.precompiled_flavor = "install_only_stripped"
 
 [tools]
-python = "3.13.12"
+python = "3.13.13"
 rust = "stable"
-node = "24"
-kubectl = "1.35.1"
-uv = "0.10.2"
+node = "24.15.0"
+kubectl = "1.35.4"
+uv = "0.10.12"
 protoc = "29.6"
 helm = "4.1.4"
 "ubi:mozilla/sccache" = { version = "0.14.0", matching = "sccache-v" }
-"github:anchore/syft" = { version = "1.42.3" }
+"github:anchore/syft" = { version = "1.43.0" }
 "github:EmbarkStudios/cargo-about" = { version = "0.8.4", version_prefix = "" }
 zig = "0.14.1"
 "npm:markdownlint-cli2" = "0.22.0"

tasks/scripts/docker-build-ci.sh

@@ -18,9 +18,17 @@ elif [[ "${DOCKER_PLATFORM:-}" == *","* ]]; then
   OUTPUT_ARGS=(--push)
 fi
 
+SECRET_ARGS=()
+if [[ -n "${MISE_GITHUB_TOKEN:-}" ]]; then
+  SECRET_ARGS=(--secret id=MISE_GITHUB_TOKEN,env=MISE_GITHUB_TOKEN)
+elif [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  SECRET_ARGS=(--secret id=MISE_GITHUB_TOKEN,env=GITHUB_TOKEN)
+fi
+
 exec ce_build \
   ${DOCKER_BUILDER:+--builder ${DOCKER_BUILDER}} \
   ${DOCKER_PLATFORM:+--platform ${DOCKER_PLATFORM}} \
+  ${SECRET_ARGS[@]+"${SECRET_ARGS[@]}"} \
   -f deploy/docker/Dockerfile.ci \
   -t "openshell/ci:${IMAGE_TAG:-dev}" \
   --provenance=false \