## Summary
- The admin-tools container CMD runs `sleep infinity` in the foreground,
which blocks the shell from processing signal traps
- SIGTERM is never handled, so the container hangs until the kubelet
termination deadline before being force-killed
- Background the sleep and use `wait` as the foreground command instead
-- `wait` is a shell builtin that gets interrupted by signals, allowing
the trap handler to exit immediately
## Test plan
Run the following to compare signal handling before and after:
```bash
#!/usr/bin/env bash
set -euo pipefail
STOP_TIMEOUT=5
echo "=== OLD: sleep infinity in foreground (should hang for ${STOP_TIMEOUT}s) ==="
docker run -d --name admin-tools-old alpine:latest \
sh -c "trap exit INT HUP TERM; sleep infinity" >/dev/null
sleep 1
echo "Container running. Sending SIGTERM..."
start=$(date +%s)
docker stop --timeout "$STOP_TIMEOUT" admin-tools-old >/dev/null
elapsed=$(( $(date +%s) - start ))
echo "Stopped in ${elapsed}s (expected: ${STOP_TIMEOUT}s -- signal was ignored)"
docker rm admin-tools-old >/dev/null
echo ""
echo "=== NEW: sleep infinity & wait (should exit immediately) ==="
docker run -d --name admin-tools-new alpine:latest \
sh -c "trap exit INT HUP TERM; sleep infinity & wait" >/dev/null
sleep 1
echo "Container running. Sending SIGTERM..."
start=$(date +%s)
docker stop --timeout "$STOP_TIMEOUT" admin-tools-new >/dev/null
elapsed=$(( $(date +%s) - start ))
echo "Stopped in ${elapsed}s (expected: 0s -- signal was handled)"
docker rm admin-tools-new >/dev/null
```
Expected output:
```
=== OLD: sleep infinity in foreground (should hang for 5s) ===
Container running. Sending SIGTERM...
Stopped in 5s (expected: 5s -- signal was ignored)
=== NEW: sleep infinity & wait (should exit immediately) ===
Container running. Sending SIGTERM...
Stopped in 0s (expected: 0s -- signal was handled)
```
## What changed?
- Centralized Alpine base image version to a single source of truth in
\`docker/docker-bake.hcl\` (\`ALPINE_TAG\`).
- Updated Docker targets to consume \`ALPINE_TAG\` from bake args
(removed duplicated Dockerfile defaults).
- Updated build action handling so an empty \`alpine-tag\` input does
not override bake defaults.
- Simplified manual Docker workflow inputs by removing platform/snapshot
toggles and hardcoding snapshot builds + multi-arch behavior for manual
runs.
- Clarified manual workflow input descriptions (\`cli-version\`,
\`alpine-tag\`, and push destination).
## Why?
- Avoid Alpine version drift across multiple files.
- Make manual dispatch safer and less error-prone (empty Alpine input
should use default, not fail with \`alpine:\`).
- Reduce confusing/no-op options in manual workflow while keeping
release behavior unchanged.
## Updating versions
**Alpine base image** — edit the \`ALPINE_TAG\` default in
\`docker/docker-bake.hcl\` (line 41):
```hcl
variable "ALPINE_TAG" {
default = "3.23.3" # <-- change this
}
```
**Temporal CLI** — edit the \`defaultCliVersion\` constant in
\`.github/actions/build-docker-images/scripts/main.go\` (line 17):
```go
// defaultCliVersion should be updated to the latest cli version
const defaultCliVersion = "1.6.1" // <-- change this
```
To pin a different version for a one-off manual run without changing the
default, pass it via the \`cli-version\` workflow dispatch input
instead.
## Validation
- Triggered manual workflow against branch and confirmed branch is
available on upstream.
- Verified bake config resolves default Alpine tag from
\`docker/docker-bake.hcl\`.
## Summary
Bumps dependencies to address security CVEs on `main`:
- **CVE-2026-33186 (CRITICAL)**: `google.golang.org/grpc` v1.72.2 →
v1.79.3 — authorization bypass via missing leading `/` in `:path` header
- **CVE-2026-22184 (HIGH)**: Alpine `zlib` 1.3.1-r2 → 1.3.2-r0 — global
buffer overflow in `untgz` utility
Note: The other two CVEs from the v1.30.2 security review are already
addressed on `main`:
- otel/sdk v1.40.0 — already landed via #9442
- Go stdlib — `main` is on Go 1.26.0 (separate release series)
## Risk assessment
- **grpc v1.72.2 → v1.79.3**: 7 minor version jump with ~23 transitive
dependency upgrades. Builds cleanly. Same bump successfully applied to
`release/v1.30.x` in #9610.
- **zlib**: Alpine package upgrade via `apk upgrade --no-cache zlib` in
both server and admin-tools Dockerfiles.
## Test plan
- [ ] CI passes
Made with [Cursor]()
## Summary
- Bump Alpine base image tag default to 3.23.3 for server/admin-tools
images.
- Update defaults in docker build bake args and manual build workflows.
## What changed?
* Remove redundant docker image platform
* Remove Multi Arch build PR trigger
Th Multi Arch build PR build trigger was added to validate multi arch
builds in PR. It's likely overkill now. There is a single arch docker
build on each PR for the feature tests
## What changed?
* updates goreleaser to v2
* add GHA for build admin-tools and server images within this repo.
`docker-builds` will only be used for building pre 1.30 images
* added GHA to promote docker builds from temporaliotest to temproalio
docker image repos
* trivy security scanning gates for image promotion (pulled rom
docker-builds repo). The gate can be overridden
## Why?
* we decided to move away from building images in `docker-builds`. The
complexity is not needed
* updates goreleaser to v2 because the v1 definitions might be no longer
supported at some point and this is a good time to do it
* I used go scripts for the more complex flows instead of js or bash so
we don't introduce another language contributors need to be familiar
with. IMO the js or bash I did use it simple enough to understand.
## How did you test it?
It passes in CI.
## Potential risks
* these build pipelines are only compatible with the new docker images.
* merging this PR may break our nightly tests. Will double check before
merging
* flows that are not triggered by opening a PR are untested and
therefore not completely validated
