[gascity-infra-agent]

HOLD: merge after AH stamp (~11-19)

This image (ghcr.io/gascity/gascity-registry) is not in the dedicated box bundle. It is, however, sealed into the identity-ha release bundle and deployed on identity-ha. See infra identity-ha-v0/flux/apps/registry/registry{,-apex}.yaml, corp-public/flux/apps/image-automation/identity-autodeploy.yaml (id-registry / id-registry-apex) and charts/tools/catalog/testdata/bundles/identity-ha/images.json. Under the release freeze, anything touching identity-ha holds until the AH stamp.

Summary

Fixes CVE-2026-105437 for git in both Alpine stages of the Dockerfile:

• the gc-build stage (golang:1.26.10-alpine@sha256:27f2…);
• the runtime stage (oven/bun:1.4.4-alpine@sha256:4cf8…).

Both stages are Alpine 3.24. Its only git is 2.54.1-r0, which is fixed: Alpine secdb lists CVE-2026-105437 under 2.54.1-r0, and upstream RelNotes 2.56.1 says the fix was merged up from v2.54.1. This PR adds the apk version floor 'git>=2.54.1-r0' to both apk add lines. If the base ever resolves an older, vulnerable git, the build now fails instead of shipping it. The digest pins are unchanged.

The Debian oven/bun:1.4.4 build stage doesn't install git, so it needs no change.

Verification (local)

DOCKER_BUILDKIT=1 docker build --secret id=gh_token,env=NODE_AUTH_TOKEN -t registry-ci-git105437 .     # rc=0
docker run --rm --entrypoint git registry-ci-git105437 --version                                       # git version 2.54.1
docker run --rm --entrypoint sh registry-ci-git105437 -c 'cat /etc/alpine-release; apk list --installed | grep ^git-'
#   3.24.3 / git-2.54.1-r0 / git-init-template-2.54.1-r0
docker build --target gc-build -t registry-gcbuild-git105437 . && docker run --rm registry-gcbuild-git105437 git --version
#   git version 2.54.1 (git-2.54.1-r0, Alpine 3.24.3)
# CI "Production image smoke" equivalents:
docker run --rm --entrypoint bun registry-ci-git105437 -e 'await import("./server/app.ts")'           # rc=0
docker run --rm --entrypoint /usr/local/bin/gc registry-ci-git105437 pack release hash --help         # rc=0

Rollout / rollback

• Rollout: after merge (and after the AH stamp), the image workflow publishes main-<epoch> / apex-main-<epoch>. promote.yml gates them to prod-* / apex-prod-*, and the identity-ha bundle picks them up via its ImagePolicies. This PR has no other deploy steps.
• Rollback: revert this commit, or re-pin the previous prod-* tag in the identity-ha bundle.

🤖 Generated with Claude Code