From ef8ca2fd7231f331f6822955b518a25861663b87 Mon Sep 17 00:00:00 2001
From: Renaud Chaput <renchap@gmail.com>
Date: Thu, 14 Sep 2023 23:11:36 +0200
Subject: [PATCH] Change Dockerfile to upgrade packages when building (#26922)

---
 .github/workflows/build-container-image.yml | 7 +++++--
 .github/workflows/build-nightly.yml         | 1 +
 .github/workflows/build-releases.yml        | 2 ++
 Dockerfile                                  | 1 +
 4 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-container-image.yml b/.github/workflows/build-container-image.yml
index 532921b1ff..0008e902ca 100644
--- a/.github/workflows/build-container-image.yml
+++ b/.github/workflows/build-container-image.yml
@@ -4,6 +4,9 @@ on:
       platforms:
         required: true
         type: string
+      cache:
+        type: boolean
+        default: true
       use_native_arm64_builder:
         type: boolean
       push_to_images:
@@ -92,5 +95,5 @@ jobs:
           push: ${{ inputs.push_to_images != '' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: ${{ inputs.cache && 'type=gha' }}
+          cache-to: ${{ inputs.cache && 'type=gha,mode=max' }}
diff --git a/.github/workflows/build-nightly.yml b/.github/workflows/build-nightly.yml
index 5feb2ade33..aa1f916afe 100644
--- a/.github/workflows/build-nightly.yml
+++ b/.github/workflows/build-nightly.yml
@@ -26,6 +26,7 @@ jobs:
     with:
       platforms: linux/amd64,linux/arm64
       use_native_arm64_builder: true
+      cache: false
       push_to_images: |
         tootsuite/mastodon
         ghcr.io/mastodon/mastodon
diff --git a/.github/workflows/build-releases.yml b/.github/workflows/build-releases.yml
index f739a69d9a..98b9dfc0df 100644
--- a/.github/workflows/build-releases.yml
+++ b/.github/workflows/build-releases.yml
@@ -17,6 +17,8 @@ jobs:
       push_to_images: |
         tootsuite/mastodon
         ghcr.io/mastodon/mastodon
+      # Do not use cache when building releases, so apt update is always ran and the release always contain the latest packages
+      cache: false
       # Only tag with latest when ran against the latest stable branch
       # This needs to be updated after each minor version release
       flavor: |
diff --git a/Dockerfile b/Dockerfile
index 3fe4a62bdf..f73bdcf786 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,6 +17,7 @@ COPY Gemfile* package.json yarn.lock /opt/mastodon/
 
 # hadolint ignore=DL3008
 RUN apt-get update && \
+    apt-get -yq dist-upgrade && \
     apt-get install -y --no-install-recommends build-essential \
         git \
         libicu-dev \