build: upgrade base Docker image to prevent security vulnerability

[diogokiss]

According to Snyk.io, the currently used base Docker image has 19 security
vulnerabilities (13 high).
https://snyk.io/test/docker/node%3A16.5.0-alpine3.14

On the other hand, the image node:16.14.2-alpine3.14 has no known security
vulnerabilies.

https://snyk.io/test/docker/node%3A16.14.2-alpine3.14

This commit upgrades the image to fix the above mentioned issues.

[diogokiss]

Hi, @wagoid! 🇧🇷 👋
I'm not really sure what the error with the failing job is about.
I mean, it is complaining about some permissions, but I'm not sure how to debug it.

fatal: unsafe repository ('/github/workspace' is owned by someone else)

If there is anything I can help with, please, let me know.

In the meanwhile, I'll check the other errors.

I was wondering whether I should upgrade all the used Node versions to 16. What do you say?

❯ fgrep -r node-version .github/workflows
.github/workflows/commitlint.yml:          node-version: '14'
.github/workflows/commitlint.yml:          node-version: '14'
.github/workflows/ci.yml:          node-version: '12.x'
.github/workflows/ci.yml:          node-version: '12.x'

[diogokiss]

@wagoid, I think I fixed the Node version-related error. However, the error with regard to the unsafe repository seems to be related to this issue.
actions/checkout#760

Apparently, there are 2 options to work around the problem:

• Solution 1 - pre git v2.35.2
• Solution 2 - git v2.35.2 onwards

[jdbruijn]

Yeah good one. Feel free to add the seconds solution, so git config --global --add safe.directory /github/workspace to the commitment workflow. As this is running in the action I'm guessing the git version to be latest, or at least near latest and that is also what the error log is suggesting 😄

[wagoid]

Hi @diogokiss! 🇧🇷 👋 🎉
Thank you for the contribution! Agreed, as @jdbruijn said second option shouold probably be the right one 🚀

[wagoid]

Just noticed this issue was already present before your PR, so I created another one that fixes it: #411. Turns out actions/checkout was already applying the safe.directory in latest version but we needed to do something different for this action. The PR description explains everything.

@diogokiss once you sync with origin the issue should be gone 🚀

[Fdawgs]

Maybe change it to the latest LTS, 16.15.0?

[wagoid]

@Fdawgs thanks for the suggestion! I'll update the dependabot config to also include Dockerfile so that we can more easily keep things up to date