build: unify Node 24 and upgrade release flow

docker/Dockerfile

@@ -1,6 +1,6 @@
 # Run Node package installation natively on the builder. Node/npm can spin at
 # 100% CPU when Alpine s390x is emulated through QEMU.
-FROM --platform=$BUILDPLATFORM node:18-alpine3.18 AS builder
+FROM --platform=$BUILDPLATFORM node:24.18.1-alpine3.24 AS builder
 
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -32,7 +32,7 @@ RUN set -x \
 # Pin amd64 to upstream's musl runtime after native URL parser crashes with APK Node.
 FROM --platform=linux/amd64 node:24.18.1-alpine3.24@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS node-runtime-amd64
 
-FROM python:3.11-alpine
+FROM python:3.11-alpine3.24
 
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -80,6 +80,7 @@ RUN --mount=type=bind,from=node-runtime-amd64,source=/usr/local/bin/node,target=
        cp /tmp/node-runtime-amd64 /usr/local/bin/node; \
        ln -sf /usr/local/bin/node /usr/bin/node; \
      fi \
+  && node --version | grep -E '^v24\.' \
   && rm -rf /var/cache/apk/* \
   && apk update \
   && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \

docker/Dockerfile.310

@@ -1,6 +1,6 @@
 # Run Node package installation natively on the builder. Node/npm can spin at
 # 100% CPU when Alpine s390x is emulated through QEMU.
-FROM --platform=$BUILDPLATFORM node:18-alpine3.18 AS builder
+FROM --platform=$BUILDPLATFORM node:24.18.1-alpine3.24 AS builder
 
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -32,7 +32,7 @@ RUN set -x \
 # Pin amd64 to upstream's musl runtime after native URL parser crashes with APK Node.
 FROM --platform=linux/amd64 node:24.18.1-alpine3.24@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS node-runtime-amd64
 
-FROM python:3.10-alpine
+FROM python:3.10-alpine3.24
 
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -80,6 +80,7 @@ RUN --mount=type=bind,from=node-runtime-amd64,source=/usr/local/bin/node,target=
        cp /tmp/node-runtime-amd64 /usr/local/bin/node; \
        ln -sf /usr/local/bin/node /usr/bin/node; \
      fi \
+  && node --version | grep -E '^v24\.' \
   && rm -rf /var/cache/apk/* \
   && apk update \
   && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \

docker/Dockerfile.debian

@@ -1,6 +1,10 @@
-# Node 20 Bookworm is the latest official Node image variant that covers the
-# full Debian build matrix, including arm/v7, ppc64le, and s390x.
-FROM node:20-bookworm-slim AS nodebuilder
+# Download and verify the target Node archive without running under QEMU.
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS nodebuilder
+ARG TARGETARCH
+COPY docker/install-node-debian.sh /tmp/install-node-debian.sh
+RUN apt-get update && \
+  apt-get install --no-install-recommends -y ca-certificates curl xz-utils && \
+  sh /tmp/install-node-debian.sh "${TARGETARCH}"
 
 FROM python:3.11.14-slim-bookworm AS builder
 COPY package.json .npmrc pnpm-lock.yaml /tmp/build/
@@ -11,6 +15,7 @@ RUN set -x && \
   apt-get update && \
   apt-get install --no-install-recommends -y libatomic1 && \
   npm i -g pnpm@8.3.1 && \
+  test "$(node --version)" = "v24.18.1" && \
   test "$(pnpm --version)" = "8.3.1" && \
   cd /tmp/build && \
   pnpm install --prod --frozen-lockfile
@@ -71,6 +76,7 @@ RUN set -x && \
   git config --global user.name "qinglong" && \
   git config --global http.postBuffer 524288000 && \
   npm install -g pnpm@8.3.1 pm2 ts-node typescript@5 && \
+  test "$(node --version)" = "v24.18.1" && \
   test "$(pnpm --version)" = "8.3.1" && \
   npm cache clean --force && \
   rm -rf /root/.cache && \

docker/Dockerfile.debian310

@@ -1,8 +1,12 @@
-# Node 20 Bookworm is the latest official Node image variant that covers the
-# full Debian build matrix, including arm/v7, ppc64le, and s390x.
-FROM node:20-bookworm-slim AS nodebuilder
+# Download and verify the target Node archive without running under QEMU.
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS nodebuilder
+ARG TARGETARCH
+COPY docker/install-node-debian.sh /tmp/install-node-debian.sh
+RUN apt-get update && \
+  apt-get install --no-install-recommends -y ca-certificates curl xz-utils && \
+  sh /tmp/install-node-debian.sh "${TARGETARCH}"
 
-# Keep the full release matrix, including s390x, on the same immutable base.
+# Keep s390x on the same immutable Python base as the other Debian targets.
 # The floating 3.10-slim-bookworm tag no longer includes s390x.
 FROM python:3.10.19-slim-bookworm@sha256:23f63358922e79a794f71be8f3723c84e5ccca9638af3f74456dc73d6184499e AS builder
 COPY package.json .npmrc pnpm-lock.yaml /tmp/build/
@@ -13,6 +17,7 @@ RUN set -x && \
   apt-get update && \
   apt-get install --no-install-recommends -y libatomic1 && \
   npm i -g pnpm@8.3.1 && \
+  test "$(node --version)" = "v24.18.1" && \
   cd /tmp/build && \
   pnpm install --prod --frozen-lockfile
 
@@ -71,6 +76,7 @@ RUN set -x && \
   git config --global user.name "qinglong" && \
   git config --global http.postBuffer 524288000 && \
   npm install -g pnpm@8.3.1 pm2 ts-node typescript@5 && \
+  test "$(node --version)" = "v24.18.1" && \
   npm cache clean --force && \
   rm -rf /root/.cache && \
   rm -rf /root/.npm && \

docker/install-node-debian.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+# The official Node 24 Bookworm image does not cover s390x. Use the same
+# verified upstream release archive on every supported Debian architecture.
+version=24.18.1
+case "${1:?Missing Docker TARGETARCH}" in
+  amd64) arch=x64; checksum=d6c664df3f3f61458e8c277585571328522d705166723a7c7823a9253a4d15a0 ;;
+  arm64) arch=arm64; checksum=7201e3a09dc825bac57867c81913e2b8f0ef87d04cb9082af4cda82f6ff3d88c ;;
+  ppc64le) arch=ppc64le; checksum=c47812c13862be7f6e71194c434c4d78a99096e72efb9c31a2627437e056d669 ;;
+  s390x) arch=s390x; checksum=acf57bd726f35afc2ba8475194e5a8bd532c00e1a3b2436295b2fbdde199d0e9 ;;
+  *) echo "Node ${version} has no supported Debian binary for TARGETARCH=$1" >&2; exit 1 ;;
+esac
+
+archive="node-v${version}-linux-${arch}.tar.xz"
+curl --fail --location --silent --show-error --retry 3 \
+  "https://nodejs.org/dist/v${version}/${archive}" -o "/tmp/${archive}"
+printf '%s  %s\n' "${checksum}" "/tmp/${archive}" | sha256sum --check --status
+tar -xJf "/tmp/${archive}" -C /usr/local --strip-components=1 --no-same-owner
+rm "/tmp/${archive}"
+# The target binary is executed and version-checked in the target builder/runtime stages.
+test -x /usr/local/bin/node