luna
9645aebce1
- Add workspace-level pnpm install in Dockerfile so pnpm-workspace.yaml supply-chain settings (onlyBuiltDependencies, allowBuilds) apply uniformly - Pin pnpm@11.5.2 via corepack with sha1 hash to prevent future policy drift - Downgrade postcss to ^8.5.22 (8.5.23 was <24h old, violated minimumReleaseAge) - Regenerate frontend/pnpm-lock.yaml and add root pnpm-lock.yaml for full workspace - Add binaryTargets to Prisma schema for linux-musl (Alpine) + debian compatibility - Run pnpm approve-builds to set allowBuilds for esbuild, ssh2, prisma, @prisma/* - Fix docker-compose.yml: postgres:18-alpine volume at /var/lib/postgresql (not /data) - Add .env.docker.example; ignore .env.docker in .gitignore Integration tests (Docker Compose against real Gitea 1.26.2): ✅ Docker image builds cleanly (pnpm frozen-lockfile, no policy violations) ✅ postgres:18-alpine starts healthy ✅ Prisma migrations run on startup ✅ Founder registration and session auth ✅ Gitea connection validated (PAT scope check) ✅ Webhook registered on test repo (Hook ID 11) ✅ PR opened → HMAC verified → preview created → DEPLOY job queued ✅ Gitea PR comment posted (write:issue scope confirmed working) ✅ Deploy fails correctly at AWS step: "Region is missing" (no creds in test env) ✅ PR closed → STOP job created and completed (status DONE) ✅ HMAC rejection: wrong signature → 401 ✅ /pp stop via issue_comment webhook → accepted Blocked (expected): EC2 provisioning requires AWS credentials not present in CI/test env. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
50 lines
1.9 KiB
Docker
50 lines
1.9 KiB
Docker
# Stage 1: Install all workspace dependencies
|
|
# Using workspace-level install so pnpm-workspace.yaml settings (onlyBuiltDependencies,
|
|
# supply-chain policies, etc.) apply uniformly — the canonical pnpm monorepo pattern.
|
|
FROM node:24-alpine AS deps
|
|
WORKDIR /app
|
|
|
|
# Copy workspace manifest files first for layer caching
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY frontend/package.json ./frontend/
|
|
COPY backend/package.json ./backend/
|
|
COPY prisma/ ./prisma/
|
|
|
|
# corepack activates the exact pnpm version declared in package.json#packageManager.
|
|
# This is hash-verified (sha1) and prevents newer pnpm from applying different
|
|
# supply-chain policies (e.g. minimumReleaseAge) against a lockfile generated with
|
|
# the pinned version.
|
|
RUN corepack enable && corepack install && \
|
|
pnpm install --frozen-lockfile
|
|
|
|
# Stage 2: Build frontend
|
|
FROM deps AS frontend-builder
|
|
COPY frontend/ ./frontend/
|
|
RUN pnpm --filter pp-frontend run build
|
|
|
|
# Stage 3: Build backend + Prisma client
|
|
FROM deps AS backend-builder
|
|
COPY backend/ ./backend/
|
|
RUN pnpm --filter pp-backend run generate && \
|
|
pnpm --filter pp-backend run build
|
|
|
|
# Stage 4: Minimal production runner
|
|
FROM node:24-alpine AS runner
|
|
WORKDIR /app
|
|
RUN apk add --no-cache openssl
|
|
|
|
# Root node_modules contains prisma CLI and hoisted deps; backend node_modules has
|
|
# the backend-specific symlinks. Both are needed at runtime.
|
|
COPY --from=backend-builder /app/node_modules ./node_modules
|
|
COPY --from=backend-builder /app/backend/dist ./backend/dist
|
|
COPY --from=backend-builder /app/backend/node_modules ./backend/node_modules
|
|
COPY --from=backend-builder /app/backend/package.json ./backend/package.json
|
|
COPY --from=frontend-builder /app/frontend/dist ./frontend/dist
|
|
COPY prisma/ ./prisma/
|
|
|
|
WORKDIR /app/backend
|
|
|
|
EXPOSE 5000
|
|
|
|
CMD sh -c "../node_modules/.bin/prisma migrate deploy --schema=../prisma/schema.prisma && node dist/index.js"
|