opencode
2f66fff993
Build & Push Docker Image / build (push) Failing after 1m18s
Policy: every direct dependency is now an exact pin; lockfile + --frozen-lockfile keep builds reproducible; save-exact=true enforced. Toolchain: - pnpm 10.26 -> 11.18 (lockfile migrated; supportedArchitectures moved to pnpm-workspace.yaml) - typescript 5.9 -> 7.0, vite 7 -> 8, @vitejs/plugin-react 5 -> 6 - esbuild override 0.27.3 -> 0.28.1 (closes GHSA-g7r4-m6w7-qqqr); added @esbuild/darwin-arm64 for local dev - orval 8.9 -> 8.23, regenerated clients Backend (prod image): - openid-client 5.7 -> 6.8 (rewritten OIDC flow in routes/auth.ts: discovery + functional API, PKCE/state, fetchUserInfo, buildEndSessionUrl) - pino 9 -> 10, pino-http 10 -> 11, thread-stream 3 -> 4 - zod 3.25 -> 4.4 (catalog; supported by drizzle-zod 0.8.3) - pg 8.20 -> 8.22; removed deprecated @types/bcryptjs Frontend: - react/react-dom 19.1.0 -> 19.2.8 (catalog pin lifted; expo note removed) - react-day-picker 9 -> 10 (table classname -> month_grid) - recharts 2 -> 3 (TooltipContentProps + DefaultLegendContentProps typing; safe keys) - react-resizable-panels 2 -> 4 (Group/Separator rename) - date-fns 3 -> 4, @hookform/resolvers 3 -> 5, lucide-react 0.545 -> 1.28 - all @radix-ui/*, tailwind, types, and remaining patch/minor deps bumped to latest Security/process: - overrides for body-parser >=2.3.0 (GHSA-v422-hmwv-36x6) + markdown-it/linkify-it/brace-expansion/fast-uri (dev tooling) - pnpm audit now reports 0 vulnerabilities (prod and full) - CI audit gate added to build.yaml; docs/dependency-policy.md; renovate.json - Dockerfile pins node:24.18.1-alpine and pnpm@11.18.0
56 lines
1.8 KiB
Docker
56 lines
1.8 KiB
Docker
FROM node:24.18.1-alpine AS builder
|
|
WORKDIR /app
|
|
|
|
RUN npm install -g pnpm@11.18.0
|
|
|
|
# 1. Alle Projektdateien in den Container bringen
|
|
COPY . .
|
|
|
|
# 2. Abhängigkeiten installieren
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Zwingt pnpm, alle nativen Binärdateien für Alpine physisch bereit zustellen
|
|
RUN pnpm add -w @rollup/rollup-linux-x64-musl lightningcss-linux-x64-musl @tailwindcss/oxide-linux-x64-musl --save-optional --config.ignore-scripts=false
|
|
|
|
ENV BASE_PATH=/
|
|
ENV PORT=8080
|
|
|
|
RUN pnpm -r --if-present run build
|
|
|
|
FROM node:24.18.1-alpine AS runner
|
|
WORKDIR /app
|
|
|
|
RUN npm install -g pnpm@11.18.0
|
|
|
|
COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
|
|
COPY lib/db/package.json lib/db/
|
|
COPY lib/api-spec/package.json lib/api-spec/
|
|
COPY lib/api-zod/package.json lib/api-zod/
|
|
COPY lib/api-client-react/package.json lib/api-client-react/
|
|
COPY artifacts/api-server/package.json artifacts/api-server/
|
|
COPY artifacts/toolrate/package.json artifacts/toolrate/
|
|
|
|
RUN pnpm install --frozen-lockfile --prod
|
|
|
|
# HIER ERGÄNZT: drizzle-kit und pg am Ende hinzugefügt, damit das CMD-Skript nicht abstürzt!
|
|
RUN pnpm add -w @rollup/rollup-linux-x64-musl lightningcss-linux-x64-musl @tailwindcss/oxide-linux-x64-musl drizzle-kit pg --save-optional --prod
|
|
|
|
# Kopiert den gesamten Ordner lib/db (inkl. src/), da es kein dist/ gibt
|
|
COPY --from=builder /app/lib/db lib/db
|
|
COPY --from=builder /app/artifacts/api-server/dist artifacts/api-server/dist
|
|
COPY --from=builder /app/artifacts/toolrate/dist artifacts/toolrate/dist
|
|
|
|
ENV NODE_ENV=production
|
|
ENV STATIC_DIR=/app/artifacts/toolrate/dist/public
|
|
|
|
ARG COMMIT_SHA=""
|
|
ARG BUILD_DATE=""
|
|
ARG VERSION=""
|
|
ENV COMMIT_SHA=${COMMIT_SHA}
|
|
ENV BUILD_DATE=${BUILD_DATE}
|
|
ENV VERSION=${VERSION}
|
|
|
|
EXPOSE 8080
|
|
|
|
CMD ["sh", "-c", "pnpm --filter @workspace/db run push-force && node --enable-source-maps artifacts/api-server/dist/index.mjs"]
|