TehRiehlDeal
8c10124272
CI / test (push) Successful in 25s
CI / lint (push) Successful in 28s
CI / secrets-scan (push) Successful in 5s
CI / vuln-scan (push) Successful in 12s
CI / sast (push) Successful in 10s
CI / build-images (push) Failing after 51s
CI / image-scan (push) Has been skipped
CI / push (push) Has been skipped
Wires up the CD half of the pipeline. New jobs build multi-stage Docker images for the frontend and backend, run a Trivy image scan that fails on HIGH/CRITICAL findings, and push to harbor.tehriehldeal.com on main only. Each push tags <version> (from package.json), <sha>, and latest; a pre-push existence check refuses to overwrite a version tag that already points at a different digest, forcing a real bump. The Vite frontend now reads runtime config from window.__RUNTIME_CONFIG__, populated by /config.js which nginx renders from container env vars at startup via envsubst. A getConfig() helper falls back to import.meta.env for `pnpm dev` and Vitest, so existing test scaffolding keeps working. PWA workbox excludes /config.js from precache and serves it NetworkOnly to keep stale config from surviving a container restart. Bumps frontend 0.0.0→0.1.0 and backend 0.0.1→0.1.0 (production deployment is a meaningful new capability for both packages). Also fixes four pre-existing tsc -b errors that the new vite build step in the frontend Dockerfile would otherwise hit: global.fetch → globalThis.fetch in three test files, null-guard in Activity.tsx account filter, type cast on Recharts Pie onClick in Dashboard.tsx, typed callback signature on the auth.test.ts onAuthStateChange mock. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
42 lines
2.0 KiB
Docker
42 lines
2.0 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
ARG NODE_VERSION=20
|
|
|
|
FROM node:${NODE_VERSION}-alpine AS deps
|
|
RUN apk add --no-cache libc6-compat openssl
|
|
RUN corepack enable && corepack prepare pnpm@9 --activate
|
|
WORKDIR /repo
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
|
|
COPY tehriehlbudget-backend/package.json tehriehlbudget-backend/
|
|
COPY tehriehlbudget-frontend/package.json tehriehlbudget-frontend/
|
|
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
|
|
pnpm install --frozen-lockfile --filter tehriehlbudget-backend...
|
|
|
|
FROM deps AS build
|
|
WORKDIR /repo
|
|
COPY tehriehlbudget-backend/ tehriehlbudget-backend/
|
|
RUN pnpm --filter tehriehlbudget-backend exec prisma generate
|
|
RUN pnpm --filter tehriehlbudget-backend run build
|
|
|
|
FROM deps AS prod-deps
|
|
WORKDIR /repo
|
|
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
|
|
pnpm install --frozen-lockfile --prod --filter tehriehlbudget-backend...
|
|
|
|
FROM node:${NODE_VERSION}-alpine AS runtime
|
|
RUN apk add --no-cache libc6-compat openssl tini
|
|
WORKDIR /app
|
|
RUN addgroup -S nodeapp && adduser -S nodeapp -G nodeapp
|
|
ENV NODE_ENV=production
|
|
COPY --from=build --chown=nodeapp:nodeapp /repo/tehriehlbudget-backend/dist ./dist
|
|
COPY --from=build --chown=nodeapp:nodeapp /repo/tehriehlbudget-backend/prisma ./prisma
|
|
COPY --from=build --chown=nodeapp:nodeapp /repo/tehriehlbudget-backend/package.json ./package.json
|
|
COPY --from=prod-deps --chown=nodeapp:nodeapp /repo/tehriehlbudget-backend/node_modules ./node_modules
|
|
# Overlay generated Prisma client from the build stage (the prod-deps stage
|
|
# pruned the `prisma` CLI devDep, which removes the client during install).
|
|
COPY --from=build --chown=nodeapp:nodeapp /repo/tehriehlbudget-backend/node_modules/.prisma ./node_modules/.prisma
|
|
COPY --from=build --chown=nodeapp:nodeapp /repo/tehriehlbudget-backend/node_modules/@prisma ./node_modules/@prisma
|
|
USER nodeapp
|
|
EXPOSE 3000
|
|
ENTRYPOINT ["/sbin/tini", "--"]
|
|
CMD ["node", "dist/main"]
|