Lucas WintherandClaude Opus 5
6177633abc
The suite gained three tests that assert on .github/workflows — the freshness-cache restore, the per-attempt cache key and the rebase-and- retry push, all defects that live in YAML and fail silently. But .dockerignore excluded .github, so those three tests failed inside the image build and took the whole build down with them. Put .github in the build context. It reaches the build stage only; the runtime stage still copies nothing but public/ and serve.ts, and the image is unchanged (verified: /app holds public and serve.ts, nothing else). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
54 lines
1.9 KiB
Docker
54 lines
1.9 KiB
Docker
# Build the static site, then serve it from a distroless-ish runtime.
|
|
#
|
|
# Two stages so the image ships the built assets and nothing else: no source,
|
|
# no fixtures, no toolchain. The build is fully offline — it parses the
|
|
# committed snapshots, falling back to checked-in fixtures, rather than
|
|
# fetching anything — so the image is reproducible and needs no network at
|
|
# build time.
|
|
|
|
FROM oven/bun:1.3-alpine AS build
|
|
WORKDIR /app
|
|
|
|
# Dependencies first, so a source-only change reuses this layer.
|
|
COPY package.json bun.lock ./
|
|
RUN bun install --frozen-lockfile
|
|
|
|
COPY tsconfig.json index.html serve.ts ./
|
|
COPY src ./src
|
|
COPY scripts ./scripts
|
|
COPY fixtures ./fixtures
|
|
# Whatever the last refresh committed. The directory always exists (it carries
|
|
# a README), so this cannot break a build made before the first refresh — it
|
|
# just leaves build:feed on the fixture fallback, which is what the image did
|
|
# before. Without it the container would serve fixture-era data while the site
|
|
# served fresh, with nothing to say why.
|
|
COPY snapshots ./snapshots
|
|
COPY test ./test
|
|
# The suite asserts on the refresh workflows — three defects that live in YAML
|
|
# and fail silently — so the files have to be here for `bun test` below to mean
|
|
# the same thing it means in CI.
|
|
COPY .github ./.github
|
|
|
|
# Fail the image on a type error or a failing test rather than shipping it.
|
|
RUN bun run typecheck && bun test
|
|
RUN bun run build
|
|
|
|
|
|
FROM oven/bun:1.3-alpine AS runtime
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV PORT=3000
|
|
|
|
# Run unprivileged. The bun image ships a `bun` user; use it rather than root.
|
|
COPY --from=build --chown=bun:bun /app/public ./public
|
|
COPY --from=build --chown=bun:bun /app/serve.ts ./serve.ts
|
|
USER bun
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD bun -e "await fetch('http://127.0.0.1:'+(process.env.PORT??3000)+'/api/health').then(r=>{if(!r.ok)process.exit(1)})"
|
|
|
|
CMD ["bun", "run", "serve.ts"]
|