Amir Pourmand
0e97206907
* ci: optimize build time for Docker and CI workflows - Dockerfile: slim production-stage to copy only runtime artifacts (.next, public, node_modules, package.json, next.config.mjs), dropping src/, src-tauri/, patches/, packages source, etc. - Dockerfile: add sharing=locked to pnpm store cache mount to prevent concurrent-build cache corruption - docker-image.yml: pin actions/checkout to SHA (consistent with other workflows) - docker-image.yml: switch Buildx cache from type=gha (10 GB shared limit, poor for multi-arch) to type=registry on GHCR (no size cap, already authenticated, correct per-platform caching) - pull-request.yml: use pnpm install --frozen-lockfile --prefer-offline - release.yml: use pnpm install --frozen-lockfile --prefer-offline - next.config.mjs: skip redundant eslint pass during next build (lint already runs as a dedicated CI step) * fix(docker): eliminate QEMU emulation, fix pnpm version mismatch, patch artifact write CVE (#4) * fix(docker): eliminate QEMU arm64 emulation and fix pnpm version mismatch - Fix pnpm version in Dockerfile: 10.29.3 → 11.1.1 (matches package.json) Prevents corepack from re-downloading pnpm 11 on every build - Replace single QEMU job with matrix build (ubuntu-latest for amd64, ubuntu-24.04-arm for arm64) — eliminates ~21 min QEMU emulation overhead - Use per-platform build cache tags (buildcache-linux-amd64 / buildcache-linux-arm64) to avoid cache thrashing between architectures - Add merge job that assembles multi-arch manifest from platform digests Agent-Logs-Url: https://github.com/pourmand1376/readest/sessions/89c298b4-8a58-4517-ac7f-2f26c86bbcd6 Co-authored-by: pourmand1376 <32064808+pourmand1376@users.noreply.github.com> * fix(ci): upgrade artifact actions to v7 to patch arbitrary file write vulnerability actions/download-artifact >= 4.0.0 < 4.1.3 allows arbitrary file write via artifact extraction. Pin both upload-artifact and download-artifact to v7 (SHA-pinned), consistent with the rest of the repo's workflows. Agent-Logs-Url: https://github.com/pourmand1376/readest/sessions/89c298b4-8a58-4517-ac7f-2f26c86bbcd6 Co-authored-by: pourmand1376 <32064808+pourmand1376@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pourmand1376 <32064808+pourmand1376@users.noreply.github.com> * chore(docker): tighten build context Exclude local env, build output, credential, and tooling state files from Docker build context to reduce registry cache exposure. --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Huang Xin <chrox.huang@gmail.com>
65 lines
2.8 KiB
Docker
65 lines
2.8 KiB
Docker
FROM docker.io/library/node:24-slim@sha256:24dc26ef1e3c3690f27ebc4136c9c186c3133b25563ae4d7f0692e4d1fe5db0e AS dependencies
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
RUN corepack prepare pnpm@11.1.1 --activate
|
|
WORKDIR /app
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY apps/readest-app/package.json ./apps/readest-app/
|
|
COPY patches/ ./patches/
|
|
COPY packages/ ./packages/
|
|
RUN --mount=type=cache,id=pnpm,sharing=locked,target=/pnpm/store pnpm install --frozen-lockfile
|
|
RUN pnpm --filter @readest/readest-app setup-vendors
|
|
|
|
FROM docker.io/library/node:24-slim@sha256:24dc26ef1e3c3690f27ebc4136c9c186c3133b25563ae4d7f0692e4d1fe5db0e AS development-stage
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
RUN corepack prepare pnpm@11.1.1 --activate
|
|
WORKDIR /app
|
|
COPY --from=dependencies /app /app
|
|
COPY . .
|
|
WORKDIR /app/apps/readest-app
|
|
EXPOSE 3000
|
|
ENTRYPOINT ["pnpm", "dev-web", "-H", "0.0.0.0"]
|
|
|
|
FROM docker.io/library/node:24-slim@sha256:24dc26ef1e3c3690f27ebc4136c9c186c3133b25563ae4d7f0692e4d1fe5db0e AS build
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
RUN corepack prepare pnpm@11.1.1 --activate
|
|
WORKDIR /app
|
|
ARG NEXT_PUBLIC_SUPABASE_URL
|
|
ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
|
|
ARG NEXT_PUBLIC_APP_PLATFORM
|
|
ARG NEXT_PUBLIC_API_BASE_URL
|
|
ARG NEXT_PUBLIC_OBJECT_STORAGE_TYPE
|
|
ARG NEXT_PUBLIC_STORAGE_FIXED_QUOTA
|
|
ARG NEXT_PUBLIC_TRANSLATION_FIXED_QUOTA
|
|
COPY --from=dependencies /app/node_modules /app/node_modules
|
|
COPY --from=dependencies /app/apps/readest-app/node_modules /app/apps/readest-app/node_modules
|
|
COPY --from=dependencies /app/apps/readest-app/public/vendor /app/apps/readest-app/public/vendor
|
|
COPY --from=dependencies /app/packages/foliate-js/node_modules /app/packages/foliate-js/node_modules
|
|
COPY . .
|
|
WORKDIR /app/apps/readest-app
|
|
RUN pnpm build-web
|
|
|
|
FROM docker.io/library/node:24-slim@sha256:24dc26ef1e3c3690f27ebc4136c9c186c3133b25563ae4d7f0692e4d1fe5db0e AS production-stage
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
RUN corepack prepare pnpm@11.1.1 --activate
|
|
WORKDIR /app
|
|
# Only copy what next start needs — omit source, Rust, tests, patches, etc.
|
|
COPY --from=build /app/package.json /app/package.json
|
|
COPY --from=build /app/pnpm-workspace.yaml /app/pnpm-workspace.yaml
|
|
COPY --from=build /app/node_modules /app/node_modules
|
|
COPY --from=build /app/apps/readest-app/package.json /app/apps/readest-app/package.json
|
|
COPY --from=build /app/apps/readest-app/next.config.mjs /app/apps/readest-app/next.config.mjs
|
|
COPY --from=build /app/apps/readest-app/node_modules /app/apps/readest-app/node_modules
|
|
COPY --from=build /app/apps/readest-app/.next /app/apps/readest-app/.next
|
|
COPY --from=build /app/apps/readest-app/public /app/apps/readest-app/public
|
|
WORKDIR /app/apps/readest-app
|
|
ENTRYPOINT ["pnpm", "start-web", "-H", "0.0.0.0"]
|
|
EXPOSE 3000
|