nicktrn
706a0b88c9
## Summary - Upgrade pnpm from 10.23.0 → 10.33.2 (latest minor) - Enable `blockExoticSubdeps: true` for supply-chain defense - Update all version references across the repo ## Security improvements in 10.28.2+ - Path traversal protection in `directories.bin` - Symlink-escape protection for `file:/git:` dependencies (prevents reading `/etc/passwd`, `~/.ssh/...`) - https://pnpm.io/settings#blockexoticsubdeps ## Files updated - `package.json` — `packageManager` field - `docker/Dockerfile` — 5 `corepack prepare` calls - `apps/supervisor/Containerfile` — 1 `corepack prepare` call - `pnpm-workspace.yaml` — added `blockExoticSubdeps: true` - `CLAUDE.md`, `AGENTS.md`, `CONTRIBUTING.md`, `ai/references/repo.md` — version references ## Verification - `pnpm install --frozen-lockfile` succeeds (no lockfile regen needed) - `pnpm install` (plain) produces zero lockfile diff - All CI checks pass Slack thread: https://triggerdotdev.slack.com/archives/C061L2MHW93/p1777625600974279?thread_ts=1777622248.762639&cid=C061L2MHW93 https://claude.ai/code/session_01G759MUqmjsPh9k1qDxbdjG --------- Co-authored-by: Claude <noreply@anthropic.com>
55 lines
1.7 KiB
Docker
55 lines
1.7 KiB
Docker
FROM node:22-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS node-22-alpine
|
|
|
|
WORKDIR /app
|
|
|
|
FROM node-22-alpine AS pruner
|
|
|
|
COPY --chown=node:node . .
|
|
RUN npx -q turbo@2.5.4 prune --scope=supervisor --docker
|
|
|
|
FROM node-22-alpine AS base
|
|
|
|
RUN apk add --no-cache dumb-init
|
|
|
|
COPY --chown=node:node .gitignore .gitignore
|
|
COPY --from=pruner --chown=node:node /app/out/json/ .
|
|
COPY --from=pruner --chown=node:node /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
COPY --from=pruner --chown=node:node /app/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
|
|
|
|
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
|
|
|
|
FROM base AS deps-fetcher
|
|
RUN apk add --no-cache python3-dev py3-setuptools make g++ gcc linux-headers
|
|
RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm fetch --frozen-lockfile
|
|
|
|
FROM deps-fetcher AS dev-deps
|
|
ENV NODE_ENV development
|
|
|
|
RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile --offline --ignore-scripts
|
|
|
|
FROM base AS builder
|
|
|
|
COPY --from=pruner --chown=node:node /app/out/full/ .
|
|
COPY --from=dev-deps --chown=node:node /app/ .
|
|
COPY --chown=node:node turbo.json turbo.json
|
|
COPY --chown=node:node .configs/tsconfig.base.json .configs/tsconfig.base.json
|
|
COPY --chown=node:node scripts/updateVersion.ts scripts/updateVersion.ts
|
|
|
|
RUN pnpm run generate && \
|
|
pnpm run --filter supervisor... build&& \
|
|
pnpm deploy --legacy --filter=supervisor --prod /prod/supervisor
|
|
|
|
FROM base AS runner
|
|
|
|
ENV NODE_ENV production
|
|
|
|
COPY --from=builder /prod/supervisor /app/apps/supervisor
|
|
|
|
EXPOSE 8000
|
|
USER node
|
|
|
|
# ensure pnpm is installed during build and not silently downloaded at runtime
|
|
RUN pnpm -v
|
|
|
|
CMD [ "/usr/bin/dumb-init", "--", "pnpm", "run", "--filter", "supervisor", "start"]
|