TudorandClaude Opus 5
0c901cd0d1
PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 1m11s
PR Checks / Backend Smoke (pull_request) Successful in 9s
PR Checks / Build Backend (no push) (pull_request) Successful in 18s
PR Checks / Build Frontend (no push) (pull_request) Successful in 1m19s
PR Checks / Build Pipeline (no push) (pull_request) Successful in 36s
PR Checks / AI Code Review (Claude) (pull_request) Successful in 6m3s
Staging health polling asked only whether something answered HTTP 200 at the base URL. It could not tell the new deployment from the old one, so journeys could pass against the previous release, and concurrent merges could move the staging tags underneath a run in flight. Each staging run now mints a build ID and stamps all three images with the commit and that ID, as labels and — for frontend and backend — as a build-time JSON file that environment overrides cannot rewrite. /release.json reports both identities uncached, and scripts/ci/release.py polls for the expected pair before and after the journeys. Only then are the captured build digests tagged verified-<sha>. Promotion resolves those verified tags to immutable digests, revalidates their labels, and refuses a mixed or incomplete set before any :prod tag moves. The whole staging workflow shares one concurrency group with cancellation disabled, so releases serialise. The scripts are stdlib-only and unit-tested against mocked registry and HTTP behaviour; PR checks now run the pipeline and CI suites too. The runbook records what this cannot prove locally, and that the first rollout needs a commit built by this workflow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
88 lines
2.5 KiB
Docker
88 lines
2.5 KiB
Docker
# Multi-stage build for Next.js application
|
|
|
|
# Stage 1: Dependencies
|
|
FROM node:24-alpine AS deps
|
|
WORKDIR /app
|
|
|
|
# Copy package files
|
|
COPY package.json package-lock.json* ./
|
|
|
|
# Install all dependencies (including devDependencies needed for build)
|
|
RUN npm ci
|
|
|
|
# Stage 2: Builder
|
|
FROM node:24-alpine AS builder
|
|
WORKDIR /app
|
|
|
|
# Copy dependencies from deps stage
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
# Set environment variables for build
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV NODE_ENV=production
|
|
|
|
# Default backend URL for any server-side fetch during `next build`. The
|
|
# runtime /api proxy reads FASTAPI_URL per request (see app/api/[...path]),
|
|
# so the deployed container's env is what actually routes traffic.
|
|
ARG FASTAPI_URL=http://backend:80/api
|
|
ENV FASTAPI_URL=${FASTAPI_URL}
|
|
|
|
ARG BUILD_SHA=development
|
|
ARG BUILD_ID=development
|
|
RUN node -e 'require("fs").writeFileSync("build-info.json", JSON.stringify({sha:process.argv[1],build_id:process.argv[2]}))' "$BUILD_SHA" "$BUILD_ID"
|
|
|
|
# Build application
|
|
RUN npm run build
|
|
|
|
# Stage 3: Runner
|
|
FROM node:24-alpine AS runner
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
# Create non-root user
|
|
RUN addgroup --system --gid 1001 nodejs
|
|
RUN adduser --system --uid 1001 nextjs
|
|
|
|
# Copy necessary files
|
|
COPY --from=builder /app/public ./public
|
|
COPY --from=builder /app/.next/standalone ./
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
|
|
# Fonts for the generated share card. File tracing already places these in
|
|
# .next/standalone/assets, so the COPY above carries them — this makes the
|
|
# dependency explicit rather than implicit in the tracer's behaviour, because
|
|
# a miss here is a silent 500 on /opengraph-image, not a build failure.
|
|
COPY --from=builder /app/assets ./assets
|
|
|
|
# Payload writes uploads here, and the compose file mounts a named volume over
|
|
# it. The directory must exist and be owned by the runtime user BEFORE the
|
|
# mount: Docker seeds a fresh named volume from the image path, so a missing or
|
|
# root-owned directory here makes every upload fail with EACCES at runtime,
|
|
# long after the build passed. The chown below covers it.
|
|
RUN mkdir -p /app/media
|
|
|
|
# Set correct permissions
|
|
RUN chown -R nextjs:nodejs /app
|
|
|
|
# Switch to non-root user
|
|
USER nextjs
|
|
|
|
# Expose port
|
|
EXPOSE 3000
|
|
|
|
# Set environment variables
|
|
ARG BUILD_SHA=development
|
|
ARG BUILD_ID=development
|
|
LABEL io.schoolcompare.build-id=$BUILD_ID
|
|
LABEL io.schoolcompare.commit=$BUILD_SHA
|
|
COPY --from=builder /app/build-info.json ./build-info.json
|
|
|
|
ENV PORT=3000
|
|
ENV HOSTNAME="0.0.0.0"
|
|
|
|
# Start application
|
|
CMD ["node", "server.js"]
|