Skip to content

Commit 7a0532c

Browse files
MedformatikMedformatik
committed
fix(docker): drop stale root patch copies
1 parent d789e5b commit 7a0532c

6 files changed

Lines changed: 8 additions & 32 deletions

File tree

‎apps/api/Dockerfile‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ RUN corepack enable && corepack prepare "$(node -e "console.log(require('/tmp/pa
88
FROM base AS deps
99
WORKDIR /app
1010
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
11-
# The lockfile references patched dependencies by file hash, so `pnpm install`
12-
# cannot resolve without the patch itself.
13-
COPY patches/ patches/
1411
COPY packages/core/package.json packages/core/
1512
COPY packages/db-schema/package.json packages/db-schema/
1613
COPY packages/hardlinks/package.json packages/hardlinks/
@@ -39,9 +36,6 @@ RUN pnpm install --frozen-lockfile
3936
FROM base AS prod-deps
4037
WORKDIR /app
4138
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
42-
# The lockfile references patched dependencies by file hash, so `pnpm install`
43-
# cannot resolve without the patch itself.
44-
COPY patches/ patches/
4539
COPY packages/core/package.json packages/core/
4640
COPY packages/db-schema/package.json packages/db-schema/
4741
COPY packages/hardlinks/package.json packages/hardlinks/

‎apps/ops-agent/Dockerfile‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ FROM base AS deps
88
WORKDIR /app
99
ENV HUSKY=0
1010
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
11-
# The lockfile references patched dependencies by file hash, so `pnpm install`
12-
# cannot resolve without the patch itself.
13-
COPY patches/ patches/
1411
COPY packages/ packages/
1512
COPY apps/ops-agent/package.json apps/ops-agent/
1613
RUN pnpm install --frozen-lockfile
@@ -19,9 +16,6 @@ FROM base AS prod-deps
1916
WORKDIR /app
2017
ENV HUSKY=0
2118
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
22-
# The lockfile references patched dependencies by file hash, so `pnpm install`
23-
# cannot resolve without the patch itself.
24-
COPY patches/ patches/
2519
COPY packages/ packages/
2620
COPY apps/ops-agent/package.json apps/ops-agent/
2721
RUN pnpm install --frozen-lockfile --prod --ignore-scripts

‎apps/transitous-runner/Dockerfile‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,6 @@ FROM base AS deps
3333
WORKDIR /app
3434
ENV HUSKY=0
3535
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
36-
# The lockfile references patched dependencies by file hash, so `pnpm install`
37-
# cannot resolve without the patch itself.
38-
COPY patches/ patches/
3936
COPY packages/ packages/
4037
COPY apps/transitous-runner/package.json apps/transitous-runner/
4138
RUN pnpm install --frozen-lockfile
@@ -44,9 +41,6 @@ FROM base AS prod-deps
4441
WORKDIR /app
4542
ENV HUSKY=0
4643
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
47-
# The lockfile references patched dependencies by file hash, so `pnpm install`
48-
# cannot resolve without the patch itself.
49-
COPY patches/ patches/
5044
COPY packages/ packages/
5145
COPY apps/transitous-runner/package.json apps/transitous-runner/
5246
RUN pnpm install --frozen-lockfile --prod --ignore-scripts && \

‎apps/web/Dockerfile‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ RUN corepack enable && corepack prepare "$(node -e "console.log(require('/tmp/pa
88
FROM base AS deps
99
WORKDIR /app
1010
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
11-
# The lockfile references patched dependencies by file hash, so `pnpm install`
12-
# cannot resolve without the patch itself.
13-
COPY patches/ patches/
1411
COPY packages/command-palette/package.json packages/command-palette/
1512
COPY packages/core/package.json packages/core/
1613
COPY packages/hey-api-client-fetch/package.json packages/hey-api-client-fetch/

‎scripts/supply-chain-policy.test.ts‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,12 @@ describe("production supply-chain policy", () => {
8181
expect(violations).toEqual([]);
8282
});
8383

84-
it("stages the patch directory in every image that installs from the lockfile", () => {
84+
it("stages patches exactly when an image's workspace lockfile requires them", () => {
8585
// `patchedDependencies` makes the lockfile reference each patch by file
8686
// hash, so a `pnpm install --frozen-lockfile` that cannot read the patch
87-
// fails outright. Every image that installs must therefore copy the
88-
// patches its own workspace root declares.
87+
// fails outright. Conversely, Docker rejects a COPY when that workspace's
88+
// patch directory no longer exists. Keep each install stage in exact sync
89+
// with the patches its own workspace root declares.
8990
for (const [workspaceRoot, dockerfiles] of [
9091
[
9192
".",
@@ -102,12 +103,14 @@ describe("production supply-chain policy", () => {
102103
const workspace = read(
103104
`${workspaceRoot === "." ? "" : `${workspaceRoot}/`}pnpm-workspace.yaml`,
104105
);
105-
if (!workspace.includes("patchedDependencies:")) continue;
106+
const hasPatchedDependencies = workspace.includes("patchedDependencies:");
106107
for (const dockerfile of dockerfiles) {
107108
const contents = read(dockerfile);
108109
const installs = contents.match(/pnpm install --frozen-lockfile/g)?.length ?? 0;
109110
expect(installs, dockerfile).toBeGreaterThan(0);
110-
expect(contents.match(/COPY patches\/ patches\//g)?.length ?? 0, dockerfile).toBe(installs);
111+
expect(contents.match(/COPY patches\/ patches\//g)?.length ?? 0, dockerfile).toBe(
112+
hasPatchedDependencies ? installs : 0,
113+
);
111114
}
112115
}
113116
});

‎services/data-manager/Dockerfile‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,6 @@ WORKDIR /app
3838
ENV HUSKY=0
3939

4040
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
41-
# The lockfile references patched dependencies by file hash, so `pnpm install`
42-
# cannot resolve without the patch itself.
43-
COPY patches/ patches/
4441
COPY services/data-manager/package.json services/data-manager/
4542
COPY packages/db-schema/package.json packages/db-schema/
4643
COPY packages/hardlinks/package.json packages/hardlinks/
@@ -71,9 +68,6 @@ WORKDIR /app
7168
ENV HUSKY=0
7269

7370
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
74-
# The lockfile references patched dependencies by file hash, so `pnpm install`
75-
# cannot resolve without the patch itself.
76-
COPY patches/ patches/
7771
COPY services/data-manager/package.json services/data-manager/
7872
COPY packages/db-schema/package.json packages/db-schema/
7973
COPY packages/hardlinks/package.json packages/hardlinks/

0 commit comments

Comments
 (0)