Dockerfile

# Multi-stage: devDependencies (TypeScript) never reach the runtime image.
FROM node:20-alpine AS build
WORKDIR /app

# Copy manifests first so the dependency layer caches independently of source.
COPY package.json package-lock.json ./
RUN npm ci

COPY tsconfig.json ./
COPY src ./src
COPY test ./test
RUN npm run build && npm test

FROM node:20-alpine AS runtime
WORKDIR /app

# Signal handling: without an init process, PID 1 in a container does not get
# default signal handlers, so SIGTERM would be ignored and every stop would be a
# 10-second SIGKILL — which for this program means an unflushed dedupe ledger and
# a burst of duplicate alerts on the next start.
RUN apk add --no-cache tini

ENV NODE_ENV=production
# There are no runtime dependencies, so only the compiled output is needed.
COPY --from=build /app/dist/src ./dist/src
COPY package.json ./

# The state directory must be writable by the unprivileged user, and is the one
# thing worth mounting a volume at.
RUN mkdir -p /app/data && chown -R node:node /app
USER node
VOLUME ["/app/data"]

ENV STATE_FILE=/app/data/state.json

# Only meaningful in webhook mode; harmless in polling mode.
EXPOSE 8080

HEALTHCHECK --interval=60s --timeout=5s --start-period=15s --retries=3 \
  CMD node -e "require('node:fs').accessSync(process.env.STATE_FILE ? require('node:path').dirname(process.env.STATE_FILE) : '/app/data')"

ENTRYPOINT ["/sbin/tini", "--", "node", "dist/src/index.js"]