overflowWrap: 'anywhere' for CardHeadlines

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.github
+node_modules
+dist

.github/workflows/ab-testing-ci.yml

@@ -194,7 +194,7 @@ jobs:
         run: pnpm  --filter @guardian/ab-testing-cdk synth
 
       - name: Riff-Raff Upload
-        uses: guardian/actions-riff-raff@v4.3.3
+        uses: guardian/actions-riff-raff@v4.3.4
         with:
           roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
           githubToken: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cicd.yml

@@ -4,10 +4,21 @@ on:
   push:
 
 jobs:
+  production-container:
+    permissions:
+      contents: read
+      id-token: write # Required to exchange for AWS credentials using OIDC
+    uses: ./.github/workflows/container-production.yml
+    secrets:
+      GU_RIFF_RAFF_ROLE_ARN: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+
   container:
     permissions:
       packages: write
+    needs: [production-container]
     uses: ./.github/workflows/container.yml
+    with:
+      production-image-digest: ${{ needs.production-container.outputs.imageDigest }}
 
   prettier:
     uses: ./.github/workflows/prettier.yml

.github/workflows/container-production.yml

@@ -0,0 +1,46 @@
+name: Production container
+on:
+  workflow_call:
+    secrets:
+      GU_RIFF_RAFF_ROLE_ARN:
+        required: true
+    outputs:
+      imageDigest:
+        description: 'The digest of the generated container image'
+        value: ${{ jobs.build-production-image.outputs.imageDigest }}
+jobs:
+  facts:
+    runs-on: ubuntu-slim
+    permissions: {} # This job doesn't need any permissions. Explicitly set it to an empty object to avoid inheriting any default permissions of the workflow.
+    outputs:
+      branchName: ${{ steps.get-build-facts.outputs.branchName }}
+      buildNumber: ${{ steps.get-build-facts.outputs.buildNumber }}
+      commitSha: ${{ steps.get-build-facts.outputs.commitSha }}
+    steps:
+      - uses: guardian/actions-build-facts@v0.0.1
+        id: get-build-facts
+
+  build-production-image:
+    runs-on: ubuntu-latest
+    needs:
+      - facts
+    permissions:
+      contents: read
+      id-token: write # Required to exchange for AWS credentials using OIDC
+    outputs:
+      imageDigest: ${{ steps.publish-image.outputs.imageDigest }}
+    steps:
+      - uses: actions/checkout@v6.0.2
+      - name: Add commit hash for PRout
+        working-directory: dotcom-rendering
+        run: echo 'export const GIT_COMMIT_HASH = "${{ needs.facts.outputs.commitSha }}";' > src/server/prout.ts
+      - name: Build image
+        run: docker buildx build -f Production.dockerfile -t ${{ github.repository }}:latest .
+      - name: Publish Image
+        uses: guardian/actions-publish-image@v0.0.2
+        id: publish-image
+        with:
+          roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+          branchName: ${{ needs.facts.outputs.branchName }}
+          buildNumber: ${{ needs.facts.outputs.buildNumber }}
+          commitSha: ${{ needs.facts.outputs.commitSha }}

.github/workflows/container.yml

@@ -2,6 +2,11 @@
 # Commercial rely on a container image built from the main branch with the tag 'main'
 on:
   workflow_call:
+    inputs:
+      production-image-digest:
+        description: 'Digest of image pushed to AWS ECR to run on AWS ECS. Gets used by `cdk synth`.'
+        required: true
+        type: string
     outputs:
       container-image:
         description: 'The generated container image path'
@@ -30,6 +35,8 @@ jobs:
           echo 'export const GIT_COMMIT_HASH = "${{ github.sha }}";' > src/server/prout.ts
 
       - name: Generate production bundle
+        env:
+          IMAGE_DIGEST: ${{ inputs.production-image-digest }}
         run: make riffraff-bundle
         working-directory: dotcom-rendering
 

.github/workflows/dcr-chromatic.yml

@@ -47,7 +47,7 @@ jobs:
       - name: Chromatic - DCR
         env:
           NODE_OPTIONS: '--max_old_space_size=4096'
-        uses: chromaui/action@v16.10.0
+        uses: chromaui/action@v17.4.1
         if: |
           github.ref == 'refs/heads/main' ||
           (github.event_name == 'pull_request' &&

.github/workflows/publish.yml

@@ -55,7 +55,7 @@ jobs:
 
       # All rendering apps deployment
       - name: Upload rendering apps to RiffRaff
-        uses: guardian/actions-riff-raff@v4.3.3
+        uses: guardian/actions-riff-raff@v4.3.4
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}
           roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}

Production.dockerfile

@@ -0,0 +1,31 @@
+FROM dhi.io/node:24-alpine3.23-dev AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME/bin:$PATH"
+RUN corepack enable
+COPY . /app
+WORKDIR /app
+
+# Install dependencies as a separate step to take advantage of Docker's caching.
+# Leverage a cache mount to /pnpm/store to speed up subsequent builds.
+FROM base AS dependencies
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+WORKDIR /app/dotcom-rendering
+ENV PATH="node_modules/.bin:$PATH"
+ENV NODE_ENV=production
+
+# Build the application
+FROM dependencies AS builder
+RUN webpack --config webpack/webpack.config.js --progress
+RUN node scripts/islands/island-descriptions.mjs
+
+# Finally, create the production image with only the necessary files
+FROM dhi.io/node:24-alpine3.23 AS application
+WORKDIR /app
+COPY --from=builder --chown=node:node /app/dotcom-rendering/dist /app
+
+ENV NODE_ENV=production
+
+# Expose the port that the application listens on
+EXPOSE 9000
+
+CMD ["node", "/app/server.js"]

ab-testing/cdk/lib/__snapshots__/abTestingConfig.test.ts.snap

@@ -2,7 +2,7 @@ exports[`The ID5 Baton Lambda stack > matches the CODE snapshot 1`] = `
 {
   "Metadata": {
     "gu:cdk:constructs": [],
-    "gu:cdk:version": "63.3.1"
+    "gu:cdk:version": "64.0.0"
   },
   "Parameters": {
     "BuildId": {
@@ -46,7 +46,7 @@ exports[`The ID5 Baton Lambda stack > matches the PROD snapshot 1`] = `
 {
   "Metadata": {
     "gu:cdk:constructs": [],
-    "gu:cdk:version": "63.3.1"
+    "gu:cdk:version": "64.0.0"
   },
   "Parameters": {
     "BuildId": {

ab-testing/cdk/lib/__snapshots__/deploymentLambda.test.ts.snap

@@ -5,7 +5,7 @@ exports[`The AB testing deployment lambda stack > matches the CODE snapshot 1`]
       "GuDistributionBucketParameter",
       "GuLambdaFunction"
     ],
-    "gu:cdk:version": "63.3.1"
+    "gu:cdk:version": "64.0.0"
   },
   "Parameters": {
     "SsmParameterValueaccountservicesdotcomstorebucketC96584B6F00A464EAD1953AFF4B05118Parameter": {
@@ -55,7 +55,7 @@ exports[`The AB testing deployment lambda stack > matches the CODE snapshot 1`]
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -294,7 +294,7 @@ exports[`The AB testing deployment lambda stack > matches the CODE snapshot 1`]
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -327,7 +327,7 @@ exports[`The AB testing deployment lambda stack > matches the PROD snapshot 1`]
       "GuDistributionBucketParameter",
       "GuLambdaFunction"
     ],
-    "gu:cdk:version": "63.3.1"
+    "gu:cdk:version": "64.0.0"
   },
   "Parameters": {
     "SsmParameterValueaccountservicesdotcomstorebucketC96584B6F00A464EAD1953AFF4B05118Parameter": {
@@ -377,7 +377,7 @@ exports[`The AB testing deployment lambda stack > matches the PROD snapshot 1`]
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -616,7 +616,7 @@ exports[`The AB testing deployment lambda stack > matches the PROD snapshot 1`]
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",

ab-testing/cdk/lib/__snapshots__/notificationLambda.test.ts.snap

@@ -10,7 +10,7 @@ exports[`The AB testing notification lambda stack > matches the CODE snapshot 1`
       "GuScheduledLambda",
       "GuLambdaErrorPercentageAlarm"
     ],
-    "gu:cdk:version": "63.3.1"
+    "gu:cdk:version": "64.0.0"
   },
   "Resources": {
     "EmailIdentityAbtestingnotificationlambdaE053C648": {
@@ -24,7 +24,7 @@ exports[`The AB testing notification lambda stack > matches the CODE snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -113,7 +113,7 @@ exports[`The AB testing notification lambda stack > matches the CODE snapshot 1`
         "Tags": [
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -166,7 +166,7 @@ exports[`The AB testing notification lambda stack > matches the CODE snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -340,7 +340,7 @@ exports[`The AB testing notification lambda stack > matches the CODE snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -452,7 +452,7 @@ exports[`The AB testing notification lambda stack > matches the CODE snapshot 1`
         "Tags": [
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -494,7 +494,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
       "GuScheduledLambda",
       "GuLambdaErrorPercentageAlarm"
     ],
-    "gu:cdk:version": "63.3.1"
+    "gu:cdk:version": "64.0.0"
   },
   "Resources": {
     "EmailIdentityAbtestingnotificationlambdaE053C648": {
@@ -508,7 +508,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -597,7 +597,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
         "Tags": [
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -660,7 +660,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -834,7 +834,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -869,7 +869,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
           },
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",
@@ -1006,7 +1006,7 @@ exports[`The AB testing notification lambda stack > matches the PROD snapshot 1`
         "Tags": [
           {
             "Key": "gu:cdk:version",
-            "Value": "63.3.1"
+            "Value": "64.0.0"
           },
           {
             "Key": "gu:repo",

ab-testing/cdk/tsconfig.json

@@ -6,7 +6,8 @@
 		"allowImportingTsExtensions": true,
 		"erasableSyntaxOnly": true,
 		"moduleResolution": "nodenext",
-		"module": "nodenext"
+		"module": "nodenext",
+		"types": ["node"]
 	},
 	"exclude": ["node_modules"]
 }