Skip to content

Content service image: its packages at the lockfile's versions #701

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamjohnwright merged 1 commit into from
Oct 27, 2026
Merged

Content service image: its packages at the lockfile's versions #701

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 17 additions & 10 deletions deploy/content-node/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,28 +7,35 @@ FROM node:24

WORKDIR /content-node

# Only what the service imports, at the versions the root package.json pins,
# read from it rather than restated here (as the render service does). The
# repository's own lockfile would drag in Angular, Playwright and the CMS to
# run two packages. A pin restated here stayed at express 5.2.1 when
# Dependabot moved the root to 5.3.0 (it watches only the root), so the image
# would have run a version nothing here tested.
# Only what the service imports, at the versions the repository resolves and
# tests: each must be a dependency of the root package.json, and is installed
# at the version the root lockfile resolved for it. The repository's own
# lockfile would drag in Angular, Playwright and the CMS to run two packages.
# A pin restated here stayed at express 5.2.1 when Dependabot moved the root
# to 5.3.0 (it watches only the root); a range read from package.json
# (neo4j-driver's ^6.2.0) would take the newest 6.x at build time, untested.
# Their own dependencies still resolve at build time, within express's and
# the driver's ranges.
COPY package.json ./root-package.json
COPY package-lock.json ./root-lock.json
RUN node -e " \
const root = require('./root-package.json'); \
const lock = require('./root-lock.json'); \
const dependencies = {}; \
for (const name of ['express', 'neo4j-driver']) { \
const version = (root.dependencies ?? {})[name]; \
if (!version) throw new Error(name + ' is not a dependency of the root package'); \
dependencies[name] = version; \
if (!(root.dependencies ?? {})[name]) \
throw new Error(name + ' is not a dependency of the root package'); \
const locked = (lock.packages ?? {})['node_modules/' + name]; \
if (!locked?.version) throw new Error(name + ' is not in the root lockfile'); \
dependencies[name] = locked.version; \
} \
require('node:fs').writeFileSync('package.json', JSON.stringify({ \
name: 'reactome-content-node', private: true, dependencies \
}, null, 2)); \
" \
&& npm install --omit=dev --no-audit --no-fund \
&& npm cache clean --force \
&& rm root-package.json
&& rm root-package.json root-lock.json

COPY tools/content-node/ ./tools/content-node/
# The nearest package.json is what tells Node a .ts module is a module (spec
Expand Down
Loading