From 68bb8787ae1ac95fd3776c95dc975b558a1d4669 Mon Sep 17 00:00:00 2001
From: Joker <joker@sabatech.dev>
Date: Tue, 25 Aug 2026 23:04:48 +0000
Subject: [PATCH 1/2] fix(ci): repin setup-buildx SHA (was 39-char truncated,
 unresolvable) + Dockerfile pnpm-first
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- slsa-provenance.yml: b5ca5143…cbd truncated 39 chars -> GitHub 'unable to find version'. Repinned to v3 tag SHA 8d2750c6…
- Dockerfile: repo is pnpm-first (pnpm-lock + workspace + CI pnpm9); npm-based image died at 'npm run build' with spawn pnpm ENOENT. Switch install/build to pnpm@9 frozen-lockfile
---
 .github/workflows/slsa-provenance.yml |  2 +-
 Dockerfile                            | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/slsa-provenance.yml b/.github/workflows/slsa-provenance.yml
index 0e9a10a87..5733050bd 100644
--- a/.github/workflows/slsa-provenance.yml
+++ b/.github/workflows/slsa-provenance.yml
@@ -33,7 +33,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd9f16464e31d5e78d1f2f7e7f4cbd
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3 (repin: SHA anterior truncado a 39 chars, no resolvía)
 
       - name: Log in to GHCR
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
diff --git a/Dockerfile b/Dockerfile
index d6ab08891..cdf027655 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,14 +3,18 @@ FROM node:22-slim
 # Install build dependencies for native modules (better-sqlite3)
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
+# pnpm: el repo es pnpm-first (pnpm-lock.yaml + pnpm-workspace.yaml + CI con pnpm 9).
+# El build anterior moría con "spawn pnpm ENOENT" al usar npm con scripts que invocan pnpm.
+RUN npm install -g pnpm@9
+
 WORKDIR /app
 
-COPY package.json package-lock.json ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY scripts/ ./scripts/
-RUN npm install
+RUN pnpm install --frozen-lockfile
 
 COPY . .
-RUN npm run build
+RUN pnpm build
 
 ENV NODE_ENV=production
 ENV HOSTNAME=0.0.0.0

From 93d32a90cf8fb5aa4abb2151319e9357d5ede32f Mon Sep 17 00:00:00 2001
From: Joker <joker@sabatech.dev>
Date: Tue, 25 Aug 2026 23:06:50 +0000
Subject: [PATCH 2/2] =?UTF-8?q?chore(docker):=20add=20.dockerignore=20?=
 =?UTF-8?q?=E2=80=94=20exclude=20.next,=20node=5Fmodules,=20docs/memory=20?=
 =?UTF-8?q?noise=20from=20build=20context?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .dockerignore | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..2b5059a8f
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,23 @@
+# Build artifacts
+.next/
+node_modules/
+out/
+build/
+dist/
+
+# Local dev / workspace noise
+docs/specs/
+memory/
+reports/
+output/
+skills/
+*.log
+.env*
+!.env.example
+
+# Git / CI
+.git/
+.github/
+coverage/
+*.tsbuildinfo
+next.config.mjs.bak2