From fe60d27ee4f370bb18cadccf3eda92f1d5a4e735 Mon Sep 17 00:00:00 2001
From: Mateusz <mateusz@russak.biz>
Date: Mon, 27 Jul 2026 20:37:57 +0200
Subject: [PATCH] fix(docker): repair release image build

The Docker build was broken in several layered ways, hidden because CI never
built the frontend and the image build failed early at Socket Firewall:

- Drop sfw from the image build: its runtime binary fails to run on
  Alpine/musl. The supply-chain scan still runs in CI (tests.yml).
- Bump build base node:22.12 -> node:22-alpine: pnpm 11.5.3 requires
  Node >= 22.13, and the newer image avoids corepack's stale-key error.
- Install the pinned pnpm directly instead of via corepack.
- vite: alias @jsr/planigale__sse so rollup resolves it (under
  app/node_modules) when bundling code imported from ../deno/api.
- CI: run `pnpm build` in tests.yml so the frontend build is gated
  (previously only linted, so these breakages shipped undetected).
---
 .github/workflows/tests.yml | 6 ++++++
 Dockerfile                  | 6 +++---
 app/vite.config.ts          | 4 ++++
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 735fc716..ca0a2540 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -43,5 +43,11 @@ jobs:
     - name: Frontend lint
       working-directory: app
       run: pnpm lint
+    - name: Frontend build
+      working-directory: app
+      run: pnpm build
+      env:
+        APP_NAME: quack
+        APP_VERSION: ${{ github.sha }}
     - run: deno task migrate:tests
     - run: deno task check
diff --git a/Dockerfile b/Dockerfile
index 08202e91..689c11c0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
-FROM node:22.12-alpine AS build
+FROM node:22-alpine AS build
 RUN mkdir -p /app
 WORKDIR /app
 COPY . .
 WORKDIR /app/app
-RUN corepack enable && npm i -g sfw
-RUN sfw pnpm install --frozen-lockfile
+RUN npm i -g pnpm@11.5.3
+RUN pnpm install --frozen-lockfile
 ENV APP_NAME=quack
 ARG APP_VERSION=3.x.x
 ENV APP_VERSION=$APP_VERSION
diff --git a/app/vite.config.ts b/app/vite.config.ts
index ef15fe3b..4956680c 100644
--- a/app/vite.config.ts
+++ b/app/vite.config.ts
@@ -36,6 +36,10 @@ export default defineConfig(({ command }) => ({
       "@quack/encryption": path.resolve(__dirname, "../deno/encryption/mod.ts"),
       "@quack/api": path.resolve(__dirname, "../deno/api/mod.ts"),
       "@quack/tools": path.resolve(__dirname, "../deno/tools/mod.ts"),
+      "@jsr/planigale__sse": path.resolve(
+        __dirname,
+        "node_modules/@jsr/planigale__sse",
+      ),
     },
   },
   plugins: [