luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 16: CI dependency audit & security checks #15

Merged
luckberg merged 40 commits from gsd/phase-16-ci-dependency-audit-and-security-checks into main 2026-06-13 10:01:01 -04:00
Conversation 0 Commits 40 Files Changed 42
+4
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 5b4f32a649 - Show all commits
apps/api/Dockerfile
+4
View File
@@ -39,6 +39,10 @@ COPY apps/pwa/package.json ./apps/pwa/
RUN pnpm install --frozen-lockfile --prod --filter @familysync/api... RUN pnpm install --frozen-lockfile --prod --filter @familysync/api...
COPY --from=builder /app/apps/api/dist ./apps/api/dist COPY --from=builder /app/apps/api/dist ./apps/api/dist
WORKDIR /app/apps/api WORKDIR /app/apps/api
# Enforce production identity — engages the NODE_ENV=production hard guard
# in devBypass.ts, preventing dev-bypass activation even if DEV_AUTH_BYPASS
# is accidentally set in the container environment. (D-07)
ENV NODE_ENV=production
# PWA static assets built from apps/pwa and served by this API from ./public # PWA static assets built from apps/pwa and served by this API from ./public
# (single-port deployment for the Pangolin/newt tunnel). serveStatic resolves # (single-port deployment for the Pangolin/newt tunnel). serveStatic resolves
# ./public relative to the runtime CWD, which is this WORKDIR (/app/apps/api). # ./public relative to the runtime CWD, which is this WORKDIR (/app/apps/api).