Install JavaScript dependencies in release images

Install JavaScript dependencies in release images

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified Dockerfile

Diff

1 file changed, +24 -1

ARG TAILWIND_SHA256=73f0e5459054e5cfaa8ab6f3b940f3fbe0f13cc7fd83bc24e7c655033c203400
ARG ESBUILD_VERSION=0.25.4
ARG ESBUILD_SHA256=93433b456cac3a454ee27403d3de9adce88d83e5439ba37e1471af54730c9ca7
ARG NODE_VERSION=24.15.0
ARG CODEX_VERSION=0.147.0

ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}@sha256:ae38be7cb19bffa78adedb04732d9e6ba83a507b4cfb06983cbe711edb49da54"

ARG TAILWIND_SHA256
ARG ESBUILD_VERSION
ARG ESBUILD_SHA256
ARG NODE_VERSION
ARG TARGETARCH
ENV OPENAGENTS_BUILD_REVISION=${OPENAGENTS_BUILD_REVISION}
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}


      /etc/apt/sources.list.d/debian.sources \
  && printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/99snapshot \
  && apt-get update \
  && apt-get install -y --no-install-recommends build-essential git \
  && apt-get install -y --no-install-recommends build-essential ca-certificates curl git xz-utils \
  && rm -rf /var/lib/apt/lists/*

# Install a checksum-pinned Node.js toolchain for JavaScript asset dependencies.
RUN set -eu; \
  case "${TARGETARCH:-amd64}" in \
    amd64) node_arch=x64; checksum=472655581fb851559730c48763e0c9d3bc25975c59d518003fc0849d3e4ba0f6 ;; \
    arm64) node_arch=arm64; checksum=f3d5a797b5d210ce8e2cb265544c8e482eaedcb8aa409a8b46da7e8595d0dda0 ;; \
    *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
  esac; \
  archive="node-v${NODE_VERSION}-linux-${node_arch}.tar.xz"; \
  curl -fsSL --retry 3 -o "/tmp/${archive}" "https://nodejs.org/dist/v${NODE_VERSION}/${archive}"; \
  echo "${checksum}  /tmp/${archive}" | sha256sum --check --strict; \
  tar -xJf "/tmp/${archive}" -C /usr/local --strip-components=1; \
  rm "/tmp/${archive}"; \
  node --version; \
  npm --version

# prepare build dir
WORKDIR /app


COPY config/config.exs config/${MIX_ENV}.exs config/
RUN mix deps.compile

# Install JavaScript dependencies before copying the rest of the asset tree so
# dependency downloads remain cached when application assets change.
COPY assets/package.json assets/package-lock.json ./assets/
RUN npm ci --prefix assets --ignore-scripts --no-audit --no-fund

# Install Tailwind and esbuild so assets can be built
RUN mix assets.setup \
  && printf '%s  %s\n' \

16	16		`ARG TAILWIND_SHA256=73f0e5459054e5cfaa8ab6f3b940f3fbe0f13cc7fd83bc24e7c655033c203400`
17	17		`ARG ESBUILD_VERSION=0.25.4`
18	18		`ARG ESBUILD_SHA256=93433b456cac3a454ee27403d3de9adce88d83e5439ba37e1471af54730c9ca7`
	19	+	`ARG NODE_VERSION=24.15.0`
19	20		`ARG CODEX_VERSION=0.147.0`
20	21
21	22		`ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}@sha256:ae38be7cb19bffa78adedb04732d9e6ba83a507b4cfb06983cbe711edb49da54"`

33	34		`ARG TAILWIND_SHA256`
34	35		`ARG ESBUILD_VERSION`
35	36		`ARG ESBUILD_SHA256`
	37	+	`ARG NODE_VERSION`
	38	+	`ARG TARGETARCH`
36	39		`ENV OPENAGENTS_BUILD_REVISION=${OPENAGENTS_BUILD_REVISION}`
37	40		`ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}`
38	41

45	48		`/etc/apt/sources.list.d/debian.sources \`
46	49		`&& printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/99snapshot \`
47	50		`&& apt-get update \`
48		-	`&& apt-get install -y --no-install-recommends build-essential git \`
	51	+	`&& apt-get install -y --no-install-recommends build-essential ca-certificates curl git xz-utils \`
49	52		`&& rm -rf /var/lib/apt/lists/*`
50	53
	54	+	`# Install a checksum-pinned Node.js toolchain for JavaScript asset dependencies.`
	55	+	`RUN set -eu; \`
	56	+	`case "${TARGETARCH:-amd64}" in \`
	57	+	`amd64) node_arch=x64; checksum=472655581fb851559730c48763e0c9d3bc25975c59d518003fc0849d3e4ba0f6 ;; \`
	58	+	`arm64) node_arch=arm64; checksum=f3d5a797b5d210ce8e2cb265544c8e482eaedcb8aa409a8b46da7e8595d0dda0 ;; \`
	59	+	`*) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \`
	60	+	`esac; \`
	61	+	`archive="node-v${NODE_VERSION}-linux-${node_arch}.tar.xz"; \`
	62	+	`curl -fsSL --retry 3 -o "/tmp/${archive}" "https://nodejs.org/dist/v${NODE_VERSION}/${archive}"; \`
	63	+	`echo "${checksum} /tmp/${archive}" \| sha256sum --check --strict; \`
	64	+	`tar -xJf "/tmp/${archive}" -C /usr/local --strip-components=1; \`
	65	+	`rm "/tmp/${archive}"; \`
	66	+	`node --version; \`
	67	+	`npm --version`
	68	+
51	69		`# prepare build dir`
52	70		`WORKDIR /app`
53	71

72	90		`COPY config/config.exs config/${MIX_ENV}.exs config/`
73	91		`RUN mix deps.compile`
74	92
	93	+	`# Install JavaScript dependencies before copying the rest of the asset tree so`
	94	+	`# dependency downloads remain cached when application assets change.`
	95	+	`COPY assets/package.json assets/package-lock.json ./assets/`
	96	+	`RUN npm ci --prefix assets --ignore-scripts --no-audit --no-fund`
	97	+
75	98		`# Install Tailwind and esbuild so assets can be built`
76	99		`RUN mix assets.setup \`
77	100		`&& printf '%s %s\n' \`