import fs from "node:fs"; import os from "node:os"; import path from "node:path"; import assert from "node:assert/strict"; import { afterEach, describe, it } from "vitest"; import { checkDbManifest, checkDockerfileDepsManifestContract, checkDockerignoreContract, checkDockerfileApiContract, checkDockerfileMcpContract, checkHocuspocusDockerfileContract, checkDockerfileWebContract, checkDockerfileWorkerContract, checkDockerComposeWorkerTopology, checkRequiredFiles, checkStartScript, checkWebManifest, formatVerificationResult, verifyDockerBaseline, } from "./verify-docker-baseline.mjs"; const VALID_PRODUCTION_DEPS_HELPER = `#!/usr/bin/env bash set -euo pipefail deploy_web() { pnpm --offline --config.inject-workspace-packages=true \\ --filter @hivegrid/runtime-web deploy --prod /prod/web } deploy_api() { pnpm --offline --config.inject-workspace-packages=true \\ --filter @hivegrid/runtime-api deploy --prod --no-optional /prod/api } deploy_mcp() { pnpm --offline --config.inject-workspace-packages=true \\ --filter @hivegrid/runtime-mcp deploy --prod --no-optional /prod/mcp } deploy_portal_controller() { pnpm --offline --config.inject-workspace-packages=true \\ --filter @hivegrid/runtime-portal-domain-controller deploy --prod --no-optional /prod/portal-domain-controller } deploy_worker() { pnpm --offline --config.inject-workspace-packages=true \\ --filter @hivegrid/runtime-worker deploy --prod /prod/worker } tasks=(deploy_web deploy_api deploy_mcp deploy_portal_controller deploy_worker) targets=(web api mcp portal-domain-controller worker) mkdir -p /prod run_wave() { local phase="$1" local status=0 local child_status local index local task local -a pids=() for task in "\${tasks[@]}"; do "$task" & pids+=("$!") done for index in "\${!pids[@]}"; do if wait "\${pids[$index]}"; then continue else child_status=$? fi if [[ "$status" -eq 0 ]]; then status="$child_status" fi done return "$status" } initial_status=0 run_wave offline-first || initial_status=$? if [[ "$initial_status" -eq 0 ]]; then exit 0 fi for target in "\${targets[@]}"; do rm -rf -- "/prod/\${target}" done if pnpm fetch --frozen-lockfile; then echo "fetch complete" else fetch_status=$? exit "$fetch_status" fi retry_status=0 run_wave after-fetch || retry_status=$? if [[ "$retry_status" -ne 0 ]]; then exit "$retry_status" fi `; const VALID_DB_RUNTIME_BUILD_SCRIPT = ` import { build } from "esbuild"; const sharedBuildOptions = { bundle: true, format: "esm", platform: "node" }; const artifactBuilds = [ { entryPoints: ["packages/db/src/permissions-seed.server.ts"], outfile: "packages/db/dist/permissions-seed.server.js", packages: "external", }, { alias: { "@hivegrid/logger": "./packages/logger/src/index.ts" }, entryPoints: ["packages/db/src/deploy-permission-catalog-sync.server.ts"], outfile: "packages/db/dist/deploy-permission-catalog-sync.server.js", packages: "external", }, { alias: { "~": "./apps/web/app" }, banner: { js: "const require = createRequire(import.meta.url);" }, entryPoints: ["prisma/seed.ts"], outfile: "packages/db/dist/production-seed.server.js", }, { alias: { "~": "./apps/web/app" }, entryPoints: ["scripts/seed-e2e-readiness.ts"], outfile: "packages/db/dist/e2e-readiness-seed.server.js", }, ]; await Promise.all(artifactBuilds.map((artifact) => build({ ...sharedBuildOptions, ...artifact }))); `; const VALID_DOCKERFILE = `# syntax=docker/dockerfile:1.19 FROM node:24-bookworm-slim AS base FROM base AS deps WORKDIR /myapp ADD package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ADD prisma prisma COPY apps/api/package.json apps/api/package.json COPY apps/hocuspocus/package.json apps/hocuspocus/package.json COPY apps/mcp/package.json apps/mcp/package.json COPY apps/portal-domain-controller/package.json apps/portal-domain-controller/package.json COPY apps/web/package.json apps/web/package.json COPY apps/worker/package.json apps/worker/package.json COPY packages/db/package.json packages/db/package.json COPY runtime/api/package.json runtime/api/package.json COPY runtime/hocuspocus/package.json runtime/hocuspocus/package.json COPY runtime/mcp/package.json runtime/mcp/package.json COPY runtime/portal-domain-controller/package.json runtime/portal-domain-controller/package.json COPY runtime/web/package.json runtime/web/package.json COPY runtime/worker/package.json runtime/worker/package.json RUN --mount=type=cache,id=hivegrid-pnpm-store,target=/pnpm/store \\ pnpm fetch --frozen-lockfile RUN --mount=type=cache,id=hivegrid-pnpm-store,target=/pnpm/store \\ pnpm install --frozen-lockfile --prod=false --offline FROM base AS build RUN ./node_modules/.bin/prisma generate --config prisma.config.ts RUN node packages/db/scripts/build-runtime-artifacts.mjs FROM build AS production-deps-bundle RUN --mount=type=cache,id=hivegrid-pnpm-store-v2,target=/pnpm/store,sharing=locked \ bash scripts/ci/deploy-production-closures.sh FROM production-deps-bundle AS web-production-deps RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/web/node_modules /myapp/packages/db/generated/prisma/client/internal/class.ts RUN SBOM_TARGET=web SBOM_ROOT_PATH=/prod/web SBOM_NODE_MODULES_PATH=/prod/web/node_modules SBOM_OUTPUT_PATH=/prod/web/sbom-pnpm.json node /myapp/scripts/generate-sbom.mjs FROM production-deps-bundle AS api-production-deps RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/api/node_modules /myapp/packages/db/generated/prisma/client/internal/class.ts RUN SBOM_TARGET=api SBOM_ROOT_PATH=/prod/api SBOM_NODE_MODULES_PATH=/prod/api/node_modules SBOM_OUTPUT_PATH=/prod/api/sbom-pnpm.json node /myapp/scripts/generate-sbom.mjs FROM production-deps-bundle AS mcp-production-deps RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/mcp/node_modules /myapp/packages/db/generated/prisma/client/internal/class.ts RUN SBOM_TARGET=mcp SBOM_ROOT_PATH=/prod/mcp SBOM_NODE_MODULES_PATH=/prod/mcp/node_modules SBOM_OUTPUT_PATH=/prod/mcp/sbom-pnpm.json node /myapp/scripts/generate-sbom.mjs FROM production-deps-bundle AS portal-domain-controller-production-deps RUN SBOM_TARGET=portal-domain-controller SBOM_ROOT_PATH=/prod/portal-domain-controller SBOM_NODE_MODULES_PATH=/prod/portal-domain-controller/node_modules SBOM_OUTPUT_PATH=/prod/portal-domain-controller/sbom-pnpm.json node /myapp/scripts/generate-sbom.mjs FROM production-deps-bundle AS worker-production-deps RUN node /myapp/scripts/prune-pnpm-runtime-closure.mjs /prod/worker/node_modules prisma typescript RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/worker/node_modules /myapp/packages/db/generated/prisma/client/internal/class.ts RUN SBOM_TARGET=worker SBOM_ROOT_PATH=/prod/worker SBOM_NODE_MODULES_PATH=/prod/worker/node_modules SBOM_OUTPUT_PATH=/prod/worker/sbom-pnpm.json node /myapp/scripts/generate-sbom.mjs FROM build AS web-build ARG VITE_SENTRY_DSN_WEB="" ENV VITE_SENTRY_DSN_WEB="\${VITE_SENTRY_DSN_WEB}" ARG VITE_HOCUSPOCUS_URL="" ENV VITE_HOCUSPOCUS_URL="\${VITE_HOCUSPOCUS_URL}" RUN node scripts/build-web-surfaces.mjs && node scripts/build-web-server.mjs FROM build AS api-build RUN node apps/api/scripts/build.mjs FROM build AS mcp-build RUN node apps/mcp/scripts/build.mjs FROM build AS portal-domain-controller-build RUN cd apps/portal-domain-controller && node scripts/build.mjs FROM build AS worker-build RUN cd apps/worker && node scripts/build.mjs FROM web-build AS web-runtime-artifacts RUN find /myapp/build /myapp/apps/web/build /myapp/apps/web/build-portal -type f -name '*.map' -delete FROM api-build AS api-runtime-artifacts RUN find /myapp/apps/api/dist -type f -name '*.map' -delete FROM mcp-build AS mcp-runtime-artifacts RUN find /myapp/apps/mcp/dist -type f -name '*.map' -delete FROM worker-build AS worker-runtime-artifacts RUN find /myapp/apps/worker/dist -type f -name '*.map' -delete FROM base AS worker ARG APP_REVISION=unknown ENV APP_REVISION="\${APP_REVISION}" LABEL org.opencontainers.image.revision="\${APP_REVISION}" COPY --exclude=**/*.map --exclude=**/*.d.ts --from=worker-production-deps /prod/worker/node_modules /myapp/node_modules COPY --from=worker-production-deps /prod/worker/sbom-pnpm.json /myapp/sbom-pnpm.json COPY --from=worker-runtime-artifacts /myapp/apps/worker/dist /myapp/apps/worker/dist RUN printf '%s\\n' "$APP_REVISION" > /myapp/.image-revision RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD node apps/worker/dist/health.js CMD [ "node", "apps/worker/dist/index.js" ] FROM base AS portal-domain-controller COPY --exclude=**/*.map --exclude=**/*.d.ts --from=portal-domain-controller-production-deps /prod/portal-domain-controller/node_modules /myapp/node_modules COPY --from=portal-domain-controller-production-deps /prod/portal-domain-controller/sbom-pnpm.json /myapp/sbom-pnpm.json RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn CMD [ "node", "apps/portal-domain-controller/dist/index.js" ] FROM base AS api ARG APP_REVISION=unknown ENV APP_REVISION="\${APP_REVISION}" LABEL org.opencontainers.image.revision="\${APP_REVISION}" EXPOSE 8080 COPY --exclude=**/*.map --exclude=**/*.d.ts --from=api-production-deps /prod/api/node_modules /myapp/node_modules COPY --from=api-production-deps /prod/api/sbom-pnpm.json /myapp/sbom-pnpm.json COPY --from=api-runtime-artifacts /myapp/apps/api/dist /myapp/apps/api/dist RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD curl -fsS "http://127.0.0.1:\${API_PORT:-\${PORT}}/healthz" CMD [ "node", "apps/api/dist/server.js" ] FROM base AS mcp ARG APP_REVISION=unknown ENV APP_REVISION="\${APP_REVISION}" LABEL org.opencontainers.image.revision="\${APP_REVISION}" EXPOSE 8080 COPY --exclude=**/*.map --exclude=**/*.d.ts --from=mcp-production-deps /prod/mcp/node_modules /myapp/node_modules COPY --from=mcp-production-deps /prod/mcp/sbom-pnpm.json /myapp/sbom-pnpm.json COPY --from=mcp-runtime-artifacts /myapp/apps/mcp/dist /myapp/apps/mcp/dist RUN printf '%s\\n' "$APP_REVISION" > /myapp/.image-revision RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn USER node HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD node -e "fetch('http://127.0.0.1:\${MCP_PORT:-\${PORT}}/healthz').then((response) => { if (!response.ok) process.exit(1); })" CMD [ "node", "apps/mcp/dist/server.js" ] FROM base AS web ARG APP_REVISION=unknown ENV APP_REVISION="\${APP_REVISION}" LABEL org.opencontainers.image.revision="\${APP_REVISION}" EXPOSE 8080 COPY --exclude=**/*.map --exclude=**/*.d.ts --from=web-production-deps /prod/web/node_modules /myapp/node_modules COPY --from=web-production-deps /prod/web/sbom-pnpm.json /myapp/sbom-pnpm.json COPY --from=web-runtime-artifacts /myapp/build /myapp/build COPY --from=web-runtime-artifacts /myapp/build/server-runtime /myapp/build/server-runtime COPY --from=web-runtime-artifacts /myapp/apps/web/build /myapp/apps/web/build COPY --from=web-runtime-artifacts /myapp/apps/web/build-portal /myapp/apps/web/build-portal COPY --from=build /myapp/scripts/verify-migrator-role.mjs /myapp/scripts/verify-migrator-role.mjs COPY --from=build /myapp/scripts/adopt-prisma-baseline.mjs /myapp/scripts/adopt-prisma-baseline.mjs COPY --from=build /myapp/prisma.config.ts /myapp/prisma.config.ts COPY --from=build /myapp/packages/db/dist /myapp/packages/db/dist COPY --from=build /myapp/prisma /myapp/prisma RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --start-interval=2s --retries=3 CMD node -e "const http=require('node:http');http.get({hostname:'127.0.0.1',port:process.env.PORT,path:'/healthz',headers:{host:process.env.WEB_APP_HOST}},()=>{})" ENTRYPOINT [ "./start.sh" ] `; const VALID_DOCKER_COMPOSE = `services: redis: image: redis:7-alpine ports: - "127.0.0.1:6379:6379" clamav: image: clamav/clamav:stable ports: - "127.0.0.1:3310:3310" worker-general: &worker-base environment: - WORKER_QUEUE_GROUP=general - WORKER_CONCURRENCY_GENERAL=\${WORKER_CONCURRENCY_GENERAL:-10} - WORKER_HEALTH_PORT=9101 - WORKER_ADMIN_PORT=9201 - APP_URL=\${APP_URL:-} - OUTBOX_DISPATCHER_ENABLED=\${OUTBOX_DISPATCHER_ENABLED:-false} - OUTBOX_DISPATCHER_REQUIRED=\${OUTBOX_DISPATCHER_REQUIRED:-false} - LAGO_API_URL=\${LAGO_API_URL:-} - LAGO_API_KEY=\${LAGO_API_KEY:-} - LAGO_TIMEOUT_MS=\${LAGO_TIMEOUT_MS:-10000} - MOLLIE_API_KEY=\${MOLLIE_API_KEY:-} - MOLLIE_PROFILE_ID=\${MOLLIE_PROFILE_ID:-} - MOLLIE_TIMEOUT_MS=\${MOLLIE_TIMEOUT_MS:-10000} - BILLING_MOLLIE_WEBHOOK_URL=\${BILLING_MOLLIE_WEBHOOK_URL:-} - WORKFLOW_TRIGGER_EXECUTOR_MODE=\${WORKFLOW_TRIGGER_EXECUTOR_MODE:-http} - WORKFLOW_TRIGGER_EXECUTOR_URL=\${WORKFLOW_TRIGGER_EXECUTOR_URL:-} - API_ACCESS_TOKEN=\${API_ACCESS_TOKEN:-} - WORKFLOW_TRIGGER_EXECUTOR_TIMEOUT_MS=\${WORKFLOW_TRIGGER_EXECUTOR_TIMEOUT_MS:-30000} - WORKFLOW_TRIGGER_OUTBOX_ENABLED=\${WORKFLOW_TRIGGER_OUTBOX_ENABLED:-true} - WORKFLOW_TRIGGER_OUTBOX_CONCURRENCY=\${WORKFLOW_TRIGGER_OUTBOX_CONCURRENCY:-5} - WORKFLOW_TRIGGER_OUTBOX_REQUIRED=\${WORKFLOW_TRIGGER_OUTBOX_REQUIRED:-false} - SCAN_QUEUE_ENABLED=\${SCAN_QUEUE_ENABLED:-true} - CLAMAV_HOST=\${CLAMAV_HOST:-clamav} - CLAMAV_PORT=\${CLAMAV_PORT:-3310} - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:-} - STORAGE_REGION=\${STORAGE_REGION:-} - STORAGE_BUCKET=\${STORAGE_BUCKET:-} - STORAGE_ACCESS_KEY_ID=\${STORAGE_ACCESS_KEY_ID:-} - STORAGE_SECRET_ACCESS_KEY=\${STORAGE_SECRET_ACCESS_KEY:-} - STORAGE_SESSION_TOKEN=\${STORAGE_SESSION_TOKEN:-} - STORAGE_FORCE_PATH_STYLE=\${STORAGE_FORCE_PATH_STYLE:-false} - STORAGE_QUARANTINE_BUCKET=\${STORAGE_QUARANTINE_BUCKET:-} - MEILI_URL=\${MEILI_URL:-} - MEILI_API_KEY=\${MEILI_API_KEY:-} - EXPORT_RETENTION_QUEUE_ENABLED=\${EXPORT_RETENTION_QUEUE_ENABLED:-false} depends_on: redis: condition: service_healthy clamav: condition: service_healthy healthcheck: test: ["CMD", "node", "apps/worker/dist/health.js"] worker-mail: <<: *worker-base environment: - WORKER_QUEUE_GROUP=mail - WORKER_CONCURRENCY_MAIL=\${WORKER_CONCURRENCY_MAIL:-5} - WORKER_HEALTH_PORT=9102 - WORKER_ADMIN_PORT=9202 depends_on: redis: condition: service_healthy healthcheck: test: ["CMD", "node", "apps/worker/dist/health.js"] worker-import: <<: *worker-base environment: - WORKER_QUEUE_GROUP=import - WORKER_CONCURRENCY_IMPORT=\${WORKER_CONCURRENCY_IMPORT:-1} - WORKER_HEALTH_PORT=9103 - WORKER_ADMIN_PORT=9203 - IMPORT_QUEUE_ENABLED=\${IMPORT_QUEUE_ENABLED:-false} - IMPORT_QUEUE_RUNTIME_READY=\${IMPORT_QUEUE_RUNTIME_READY:-false} - PORTAL_GDPR_EXPORT_QUEUE_ENABLED=\${PORTAL_GDPR_EXPORT_QUEUE_ENABLED:-false} - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:-} - STORAGE_REGION=\${STORAGE_REGION:-} - STORAGE_BUCKET=\${STORAGE_BUCKET:-} - STORAGE_ACCESS_KEY_ID=\${STORAGE_ACCESS_KEY_ID:-} - STORAGE_SECRET_ACCESS_KEY=\${STORAGE_SECRET_ACCESS_KEY:-} - STORAGE_SESSION_TOKEN=\${STORAGE_SESSION_TOKEN:-} - STORAGE_FORCE_PATH_STYLE=\${STORAGE_FORCE_PATH_STYLE:-false} - GDPR_EXPORT_SSE_C_KEY_BASE64=\${GDPR_EXPORT_SSE_C_KEY_BASE64:-} depends_on: redis: condition: service_healthy healthcheck: test: ["CMD", "node", "apps/worker/dist/health.js"] worker-webhook: <<: *worker-base environment: - WORKER_QUEUE_GROUP=webhook - WORKER_CONCURRENCY_WEBHOOK=\${WORKER_CONCURRENCY_WEBHOOK:-20} - WORKER_HEALTH_PORT=9104 - WORKER_ADMIN_PORT=9204 - WEB_PUSH_VAPID_SUBJECT=\${WEB_PUSH_VAPID_SUBJECT:-} - WEB_PUSH_VAPID_PUBLIC_KEY=\${WEB_PUSH_VAPID_PUBLIC_KEY:-} - WEB_PUSH_VAPID_PRIVATE_KEY=\${WEB_PUSH_VAPID_PRIVATE_KEY:-} depends_on: redis: condition: service_healthy healthcheck: test: ["CMD", "node", "apps/worker/dist/health.js"] worker-plugin: <<: *worker-base environment: - WORKER_QUEUE_GROUP=plugin - WORKER_CONCURRENCY_PLUGIN=\${WORKER_CONCURRENCY_PLUGIN:-5} - WORKER_HEALTH_PORT=9105 - WORKER_ADMIN_PORT=9205 depends_on: redis: condition: service_healthy healthcheck: test: ["CMD", "node", "apps/worker/dist/health.js"] volumes: redis-data: clamav-db: `; const VALID_HOCUSPOCUS_DOCKERFILE = `# syntax=docker/dockerfile:1.19 FROM node:24-bookworm-slim AS base FROM base AS deps WORKDIR /myapp ADD package.json pnpm-lock.yaml pnpm-workspace.yaml ./ COPY apps/api/package.json apps/api/package.json COPY apps/hocuspocus/package.json apps/hocuspocus/package.json COPY apps/portal-domain-controller/package.json apps/portal-domain-controller/package.json COPY apps/web/package.json apps/web/package.json COPY apps/worker/package.json apps/worker/package.json COPY packages/db/package.json packages/db/package.json COPY runtime/api/package.json runtime/api/package.json COPY runtime/hocuspocus/package.json runtime/hocuspocus/package.json COPY runtime/mcp/package.json runtime/mcp/package.json COPY runtime/portal-domain-controller/package.json runtime/portal-domain-controller/package.json COPY runtime/web/package.json runtime/web/package.json COPY runtime/worker/package.json runtime/worker/package.json COPY patches ./patches RUN --mount=type=cache,id=hivegrid-hocuspocus-pnpm-store,target=/pnpm/store \ pnpm fetch --frozen-lockfile RUN --mount=type=cache,id=hivegrid-hocuspocus-pnpm-store,target=/pnpm/store \ pnpm install --frozen-lockfile --prod=false --offline FROM base AS build RUN ./node_modules/.bin/prisma generate --config prisma.config.ts RUN node apps/hocuspocus/scripts/build.mjs FROM build AS hocuspocus-runtime-artifacts RUN find /myapp/apps/hocuspocus/dist -type f -name '*.map' -delete FROM deps AS hocuspocus-production-deps RUN --mount=type=cache,id=hivegrid-hocuspocus-pnpm-store,target=/pnpm/store \\ pnpm fetch --frozen-lockfile \\ && pnpm --offline --config.inject-workspace-packages=true --filter @hivegrid/runtime-hocuspocus deploy --prod --no-optional /prod/hocuspocus COPY --from=build /myapp/packages/db/generated/prisma/client/internal/class.ts /myapp/packages/db/generated/prisma/client/internal/class.ts COPY scripts/prune-prisma-client-runtime.mjs /myapp/scripts/prune-prisma-client-runtime.mjs RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/hocuspocus/node_modules /myapp/packages/db/generated/prisma/client/internal/class.ts COPY scripts/generate-sbom.mjs /myapp/scripts/generate-sbom.mjs RUN SBOM_TARGET=hocuspocus SBOM_NODE_MODULES_PATH=/prod/hocuspocus/node_modules SBOM_OUTPUT_PATH=/prod/hocuspocus/sbom-pnpm.json node /myapp/scripts/generate-sbom.mjs FROM base AS hocuspocus COPY --exclude=**/*.map --exclude=**/*.d.ts --from=hocuspocus-production-deps /prod/hocuspocus/node_modules /myapp/node_modules COPY --from=hocuspocus-production-deps /prod/hocuspocus/sbom-pnpm.json /myapp/sbom-pnpm.json COPY --from=hocuspocus-runtime-artifacts /myapp/apps/hocuspocus/dist /myapp/apps/hocuspocus/dist RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn USER node HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --start-interval=2s --retries=3 CMD node -e "require('net').connect(1234, '127.0.0.1')" CMD ["node", "apps/hocuspocus/dist/index.js"] `; const VALID_DOCKER_COMPOSE_STAGING = `# docker compose -f docker-compose.yml -f docker-compose.staging.yml up postgres pgbouncer api web worker-general worker-mail worker-import worker-webhook worker-plugin services: migrator: entrypoint: ["./start.sh", "migrate"] environment: - DIRECT_URL=\${MIGRATOR_DIRECT_URL:?required} api: environment: - DATABASE_URL=\${APP_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_app - RLS_RUNTIME_MODE=required web: environment: - DATABASE_URL=\${APP_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_app - RLS_RUNTIME_MODE=required - AUTHENTIK_ADMIN_JIT_DATABASE_URL=\${AUTHENTIK_ADMIN_JIT_DATABASE_URL:-} - REDIS_URL=\${REDIS_URL:?required} - AIRCALL_CLIENT_ID=\${AIRCALL_CLIENT_ID:-} - AIRCALL_CLIENT_SECRET=\${AIRCALL_CLIENT_SECRET:-} - AIRCALL_REDIRECT_URI=\${AIRCALL_REDIRECT_URI:-} - AIRCALL_WEBHOOK_URL=\${AIRCALL_WEBHOOK_URL:-} - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:?required} - STORAGE_REGION=\${STORAGE_REGION:?required} - STORAGE_BUCKET=\${STORAGE_BUCKET:?required} - STORAGE_ACCESS_KEY_ID=\${WEB_STORAGE_ACCESS_KEY_ID:?required} - STORAGE_SECRET_ACCESS_KEY=\${WEB_STORAGE_SECRET_ACCESS_KEY:?required} - STORAGE_SESSION_TOKEN=\${WEB_STORAGE_SESSION_TOKEN:-} - STORAGE_FORCE_PATH_STYLE=\${STORAGE_FORCE_PATH_STYLE:-false} - GDPR_EXPORT_SSE_C_KEY_BASE64=\${GDPR_EXPORT_SSE_C_KEY_BASE64:?required} - WEB_PUSH_VAPID_PUBLIC_KEY=\${WEB_PUSH_VAPID_PUBLIC_KEY:?required} hocuspocus: environment: - DATABASE_URL=\${APP_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_app - RLS_RUNTIME_MODE=required worker-general: environment: - DATABASE_URL=\${WORKER_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_worker - RLS_RUNTIME_MODE=required - SCAN_QUEUE_ENABLED=true - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:?required} - STORAGE_REGION=\${STORAGE_REGION:?required} - STORAGE_BUCKET=\${STORAGE_BUCKET:?required} - STORAGE_ACCESS_KEY_ID=\${WORKER_GENERAL_STORAGE_ACCESS_KEY_ID:?required} - STORAGE_SECRET_ACCESS_KEY=\${WORKER_GENERAL_STORAGE_SECRET_ACCESS_KEY:?required} - STORAGE_SESSION_TOKEN=\${WORKER_GENERAL_STORAGE_SESSION_TOKEN:-} - STORAGE_FORCE_PATH_STYLE=\${STORAGE_FORCE_PATH_STYLE:-false} - MEILI_URL=\${MEILI_URL:?required} - MEILI_API_KEY=\${MEILI_API_KEY:?required} - EXPORT_RETENTION_QUEUE_ENABLED=true - OUTBOX_DISPATCHER_ENABLED=true - OUTBOX_DISPATCHER_REQUIRED=true - LAGO_API_URL=\${LAGO_API_URL:?required} - LAGO_API_KEY=\${LAGO_API_KEY:?required} - LAGO_TIMEOUT_MS=\${LAGO_TIMEOUT_MS:-10000} - MOLLIE_API_KEY=\${MOLLIE_API_KEY:?required} - MOLLIE_PROFILE_ID=\${MOLLIE_PROFILE_ID:-} - MOLLIE_TIMEOUT_MS=\${MOLLIE_TIMEOUT_MS:-10000} - BILLING_MOLLIE_WEBHOOK_URL=\${BILLING_MOLLIE_WEBHOOK_URL:?required} - WORKFLOW_TRIGGER_OUTBOX_ENABLED=true - WORKFLOW_TRIGGER_OUTBOX_REQUIRED=true depends_on: pgbouncer: condition: service_healthy worker-mail: environment: - DATABASE_URL=\${WORKER_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_worker - RLS_RUNTIME_MODE=required depends_on: pgbouncer: condition: service_healthy worker-import: environment: - DATABASE_URL=\${WORKER_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_worker - RLS_RUNTIME_MODE=required - IMPORT_QUEUE_ENABLED=false - IMPORT_QUEUE_RUNTIME_READY=false - PORTAL_GDPR_EXPORT_QUEUE_ENABLED=true - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:?required} - STORAGE_REGION=\${STORAGE_REGION:?required} - STORAGE_BUCKET=\${STORAGE_BUCKET:?required} - STORAGE_ACCESS_KEY_ID=\${WORKER_IMPORT_STORAGE_ACCESS_KEY_ID:?required} - STORAGE_SECRET_ACCESS_KEY=\${WORKER_IMPORT_STORAGE_SECRET_ACCESS_KEY:?required} - STORAGE_SESSION_TOKEN=\${WORKER_IMPORT_STORAGE_SESSION_TOKEN:-} - STORAGE_FORCE_PATH_STYLE=\${STORAGE_FORCE_PATH_STYLE:-false} - GDPR_EXPORT_SSE_C_KEY_BASE64=\${GDPR_EXPORT_SSE_C_KEY_BASE64:?required} depends_on: pgbouncer: condition: service_healthy worker-webhook: environment: - DATABASE_URL=\${WORKER_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_worker - RLS_RUNTIME_MODE=required - WEB_PUSH_VAPID_SUBJECT=\${WEB_PUSH_VAPID_SUBJECT:?required} - WEB_PUSH_VAPID_PUBLIC_KEY=\${WEB_PUSH_VAPID_PUBLIC_KEY:?required} - WEB_PUSH_VAPID_PRIVATE_KEY=\${WEB_PUSH_VAPID_PRIVATE_KEY:?required} depends_on: pgbouncer: condition: service_healthy worker-plugin: environment: - DATABASE_URL=\${WORKER_DATABASE_URL:?required} - DATABASE_RUNTIME_ROLE=hivegrid_worker - RLS_RUNTIME_MODE=required depends_on: pgbouncer: condition: service_healthy volumes: postgres-data: `; const fixtures = []; function writeFile(rootDir, relativePath, content) { const absolutePath = path.join(rootDir, relativePath); fs.mkdirSync(path.dirname(absolutePath), { recursive: true }); fs.writeFileSync(absolutePath, content); } function writeJson(rootDir, relativePath, value) { writeFile(rootDir, relativePath, `${JSON.stringify(value, null, 2)}\n`); } function createFixture(overrides = {}) { const rootDir = fs.mkdtempSync(path.join(os.tmpdir(), "docker-baseline-")); fixtures.push(rootDir); writeFile(rootDir, "Dockerfile", overrides.dockerfile ?? VALID_DOCKERFILE); writeFile(rootDir, "scripts/ci/deploy-production-closures.sh", overrides.productionDepsHelper ?? VALID_PRODUCTION_DEPS_HELPER); writeFile(rootDir, "packages/db/scripts/build-runtime-artifacts.mjs", overrides.dbRuntimeBuildScript ?? VALID_DB_RUNTIME_BUILD_SCRIPT); writeFile(rootDir, "apps/hocuspocus/Dockerfile", overrides.hocuspocusDockerfile ?? VALID_HOCUSPOCUS_DOCKERFILE); writeFile(rootDir, "docker-compose.yml", overrides.dockerCompose ?? VALID_DOCKER_COMPOSE); writeFile(rootDir, "docker-compose.staging.yml", overrides.dockerComposeStaging ?? VALID_DOCKER_COMPOSE_STAGING); writeFile( rootDir, ".dockerignore", overrides.dockerignore ?? [ "node_modules", "/docs", "/secrets", "/.gitea", "/.github", "/tests", "/e2e", "**/*.test.ts", "**/*.test.tsx", "**/*.test.mjs", "**/*.test.js", "**/*.spec.ts", "/scripts/ci/deploy-buildkitd.toml", "/scripts/ci/verify-deploy-buildkit-config.mjs", "/scripts/verify-gitea-ci-workflow.mjs", "/scripts/verify-gitea-deploy-workflow.mjs", ".cache", "**/.cache", ".eslintcache", "**/.eslintcache", "coverage", "**/coverage", ".nyc_output", "**/.nyc_output", "reports", "**/reports", "public/build", "/build", "/apps/*/build", "apps/*/dist", "packages/*/dist", "playwright-report", "**/playwright-report", "test-results", "**/test-results", "blob-report", "**/blob-report", "", ].join("\n") ); writeFile( rootDir, "start.sh", overrides.startScript ?? [ "#!/bin/sh", "set -eu", "", 'if [ "${1:-}" = "migrate" ]; then', ' [ -n "${DIRECT_URL:-}" ] || echo "DIRECT_URL is required for the one-shot migrator"', ' [ -z "${DATABASE_URL+x}" ] || echo "DATABASE_URL must not be forwarded to the one-shot migrator"', ' echo "AUTHENTIK_ADMIN_JIT_DATABASE_URL belongs only to the web runtime"', ' echo "MIGRATOR_* aliases must not be forwarded to the one-shot migrator"', ' echo "seed credentials and flags must not be forwarded to the one-shot migrator"', " node /myapp/scripts/verify-migrator-role.mjs", " node /myapp/scripts/adopt-prisma-baseline.mjs --adopt", ' export DATABASE_URL="$DIRECT_URL"', " node /myapp/node_modules/prisma/build/index.js migrate deploy --config prisma.config.ts", " node /myapp/scripts/adopt-prisma-baseline.mjs --verify-current-schema", " node /myapp/packages/db/dist/deploy-permission-catalog-sync.server.js", " exit 0", "fi", "", '[ "${RLS_RUNTIME_MODE:-}" = "required" ] || echo "RLS_RUNTIME_MODE=required is mandatory for the web runtime"', '[ "${DATABASE_RUNTIME_ROLE:-}" = "hivegrid_app" ] || echo "DATABASE_RUNTIME_ROLE=hivegrid_app is mandatory for the web runtime"', '[ -z "${DIRECT_URL+x}" ] || echo "DIRECT_URL must not be forwarded to the web runtime"', 'echo "MIGRATOR_* credentials must not be forwarded to the web runtime"', 'echo "AUTHENTIK_ADMIN_JIT_DATABASE_URL must use the dedicated hivegrid_authentik_jit login"', 'echo "AUTHENTIK_ OAUTH BILLING COOLIFY SSH TRAEFIK CLOUDFLARE DOMAIN_CONTROLLER"', 'echo "forbidden core session, OAuth, billing, ingress, or domain-controller credential in the portal web runtime"', '[ -z "${MIGRATE_ON_BOOT+x}" ] || echo "MIGRATE_ON_BOOT is forbidden"', '[ -z "${SEED_ON_BOOT+x}" ] || echo "SEED_ON_BOOT is forbidden"', 'echo "WEB_RUNTIME_SURFACE must be explicitly set to core, admin, or portal"', 'echo "HIVEGRID_RUNTIME_SURFACE must match WEB_RUNTIME_SURFACE"', 'export HIVEGRID_RUNTIME_SURFACE="$WEB_RUNTIME_SURFACE"', "exec node build/server-runtime/server.js", "", ].join("\n") ); writeFile(rootDir, "pnpm-workspace.yaml", overrides.workspace ?? "packages:\n - apps/*\n"); writeJson( rootDir, "package.json", overrides.rootPackage ?? { private: true, scripts: { build: "vite build && node scripts/build-web-server.mjs", lint: "eslint .", test: "pnpm --filter @hivegrid/web test", typecheck: "tsc -b", start: "pnpm --filter @hivegrid/web start", }, } ); writeJson( rootDir, "packages/db/package.json", overrides.dbPackage ?? { name: "@hivegrid/db", scripts: { build: "esbuild packages/db/src/deploy-permission-catalog-sync.server.ts --bundle --platform=node --format=esm --packages=external --alias:@hivegrid/logger=./packages/logger/src/index.ts --outfile=packages/db/dist/deploy-permission-catalog-sync.server.js", }, } ); writeJson( rootDir, "apps/web/package.json", overrides.webPackage ?? { name: "@hivegrid/web", scripts: { start: "node ../../build/server-runtime/server.js", }, } ); writeJson( rootDir, "apps/api/package.json", overrides.apiPackage ?? { name: "@hivegrid/api", scripts: { build: "tsc -p tsconfig.json", start: "node dist/server.js", }, } ); writeJson( rootDir, "apps/hocuspocus/package.json", overrides.hocuspocusPackage ?? { name: "@hivegrid/hocuspocus", scripts: { build: "node scripts/build.mjs", start: "node dist/index.js", }, } ); writeJson(rootDir, "apps/portal-domain-controller/package.json", { name: "@hivegrid/portal-domain-controller", scripts: { build: "tsc -p tsconfig.json", start: "node dist/index.js", }, }); writeJson( rootDir, "apps/worker/package.json", overrides.workerPackage ?? { name: "@hivegrid/worker", scripts: { start: "node dist/index.js", health: "node dist/health.js", }, } ); for (const target of ["api", "hocuspocus", "mcp", "portal-domain-controller", "web", "worker"]) { writeJson(rootDir, `runtime/${target}/package.json`, { name: `@hivegrid/runtime-${target}`, private: true, dependencies: {}, }); } if (overrides.remove) { for (const relativePath of overrides.remove) { fs.rmSync(path.join(rootDir, relativePath), { recursive: true, force: true }); } } return rootDir; } afterEach(() => { while (fixtures.length > 0) { fs.rmSync(fixtures.pop(), { recursive: true, force: true }); } }); describe("verify-docker-baseline", () => { it("passes for a repository with required Docker files and runtime scripts", () => { const rootDir = createFixture(); const result = verifyDockerBaseline(rootDir); assert.deepEqual(result.failures, []); assert.ok(result.passes.some((pass) => pass === "Dockerfile: exists")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: deps stage copies all workspace package manifests before install")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: deps target fetches lockfile dependencies before offline install")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: deps target uses frozen offline dev dependency install")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: deps target uses BuildKit pnpm store cache")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: production-deps-bundle delegates one locked warm v2 store directly to the closure helper")); assert.ok( result.passes.some( (pass) => pass === "scripts/ci/deploy-production-closures.sh: each wave starts all five closures in parallel, reaps every PID, and returns the first failure" ) ); assert.ok( result.passes.some( (pass) => pass === "scripts/ci/deploy-production-closures.sh: retries one complete wave only after exact-target cleanup and one frozen fetch, with no sentinel or fail-open bypass" ) ); assert.ok( result.passes.some( (pass) => pass === "scripts/ci/deploy-production-closures.sh: deploy_web deploys exactly the isolated @hivegrid/runtime-web production closure" ) ); assert.ok( result.passes.some( (pass) => pass === "Dockerfile: web-production-deps derives from production-deps-bundle and performs only required reachability pruning and SBOM generation" ) ); assert.ok( result.passes.some( (pass) => pass === "Dockerfile: portal-domain-controller-production-deps derives from production-deps-bundle and performs only required reachability pruning and SBOM generation" ) ); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target copies only its deployed dependency closure without maps or declarations")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web-production-deps keeps only the generated PostgreSQL Prisma runtime")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: api target copies only its deployed dependency closure without maps or declarations")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: api target removes inherited package-manager executables")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: excludes generic whole-workspace production node_modules from runtime images")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: defines named web target from base")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: copies build/server-runtime into web image")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: build target leaves web, api, and worker app builds to split stages")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: build target keeps VITE build args out of api/worker cache paths")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web-build target invokes both direct web build entry points")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web-build target forwards VITE_HOCUSPOCUS_URL into the Vite and CSP builds")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: api-build target invokes its direct build entry point")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: worker-build target invokes its direct cwd-aware build entry point")); assert.ok( result.passes.some((pass) => pass === "Dockerfile: target-specific runtime artifacts remove web, api, and worker sourcemaps before runtime COPY") ); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target exposes port 8080")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target avoids recursive runtime chown")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target copies prisma.config.ts")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target copies target-specific node_modules")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target copies migrator role verifier")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target copies packages/db production seed artifact")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target copies prisma")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: web target excludes the separate API application")); assert.ok(result.passes.some((pass) => pass === "start.sh: execs the production start process for container signal handling")); assert.ok(result.passes.some((pass) => pass === "start.sh: fails closed on command errors and unset variables (set -eu)")); assert.ok(result.passes.some((pass) => pass === "start.sh: isolates migrate deploy behind the DIRECT_URL-only one-shot mode")); assert.ok(result.passes.some((pass) => pass === "start.sh: syncs the permission catalog inside one-shot migrate mode only after successful migrations")); assert.ok(result.passes.some((pass) => pass === "start.sh: keeps seeding outside the non-superuser migration authority")); assert.ok(result.passes.some((pass) => pass === "start.sh: rejects privileged credentials and RLS bypasses in the long-lived web runtime")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: defines named worker target from base")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: worker target copies apps/worker/dist")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: worker target copies target-specific node_modules")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: worker target runtime does not use tsx")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: worker target avoids recursive runtime chown")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: defines named api target from base")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: api target copies target-specific node_modules")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: api target exposes port 8080")); assert.ok(result.passes.some((pass) => pass === "Dockerfile: api target avoids recursive runtime chown")); assert.ok(result.passes.some((pass) => pass === 'package.json: script "typecheck" is defined')); assert.ok(result.passes.some((pass) => pass === "package.json: production start script delegates to @hivegrid/web")); assert.ok(result.passes.some((pass) => pass === "apps/web/package.json: owns production web server start command")); assert.ok(result.passes.some((pass) => pass === "package.json: production start script does not use tsx")); assert.ok(result.passes.some((pass) => pass === "apps/api/package.json: production start script uses node")); assert.ok(result.passes.some((pass) => pass === 'apps/worker/package.json: script "start" targets dist/index.js')); assert.ok(result.passes.some((pass) => pass === 'apps/worker/package.json: script "health" targets dist/health.js')); assert.ok(result.passes.some((pass) => pass === "packages/db/package.json: builds the self-contained deploy permission catalog sync artifact")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general passes through OUTBOX_DISPATCHER_ENABLED")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general passes through OUTBOX_DISPATCHER_REQUIRED")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general passes through WORKFLOW_TRIGGER_OUTBOX_REQUIRED")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general uses distinct WORKER_ADMIN_PORT=9201")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-mail uses distinct WORKER_ADMIN_PORT=9202")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-plugin uses distinct WORKER_ADMIN_PORT=9205")); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general forces OUTBOX_DISPATCHER_ENABLED=true")); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general forces OUTBOX_DISPATCHER_REQUIRED=true")); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general forces WORKFLOW_TRIGGER_OUTBOX_ENABLED=true")); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general forces WORKFLOW_TRIGGER_OUTBOX_REQUIRED=true")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general passes through LAGO_API_KEY for billing reconciliation")); assert.ok( result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general configures MOLLIE_PROFILE_ID for required billing reconciliation") ); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general owns ClamAV dependency for file scanning")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general enables the fail-closed scan queue by default")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-general passes through STORAGE_BUCKET for scan and preview storage")); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general forces SCAN_QUEUE_ENABLED=true")); assert.ok( result.passes.some( (pass) => pass === "docker-compose.staging.yml: worker-general forces EXPORT_RETENTION_QUEUE_ENABLED=true for GDPR export hard-delete" ) ); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-general requires STORAGE_BUCKET for GDPR export retention")); assert.ok( result.passes.some((pass) => pass === "docker-compose.staging.yml: web requires GDPR_EXPORT_SSE_C_KEY_BASE64 for encrypted GDPR export downloads") ); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: web requires REDIS_URL for distributed GDPR export download gates")); assert.ok(result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-import forces PORTAL_GDPR_EXPORT_QUEUE_ENABLED=true")); assert.ok( result.passes.some((pass) => pass === "docker-compose.staging.yml: worker-import requires GDPR_EXPORT_SSE_C_KEY_BASE64 for encrypted GDPR exports") ); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-mail depends on redis only and does not wait for ClamAV")); assert.ok(result.passes.some((pass) => pass === "docker-compose.yml: worker-plugin depends on redis only and does not wait for ClamAV")); }); it("fails with a path-specific message when Dockerfile is missing", () => { const rootDir = createFixture({ remove: ["Dockerfile"] }); const result = checkRequiredFiles(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: missing required Docker baseline file/); }); it("fails when the deps target omits a workspace package manifest", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("COPY apps/api/package.json apps/api/package.json\n", ""), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: deps target must copy apps\/api\/package\.json before pnpm install/); }); it("fails when the compose worker topology omits the plugin worker group", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace(/\n worker-plugin:[\s\S]*?(?=\nvolumes:)/, ""), dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(/\n worker-plugin:[\s\S]*?(?=\nvolumes:)/, ""), }); const result = checkDockerComposeWorkerTopology(rootDir); assert.match(result.failures.join("\n"), /docker-compose\.yml: missing worker-plugin service for WORKER_QUEUE_GROUP=plugin/); assert.match(result.failures.join("\n"), /docker-compose\.staging\.yml: missing worker-plugin staging overlay/); }); it("fails when Hocuspocus restores dev dependencies or copies source maps into the runtime", () => { const rootDir = createFixture({ hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace( "COPY --exclude=**/*.map --exclude=**/*.d.ts --from=hocuspocus-production-deps /prod/hocuspocus/node_modules /myapp/node_modules", "COPY --from=build /myapp/node_modules /myapp/node_modules" ) .replace( "COPY --from=hocuspocus-runtime-artifacts /myapp/apps/hocuspocus/dist /myapp/apps/hocuspocus/dist", "COPY --from=build /myapp/apps/hocuspocus/dist /myapp/apps/hocuspocus/dist" ) .replace("RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn", ""), }); const result = checkHocuspocusDockerfileContract(rootDir); expect(result.failures.join("\n")).toMatch(/final dependency COPY must use both --exclude/); expect(result.failures.join("\n")).toMatch(/strip dist source maps/); expect(result.failures.join("\n")).toMatch(/remove inherited Corepack, pnpm, and Yarn executables/); }); it("fails when Hocuspocus dependency install is invalidated by application source", () => { const rootDir = createFixture({ hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace("COPY patches ./patches", "COPY patches ./patches\nADD apps apps\nADD prisma prisma"), }); const result = checkHocuspocusDockerfileContract(rootDir); expect(result.failures.join("\n")).toMatch(/deps target must not copy source inputs before install/); }); it("fails when Hocuspocus source rebuilds rerun workspace resolution or unused database seed builds", () => { const rootDir = createFixture({ hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace( "RUN ./node_modules/.bin/prisma generate --config prisma.config.ts", "RUN pnpm exec prisma generate\nRUN pnpm --filter @hivegrid/db build" ), }); const result = checkHocuspocusDockerfileContract(rootDir); expect(result.failures.join("\n")).toMatch(/invoke pinned Prisma and Hocuspocus build scripts directly/); }); it("fails when the shared build routes Prisma generation through pnpm workspace resolution", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "RUN ./node_modules/.bin/prisma generate --config prisma.config.ts", "RUN pnpm --filter @hivegrid/db prisma:generate" ), }); const result = checkDockerfileWebContract(rootDir); expect(result.failures.join("\n")).toMatch(/shared build must invoke \.\/node_modules\/\.bin\/prisma generate/); }); it("fails when the Docker DB build stops using the direct runtime artifact entry point", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("RUN node packages/db/scripts/build-runtime-artifacts.mjs", "RUN pnpm --filter @hivegrid/db build"), }); const result = checkDockerfileWebContract(rootDir); expect(result.failures.join("\n")).toMatch(/shared build must invoke node packages\/db\/scripts\/build-runtime-artifacts\.mjs directly/); }); it("fails when Dockerfile syntax cannot support COPY --exclude", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("docker/dockerfile:1.19", "docker/dockerfile:1.18"), hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace("docker/dockerfile:1.19", "docker/dockerfile:1.18"), }); const failures = verifyDockerBaseline(rootDir).failures.join("\n"); expect(failures).toMatch(/Dockerfile: must declare docker\/dockerfile syntax 1\.19 or newer/); expect(failures).toMatch(/apps\/hocuspocus\/Dockerfile: must declare docker\/dockerfile syntax 1\.19 or newer/); }); it("fails when locked closure deployment performs metadata tree walks", () => { const rootDir = createFixture({ productionDepsHelper: VALID_PRODUCTION_DEPS_HELPER.replace( "--filter @hivegrid/runtime-api deploy --prod --no-optional /prod/api", "--filter @hivegrid/runtime-api deploy --prod --no-optional /prod/api\n find /prod/api/node_modules -name '*.map' -delete" ), hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace( "&& pnpm --offline --config.inject-workspace-packages=true --filter @hivegrid/runtime-hocuspocus deploy --prod --no-optional /prod/hocuspocus", "&& pnpm --offline --config.inject-workspace-packages=true --filter @hivegrid/runtime-hocuspocus deploy --prod --no-optional /prod/hocuspocus \\\n && find /prod/hocuspocus/node_modules -name '*.d.ts' -delete" ), }); expect(checkDockerfileDepsManifestContract(rootDir).failures.join("\n")).toMatch(/must not run metadata find\/delete work while the locked/); expect(checkHocuspocusDockerfileContract(rootDir).failures.join("\n")).toMatch(/without metadata find\/delete work in the locked RUN/); }); it("fails for each missing DB runtime artifact build contract", () => { const artifacts = [ ["packages/db/src/permissions-seed.server.ts", "packages/db/dist/permissions-seed.server.js"], ["packages/db/src/deploy-permission-catalog-sync.server.ts", "packages/db/dist/deploy-permission-catalog-sync.server.js"], ["prisma/seed.ts", "packages/db/dist/production-seed.server.js"], ["scripts/seed-e2e-readiness.ts", "packages/db/dist/e2e-readiness-seed.server.js"], ]; for (const [entryPoint, outfile] of artifacts) { const rootDir = createFixture({ dbRuntimeBuildScript: VALID_DB_RUNTIME_BUILD_SCRIPT.replace(outfile, `${outfile}.missing`), }); const failures = checkDockerfileWebContract(rootDir).failures; expect(failures).toContain(`packages/db/scripts/build-runtime-artifacts.mjs: must build ${outfile} from ${entryPoint}`); } }); it("fails when runtime HEALTHCHECK startup polling loses its fast cadence", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replaceAll("--start-interval=2s ", ""), hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace("--start-interval=2s ", ""), }); const result = verifyDockerBaseline(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/web HEALTHCHECK must use --start-interval=2s with steady --interval=30s and --retries=3/); expect(failures).toMatch(/worker HEALTHCHECK must use --start-interval=2s with steady --interval=30s and --retries=3/); expect(failures).toMatch(/api HEALTHCHECK must use --start-interval=2s with steady --interval=30s and --retries=3/); expect(failures).toMatch(/MCP HEALTHCHECK must use --start-interval=2s with steady --interval=30s and --retries=3/); expect(failures).toMatch(/Hocuspocus HEALTHCHECK must use --start-interval=2s with steady --interval=30s and --retries=3/); }); it("fails when Hocuspocus production dependency deployment depends on application source", () => { const rootDir = createFixture({ hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace("FROM deps AS hocuspocus-production-deps", "FROM build AS hocuspocus-production-deps"), }); const result = checkHocuspocusDockerfileContract(rootDir); expect(result.failures.join("\n")).toMatch(/production-deps must derive from the manifest-only deps stage/); }); it("fails when Hocuspocus bypasses the generated-client-aware Prisma runtime pruner", () => { const rootDir = createFixture({ hocuspocusDockerfile: VALID_HOCUSPOCUS_DOCKERFILE.replace( "RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/hocuspocus/node_modules /myapp/packages/db/generated/prisma/client/internal/class.ts", "RUN rm -rf /prod/hocuspocus/node_modules/.pnpm/@prisma+client@*/node_modules/@prisma/client/generator-build" ), }); const result = checkHocuspocusDockerfileContract(rootDir); expect(result.failures.join("\n")).toMatch(/generated-client-aware Prisma runtime pruner/); }); it("fails when deployed runtime closures retain source artifacts or remote services retain package managers", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "COPY --exclude=**/*.map --exclude=**/*.d.ts --from=api-production-deps /prod/api/node_modules /myapp/node_modules", "COPY --from=api-production-deps /prod/api/node_modules /myapp/node_modules" ).replaceAll("RUN rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/pnpm /usr/local/bin/yarn", ""), }); const result = checkDockerfileDepsManifestContract(rootDir); expect(result.failures.join("\n")).toMatch(/api target dependency COPY must use both --exclude/); expect(result.failures.join("\n")).toMatch(/api target must remove inherited Corepack, pnpm, and Yarn executables/); }); it("fails when the worker keeps optional peer closure orphans", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "RUN node /myapp/scripts/prune-pnpm-runtime-closure.mjs /prod/worker/node_modules prisma typescript", "RUN rm -rf /prod/worker/node_modules/.pnpm/prisma@* /prod/worker/node_modules/.pnpm/typescript@*" ), }); const result = checkDockerfileDepsManifestContract(rootDir); expect(result.failures.join("\n")).toMatch(/prune optional Prisma and TypeScript peer closures by reachability/); }); it("fails when non-scanning workers inherit the ClamAV dependency", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace( / worker-mail:\n <<: \*worker-base\n environment:[\s\S]*? healthcheck:/, ` worker-mail: <<: *worker-base environment: - WORKER_QUEUE_GROUP=mail - WORKER_CONCURRENCY_MAIL=\${WORKER_CONCURRENCY_MAIL:-5} - WORKER_HEALTH_PORT=9102 - WORKER_ADMIN_PORT=9202 healthcheck:` ), }); const result = checkDockerComposeWorkerTopology(rootDir); assert.match(result.failures.join("\n"), /docker-compose\.yml: worker-mail must override worker-base depends_on so it does not inherit clamav/); }); it("fails when the scan worker defaults off or omits its storage contract", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace( "SCAN_QUEUE_ENABLED=\${SCAN_QUEUE_ENABLED:-true}", "SCAN_QUEUE_ENABLED=\${SCAN_QUEUE_ENABLED:-false}" ).replace(" - STORAGE_BUCKET=\${STORAGE_BUCKET:-}\n", ""), dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(" - SCAN_QUEUE_ENABLED=true\n", ""), }); const result = checkDockerComposeWorkerTopology(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/default SCAN_QUEUE_ENABLED to true/); expect(failures).toMatch(/pass through STORAGE_BUCKET/); expect(failures).toMatch(/force SCAN_QUEUE_ENABLED=true/); }); it("fails when the staging web runtime omits encrypted GDPR export storage", () => { const rootDir = createFixture({ dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(" - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:?required}\n", "").replace( " - GDPR_EXPORT_SSE_C_KEY_BASE64=\${GDPR_EXPORT_SSE_C_KEY_BASE64:?required}\n", "" ), }); const result = checkDockerComposeWorkerTopology(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/web must require STORAGE_ENDPOINT for encrypted GDPR export downloads/); expect(failures).toMatch(/web must require GDPR_EXPORT_SSE_C_KEY_BASE64 for encrypted GDPR export downloads/); }); it("fails when the staging web runtime omits the distributed GDPR download Redis contract", () => { const rootDir = createFixture({ dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(" - REDIS_URL=\${REDIS_URL:?required}\n", ""), }); const result = checkDockerComposeWorkerTopology(rootDir); expect(result.failures.join("\n")).toMatch(/web must require REDIS_URL for distributed GDPR export download gates/); }); it("fails when staging GDPR consumers reuse shared storage credential sources", () => { const rootDir = createFixture({ dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING .replace("WEB_STORAGE_ACCESS_KEY_ID:?required", "STORAGE_ACCESS_KEY_ID:?required") .replace("WORKER_GENERAL_STORAGE_ACCESS_KEY_ID:?required", "STORAGE_ACCESS_KEY_ID:?required") .replace("WORKER_IMPORT_STORAGE_ACCESS_KEY_ID:?required", "STORAGE_ACCESS_KEY_ID:?required"), }); const result = checkDockerComposeWorkerTopology(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/web must require STORAGE_ACCESS_KEY_ID for encrypted GDPR export downloads/); expect(failures).toMatch(/worker-general must require STORAGE_ACCESS_KEY_ID for GDPR export retention/); expect(failures).toMatch(/worker-import must require STORAGE_ACCESS_KEY_ID for encrypted GDPR exports/); }); it("fails when worker-general omits automatic GDPR export retention storage", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace(" - EXPORT_RETENTION_QUEUE_ENABLED=\${EXPORT_RETENTION_QUEUE_ENABLED:-false}\n", ""), dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(" - EXPORT_RETENTION_QUEUE_ENABLED=true\n", "").replaceAll( " - STORAGE_BUCKET=\${STORAGE_BUCKET:?required}\n", "" ), }); const result = checkDockerComposeWorkerTopology(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/worker-general must pass through EXPORT_RETENTION_QUEUE_ENABLED/); expect(failures).toMatch(/worker-general must force EXPORT_RETENTION_QUEUE_ENABLED=true/); expect(failures).toMatch(/worker-general must require STORAGE_BUCKET for GDPR export retention/); }); it("fails when worker-general omits required tenant hard-delete search cleanup configuration", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace(" - MEILI_URL=\${MEILI_URL:-}\n", ""), dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(" - MEILI_API_KEY=\${MEILI_API_KEY:?required}\n", ""), }); const result = checkDockerComposeWorkerTopology(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/worker-general must pass through MEILI_URL for tenant hard-delete search cleanup/); expect(failures).toMatch(/worker-general must require MEILI_API_KEY for tenant hard-delete search cleanup/); }); it("fails when worker-import omits its dedicated encrypted GDPR export contract", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace(" - GDPR_EXPORT_SSE_C_KEY_BASE64=\${GDPR_EXPORT_SSE_C_KEY_BASE64:-}\n", ""), dockerComposeStaging: VALID_DOCKER_COMPOSE_STAGING.replace(" - PORTAL_GDPR_EXPORT_QUEUE_ENABLED=true\n", "").replace( " - IMPORT_QUEUE_RUNTIME_READY=false\n - STORAGE_ENDPOINT=\${STORAGE_ENDPOINT:?required}\n", " - IMPORT_QUEUE_RUNTIME_READY=false\n" ), }); const result = checkDockerComposeWorkerTopology(rootDir); const failures = result.failures.join("\n"); expect(failures).toMatch(/worker-import must pass through GDPR_EXPORT_SSE_C_KEY_BASE64 for encrypted GDPR exports/); expect(failures).toMatch(/worker-import must force PORTAL_GDPR_EXPORT_QUEUE_ENABLED=true/); expect(failures).toMatch(/worker-import must require STORAGE_ENDPOINT for encrypted GDPR exports/); }); it("fails when a worker group omits its distinct admin port", () => { const rootDir = createFixture({ dockerCompose: VALID_DOCKER_COMPOSE.replace(" - WORKER_ADMIN_PORT=9202\n", ""), }); const result = checkDockerComposeWorkerTopology(rootDir); assert.match(result.failures.join("\n"), /docker-compose\.yml: worker-mail must set WORKER_ADMIN_PORT=9202 distinct from WORKER_HEALTH_PORT=9102/); }); it("fails when dependency targets copy full workspace source or restore a generic runtime closure", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("COPY apps/api/package.json apps/api/package.json\n", "ADD apps apps\n") .replace("FROM production-deps-bundle AS web-production-deps", "FROM build AS web-production-deps") .concat("\nFROM base AS production-deps\nCOPY --from=deps /myapp/node_modules /myapp/node_modules\n"), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match( result.failures.join("\n"), /Dockerfile: deps target must copy workspace package manifests, not full apps or packages source, before pnpm install/ ); assert.match(result.failures.join("\n"), /Dockerfile: web-production-deps must derive from production-deps-bundle/); assert.match(result.failures.join("\n"), /Dockerfile: must not build or copy a generic whole-workspace production node_modules closure/); }); it("fails when the production dependency bundle does not own one locked warm-v2 helper invocation", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("FROM build AS production-deps-bundle", "FROM deps AS production-deps-bundle").replace( "id=hivegrid-pnpm-store-v2,target=/pnpm/store,sharing=locked", "id=hivegrid-pnpm-store-v3,target=/pnpm/store,sharing=shared" ), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /production-deps-bundle must derive from build and contain only one locked hivegrid-pnpm-store-v2 invocation/); }); it("fails when a target-specific dependency stage bypasses the bundle or adds work beyond prune and SBOM", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("FROM production-deps-bundle AS api-production-deps", "FROM build AS api-production-deps").replace( "RUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/api/node_modules", "RUN echo unexpected\nRUN node /myapp/scripts/prune-prisma-client-runtime.mjs /prod/api/node_modules" ), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match( result.failures.join("\n"), /api-production-deps must derive from production-deps-bundle and contain only its required post-deploy prune and SBOM instructions/ ); }); it("fails when helper deploy flags differ from the five exact runtime closure commands", () => { const rootDir = createFixture({ productionDepsHelper: VALID_PRODUCTION_DEPS_HELPER.replace( "@hivegrid/runtime-portal-domain-controller deploy --prod --no-optional /prod/portal-domain-controller", "@hivegrid/runtime-portal-domain-controller deploy --prod /prod/portal-domain-controller" ).replace("@hivegrid/runtime-worker deploy --prod /prod/worker", "@hivegrid/runtime-worker deploy --prod --no-optional /prod/worker"), }); const result = checkDockerfileDepsManifestContract(rootDir); const failures = result.failures.join("\n"); assert.match(failures, /deploy_portal_controller must run exactly .*deploy --prod --no-optional \/prod\/portal-domain-controller/); assert.match(failures, /deploy_worker must run exactly .*deploy --prod \/prod\/worker/); }); it("fails when helper concurrency drops PID collection or complete failure propagation", () => { const rootDir = createFixture({ productionDepsHelper: VALID_PRODUCTION_DEPS_HELPER.replace(' pids+=("$!")\n', "").replace( ' if [[ "$status" -eq 0 ]]; then\n status="$child_status"\n fi', ' status="$child_status"' ), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match( result.failures.join("\n"), /run_wave must collect all five background PIDs, wait for every child, preserve the first non-zero status, and return after all children are reaped/ ); }); it("fails when the fallback cleans broadly or skips exact target cleanup", () => { const rootDir = createFixture({ productionDepsHelper: VALID_PRODUCTION_DEPS_HELPER.replace('for target in "${targets[@]}"; do\n rm -rf -- "/prod/${target}"\ndone', "rm -rf -- /prod/*"), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /clean exactly the five \/prod targets on failure/); }); it("fails when the fallback fetches more than once or skips the complete retry wave", () => { const rootDir = createFixture({ productionDepsHelper: VALID_PRODUCTION_DEPS_HELPER.replace( "if pnpm fetch --frozen-lockfile; then", "pnpm fetch --frozen-lockfile\nif pnpm fetch --frozen-lockfile; then" ).replace("run_wave after-fetch || retry_status=$?", "retry_status=0"), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /fetch once, retry one complete wave/); }); it("fails when the fallback uses a lockfile sentinel or masks fetch failure", () => { const rootDir = createFixture({ productionDepsHelper: VALID_PRODUCTION_DEPS_HELPER.replace( "if pnpm fetch --frozen-lockfile; then", "lockfile_hash=sentinel\nif pnpm fetch --frozen-lockfile || true; then" ), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /propagate fetch or retry failure without a sentinel/); }); it("fails when the deps target installs without a BuildKit pnpm store cache", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "RUN --mount=type=cache,id=hivegrid-pnpm-store,target=/pnpm/store \\\n pnpm install --frozen-lockfile --prod=false --offline", "RUN pnpm install --frozen-lockfile --prod=false" ), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: deps target must use BuildKit cache mount for \/pnpm\/store during pnpm install/); }); it("fails when the deps target does not fetch before offline install", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("RUN --mount=type=cache,id=hivegrid-pnpm-store,target=/pnpm/store \\\n pnpm fetch --frozen-lockfile\n", ""), }); const result = checkDockerfileDepsManifestContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: deps target must run pnpm fetch --frozen-lockfile with BuildKit cache before install/); }); it("fails when .dockerignore broadly excludes source build directories", () => { const rootDir = createFixture({ dockerignore: [ "node_modules", "/docs", ".cache", "**/.cache", ".eslintcache", "**/.eslintcache", "coverage", "**/coverage", ".nyc_output", "**/.nyc_output", "reports", "**/reports", "public/build", "/build", "**/build", "apps/*/dist", "packages/*/dist", "playwright-report", "**/playwright-report", "test-results", "**/test-results", "blob-report", "**/blob-report", "", ].join("\n"), }); const result = checkDockerignoreContract(rootDir); assert.match(result.failures.join("\n"), /\.dockerignore: must not use broad \*\*\/build/); }); it("fails when .dockerignore omits generated build ignores", () => { const rootDir = createFixture({ dockerignore: ["node_modules", "apps/*/dist", "packages/*/dist", ""].join("\n"), }); const result = checkDockerignoreContract(rootDir); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore generated public\/build/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore generated \/build/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore generated \/apps\/\*\/build/); }); it("fails when .dockerignore omits Docker context artifact ignores", () => { const rootDir = createFixture({ dockerignore: ["node_modules", "public/build", "/build", "/apps/*/build", "apps/*/dist", "packages/*/dist", ""].join("\n"), }); const result = checkDockerignoreContract(rootDir); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \/docs/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \/secrets/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \/\.gitea/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \*\*\/\*\.test\.tsx/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \*\*\/coverage/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \*\*\/reports/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \*\*\/blob-report/); assert.match(result.failures.join("\n"), /\.dockerignore: must ignore Docker context artifact \*\*\/\.nyc_output/); }); it("fails when .dockerignore broadly excludes cache or report source directories", () => { const rootDir = createFixture({ dockerignore: [ "node_modules", "/docs", ".cache", "**/.cache", "public/build", "/build", "/apps/*/build", "apps/*/dist", "packages/*/dist", "**/cache", "**/report", "coverage", "**/coverage", ".nyc_output", "**/.nyc_output", "reports", "**/reports", "playwright-report", "**/playwright-report", "test-results", "**/test-results", "blob-report", "**/blob-report", "", ].join("\n"), }); const result = checkDockerignoreContract(rootDir); assert.match(result.failures.join("\n"), /\.dockerignore: must not use broad \*\*\/cache/); assert.match(result.failures.join("\n"), /\.dockerignore: must not use broad \*\*\/report/); }); it("fails when start.sh does not exec the production start process", () => { const rootDir = createFixture({ startScript: "#!/bin/sh\npnpm start\n" }); const result = checkStartScript(rootDir); assert.match( result.failures.join("\n"), /start\.sh: must use "exec node build\/server-runtime\/server\.js" so container signals reach the web process without pnpm indirection/ ); }); it("fails when start.sh drops the one-shot migration and runtime credential gates", () => { const rootDir = createFixture({ startScript: "#!/bin/sh\nexec node build/server-runtime/server.js\n" }); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /start\.sh: must set -eu/); assert.match(result.failures.join("\n"), /DIRECT_URL-only "migrate" mode/); assert.match(result.failures.join("\n"), /must reject SEED_/); assert.match(result.failures.join("\n"), /must require hivegrid_app with RLS required/); }); it("fails when start.sh delegates the one-shot migration to a package manager", () => { const rootDir = createFixture({ startScript: [ "#!/bin/sh", "set -eu", 'if [ "${1:-}" = "migrate" ]; then', ' echo "DIRECT_URL is required for the one-shot migrator"', ' echo "DATABASE_URL must not be forwarded to the one-shot migrator"', ' echo "seed credentials and flags must not be forwarded to the one-shot migrator"', " node /myapp/scripts/verify-migrator-role.mjs", " node /myapp/scripts/adopt-prisma-baseline.mjs --adopt", ' export DATABASE_URL="$DIRECT_URL"', " pnpm exec prisma migrate deploy --config prisma.config.ts", "fi", 'echo "RLS_RUNTIME_MODE=required is mandatory for the web runtime"', 'echo "DATABASE_RUNTIME_ROLE=hivegrid_app is mandatory for the web runtime"', 'echo "DIRECT_URL must not be forwarded to the web runtime"', 'echo "MIGRATOR_* credentials must not be forwarded to the web runtime"', 'echo "MIGRATE_ON_BOOT is forbidden"', 'echo "SEED_ON_BOOT is forbidden"', "exec node build/server-runtime/server.js", ].join("\n"), }); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /without package-manager indirection/); }); it("fails when start.sh skips the exact migrator role probe", () => { const rootDir = createFixture(); const startPath = path.join(rootDir, "start.sh"); fs.writeFileSync(startPath, fs.readFileSync(startPath, "utf8").replace(" node /myapp/scripts/verify-migrator-role.mjs\n", "")); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /verify the exact non-superuser migrator role/); }); it("fails when start.sh skips post-migration Prisma schema verification", () => { const rootDir = createFixture(); const startPath = path.join(rootDir, "start.sh"); fs.writeFileSync( startPath, fs.readFileSync(startPath, "utf8").replace(" node /myapp/scripts/adopt-prisma-baseline.mjs --verify-current-schema\n", "") ); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /current schema verification/); }); it("fails when start.sh verifies the current Prisma schema before migrations", () => { const rootDir = createFixture(); const startPath = path.join(rootDir, "start.sh"); const verifyLine = " node /myapp/scripts/adopt-prisma-baseline.mjs --verify-current-schema\n"; const source = fs.readFileSync(startPath, "utf8"); fs.writeFileSync(startPath, source.replace(verifyLine, "").replace(" node /myapp/scripts/adopt-prisma-baseline.mjs --adopt\n", `$&${verifyLine}`)); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /verify the exact non-superuser migrator role/); }); it("fails when start.sh skips the post-migration permission catalog sync", () => { const rootDir = createFixture(); const startPath = path.join(rootDir, "start.sh"); fs.writeFileSync(startPath, fs.readFileSync(startPath, "utf8").replace(" node /myapp/packages/db/dist/deploy-permission-catalog-sync.server.js\n", "")); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /must run the bundled permission catalog sync/); }); it("fails when start.sh moves the permission catalog sync outside one-shot migrate mode", () => { const rootDir = createFixture(); const startPath = path.join(rootDir, "start.sh"); const syncLine = " node /myapp/packages/db/dist/deploy-permission-catalog-sync.server.js\n"; const source = fs.readFileSync(startPath, "utf8"); fs.writeFileSync(startPath, source.replace(syncLine, "").replace(" exit 0\nfi\n", ` exit 0\nfi\n${syncLine}`)); const result = checkStartScript(rootDir); assert.match(result.failures.join("\n"), /exactly once inside one-shot migrate mode/); }); it("fails when the database build omits the deploy permission catalog artifact", () => { const rootDir = createFixture({ dbPackage: { name: "@hivegrid/db", scripts: { build: "esbuild packages/db/src/permissions-seed.server.ts --bundle --platform=node --format=esm" }, }, }); const result = checkDbManifest(rootDir); assert.match(result.failures.join("\n"), /must bundle deploy-permission-catalog-sync\.server\.ts/); }); it("fails when the root production start script uses tsx", () => { const rootDir = createFixture({ rootPackage: { private: true, scripts: { build: "vite build && node scripts/build-web-server.mjs", lint: "eslint .", test: "pnpm --filter @hivegrid/web test", typecheck: "tsc -b", start: "tsx server/server.ts", }, }, }); const result = verifyDockerBaseline(rootDir); assert.match(result.failures.join("\n"), /package\.json: script "start" must delegate to @hivegrid\/web/); assert.match(result.failures.join("\n"), /package\.json: script "start" must not use tsx for web production runtime/); }); it("fails when Dockerfile does not define the named web target", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("FROM base AS web", "FROM base"), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: must define web target with "FROM base AS web"/); }); it("fails when the web healthcheck omits the canonical host header", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("headers:{host:process.env.WEB_APP_HOST}", "headers:{}"), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /web target HEALTHCHECK must send WEB_APP_HOST for host-aware routing/); }); it("fails when Dockerfile does not define the named api target", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("FROM base AS api", "FROM base"), }); const result = checkDockerfileApiContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: must define api target with "FROM base AS api"/); }); it("fails when Dockerfile does not define the named worker target", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("FROM base AS worker", "FROM base"), }); const result = checkDockerfileWorkerContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: must define worker target with "FROM base AS worker"/); }); it("fails when runtime images use recursive chown", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD curl", "RUN chown -R node:node /myapp\nHEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD curl" ) .replace( "HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD node apps/worker", "RUN chown -R node:node /myapp\nHEALTHCHECK --interval=30s --timeout=10s --start-period=20s --start-interval=2s --retries=3 CMD node apps/worker" ) .replace('ENTRYPOINT [ "./start.sh" ]', 'RUN chown -R node:node /myapp\nENTRYPOINT [ "./start.sh" ]'), }); assert.match(checkDockerfileWebContract(rootDir).failures.join("\n"), /web target must not use recursive chown/); assert.match(checkDockerfileApiContract(rootDir).failures.join("\n"), /api target must not use recursive chown/); assert.match(checkDockerfileWorkerContract(rootDir).failures.join("\n"), /worker target must not use recursive chown/); }); it("fails when Dockerfile misses the worker dist copy", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("COPY --from=worker-runtime-artifacts /myapp/apps/worker/dist /myapp/apps/worker/dist\n", ""), }); const result = checkDockerfileWorkerContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: worker target must copy \/myapp\/apps\/worker\/dist/); }); it("fails when Dockerfile worker target uses tsx at runtime", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace('CMD [ "node", "apps/worker/dist/index.js" ]', 'CMD [ "tsx", "apps/worker/src/index.ts" ]'), }); const result = checkDockerfileWorkerContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: worker target must invoke node apps\/worker\/dist\/index\.js directly/); assert.match(result.failures.join("\n"), /Dockerfile: worker target must not use tsx at runtime/); }); it("fails when Dockerfile misses the API target-specific dependency closure", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "COPY --exclude=**/*.map --exclude=**/*.d.ts --from=api-production-deps /prod/api/node_modules /myapp/node_modules\n", "" ), }); const result = checkDockerfileApiContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: api target must copy \/myapp\/target-specific node_modules/); }); it("fails when Dockerfile api target uses tsx at runtime", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace('CMD [ "node", "apps/api/dist/server.js" ]', 'CMD [ "tsx", "apps/api/src/server.ts" ]'), }); const result = checkDockerfileApiContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: api target must invoke node apps\/api\/dist\/server\.js directly/); assert.match(result.failures.join("\n"), /Dockerfile: api target must not use tsx at runtime/); }); it("fails when Dockerfile misses the server-runtime copy", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("COPY --from=web-runtime-artifacts /myapp/build/server-runtime /myapp/build/server-runtime\n", ""), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: web target must copy \/myapp\/build\/server-runtime from web-runtime-artifacts stage/); }); it("fails when Dockerfile does not remove sourcemaps before runtime artifact copies", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace("RUN find /myapp/build /myapp/apps/web/build /myapp/apps/web/build-portal -type f -name '*.map' -delete\n", ""), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: web\/api\/worker runtime artifact targets must delete their own \*\.map files before runtime COPY/); }); it("fails when the shared build stage runs app builds instead of split build targets", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "RUN node packages/db/scripts/build-runtime-artifacts.mjs\n", "RUN node packages/db/scripts/build-runtime-artifacts.mjs\nRUN pnpm build\n" ), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: build target must not run root\/web\/api\/worker app builds/); }); it("fails when the shared build stage owns Vite build args", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "RUN ./node_modules/.bin/prisma generate --config prisma.config.ts\n", 'ARG VITE_SENTRY_DSN_WEB=""\nRUN ./node_modules/.bin/prisma generate --config prisma.config.ts\n' ), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: build target must not declare VITE_\* ARG\/ENV values/); }); it("fails when the web build does not forward the public Hocuspocus URL", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace('ARG VITE_HOCUSPOCUS_URL=""\n', "").replace('ENV VITE_HOCUSPOCUS_URL="\${VITE_HOCUSPOCUS_URL}"\n', ""), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: web-build target must declare ARG VITE_HOCUSPOCUS_URL and forward it with ENV/); }); it("fails when Dockerfile misses required web runtime closure and boot artifacts", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "COPY --exclude=**/*.map --exclude=**/*.d.ts --from=web-production-deps /prod/web/node_modules /myapp/node_modules\n", "" ) .replace("COPY --from=build /myapp/packages/db/dist /myapp/packages/db/dist\n", "") .replace("COPY --from=build /myapp/prisma /myapp/prisma\n", ""), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: web target must copy \/myapp\/target-specific node_modules/); assert.match(result.failures.join("\n"), /Dockerfile: web target must copy \/myapp\/packages\/db production seed artifact/); assert.match(result.failures.join("\n"), /Dockerfile: web target must copy \/myapp\/prisma/); }); it("fails when the web target copies the separately deployed API application", () => { const rootDir = createFixture({ dockerfile: VALID_DOCKERFILE.replace( "COPY --from=web-runtime-artifacts /myapp/build /myapp/build\n", "COPY --from=web-runtime-artifacts /myapp/build /myapp/build\nCOPY --from=build /myapp/apps/api/src /myapp/apps/api/src\n" ), }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: web target must not copy API source, manifests, or artifacts/); }); it("fails when the web manifest depends on the separately deployed API application", () => { const rootDir = createFixture({ webPackage: { name: "@hivegrid/web", scripts: { start: "node ../../build/server-runtime/server.js" }, dependencies: { "@hivegrid/api": "workspace:*" }, }, }); const result = checkWebManifest(rootDir); assert.match(result.failures.join("\n"), /apps\/web\/package\.json: web must not depend on the separately deployed @hivegrid\/api app/); }); it("checks web runtime copy and entrypoint only inside the web target", () => { const rootDir = createFixture({ dockerfile: `FROM node:24-bookworm-slim AS base FROM base AS build COPY --from=build /myapp/build/server-runtime /myapp/build/server-runtime ENTRYPOINT [ "./start.sh" ] FROM base AS web COPY --from=build /myapp/build /myapp/build `, }); const result = checkDockerfileWebContract(rootDir); assert.match(result.failures.join("\n"), /Dockerfile: web target must copy \/myapp\/build\/server-runtime from web-runtime-artifacts stage/); assert.match(result.failures.join("\n"), /Dockerfile: web target must keep ENTRYPOINT/); }); it("fails with the script name and manifest path when root typecheck is missing", () => { const rootDir = createFixture({ rootPackage: { private: true, scripts: { build: "vite build", lint: "eslint .", test: "pnpm --filter @hivegrid/web test", }, }, }); const result = verifyDockerBaseline(rootDir); assert.match(result.failures.join("\n"), /package\.json: missing required script "typecheck"/); }); it("fails with a path-specific message when a workspace package manifest is missing", () => { const rootDir = createFixture({ remove: ["apps/api/package.json"] }); const result = verifyDockerBaseline(rootDir); assert.match(result.failures.join("\n"), /apps\/api\/package\.json: missing required Docker baseline file/); }); it("fails with a path-specific message when the web package manifest is missing", () => { const rootDir = createFixture({ remove: ["apps/web/package.json"] }); const result = verifyDockerBaseline(rootDir); assert.match(result.failures.join("\n"), /apps\/web\/package\.json: missing required Docker baseline file/); }); it("fails when worker production scripts use tsx", () => { const rootDir = createFixture({ workerPackage: { name: "@hivegrid/worker", scripts: { start: "tsx src/index.ts", health: "tsx src/health.ts", }, }, }); const result = verifyDockerBaseline(rootDir); assert.match(result.failures.join("\n"), /apps\/worker\/package\.json: script "start" must contain node for worker production runtime/); assert.match(result.failures.join("\n"), /apps\/worker\/package\.json: script "start" must target dist\/index\.js/); assert.match(result.failures.join("\n"), /apps\/worker\/package\.json: script "start" must not use tsx for worker production runtime/); assert.match(result.failures.join("\n"), /apps\/worker\/package\.json: script "health" must target dist\/health\.js/); }); it("formats concise PASS, OBSERVE, and FAIL lines", () => { const output = formatVerificationResult({ passes: ["Dockerfile: exists"], observations: ["apps/worker/package.json: dev script uses tsx"], failures: ['package.json: missing required script "typecheck"'], }); assert.match(output, /^FAIL Docker baseline verification/m); assert.match(output, /^PASS Dockerfile: exists/m); assert.match(output, /^OBSERVE apps\/worker\/package\.json: dev script uses tsx/m); assert.match(output, /^FAIL package\.json: missing required script "typecheck"/m); }); });