From 96bcf8d767ea89ab9e1bac83b696c23fc0457110 Mon Sep 17 00:00:00 2001 From: Theodore Li Date: Tue, 1 Sep 2026 03:14:41 -0700 Subject: [PATCH] fix(docker): allow pruned lockfile normalization --- docker/app.Dockerfile | 6 +++++- docker/db.Dockerfile | 6 ++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/docker/app.Dockerfile b/docker/app.Dockerfile index 4fe9320d4ef..ebe4fad1b29 100644 --- a/docker/app.Dockerfile +++ b/docker/app.Dockerfile @@ -73,9 +73,13 @@ COPY --from=pruner /app/bun.lock ./bun.lock # resolved it from the registry at build time, which pulled a different major # (13.x vs the pinned 12.4.0) and bypassed the `minimumReleaseAge` supply-chain # gate in bunfig.toml on every production image build. +# +# This stage contains only the pruned workspace manifests, while the full lockfile +# still describes every workspace. Bun must be allowed to normalize that lockfile +# to the pruned graph; the full-repository CI install owns frozen-lockfile validation. RUN --mount=type=cache,id=bun-cache,target=/root/.bun/install/cache \ --mount=type=cache,id=npm-cache,target=/root/.npm \ - HUSKY=0 bun install --frozen-lockfile --ignore-scripts --linker=hoisted && \ + HUSKY=0 bun install --ignore-scripts --linker=hoisted && \ cd node_modules/isolated-vm && JOBS=4 /app/node_modules/.bin/node-gyp rebuild --release # ======================================== diff --git a/docker/db.Dockerfile b/docker/db.Dockerfile index b2451e0b315..19bb54e62c3 100644 --- a/docker/db.Dockerfile +++ b/docker/db.Dockerfile @@ -17,9 +17,11 @@ COPY packages/logger/package.json ./packages/logger/package.json COPY packages/tsconfig/package.json ./packages/tsconfig/package.json COPY packages/utils/package.json ./packages/utils/package.json -# Install dependencies with cache mount for faster builds +# Install dependencies with cache mount for faster builds. This stage contains +# only the migration workspace manifests, so Bun must normalize the full root +# lockfile to that subset; full-repository CI owns frozen-lockfile validation. RUN --mount=type=cache,id=bun-cache,target=/root/.bun/install/cache \ - bun install --frozen-lockfile --ignore-scripts + bun install --ignore-scripts # ======================================== # Runner Stage: Production Environment