Setup Woodpecker CI config

.dockerignore

@@ -0,0 +1,33 @@
+# Never ship the host's node_modules: it clobbers the node_modules that
+# `yarn install` builds inside the image, and native addons (bcrypt) compiled
+# against the host's glibc/ABI will fail to dlopen in the container.
+node_modules/
+
+.git/
+.gitignore
+.idea*
+
+# Secrets / local config. The image gets an empty .env; real config is env vars.
+.env
+*.conf
+
+# Local-only tooling and deploy manifests, not needed at runtime.
+docker-compose.yml
+docker.env
+.drone.yml
+.woodpecker.yaml
+deploy/
+README.md
+TODO.txt
+
+# Runtime scratch dirs: keep the directories, drop any local contents.
+uploads/*
+!uploads/.gitkeep
+tmp.uploads/*
+!tmp.uploads/.gitkeep
+
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*

.woodpecker.yaml

@@ -0,0 +1,21 @@
+when:
+  - event: push
+    branch: master
+  - event: [tag, manual]
+
+steps:
+  - name: build-and-push
+    # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact
+    # image:tag, so a floating tag here would silently break the build.
+    image: woodpeckerci/plugin-docker-buildx:6.1.1
+    privileged: true
+    settings:
+      registry: registry.apps.millslan.net
+      repo: registry.apps.millslan.net/starship/coreid
+      tags: latest
+      platforms: linux/amd64
+      dockerfile: Dockerfile
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password

Dockerfile

@@ -1,16 +1,17 @@
-FROM node:16
-
-RUN mkdir /app
-
-COPY package.json /app
-COPY yarn.lock /app
-
-RUN cd /app && yarn install
-
-COPY . /app
-
-RUN rm -rf /app/.env
-RUN touch /app/.env
+FROM node:16-bullseye
 
 WORKDIR /app
+
+# Dependencies first so the install layer caches independently of app source.
+COPY package.json yarn.lock ./
+
+RUN yarn install --frozen-lockfile --network-timeout 600000 \
+ && yarn cache clean
+
+COPY . .
+
+# Config comes from the environment in k8s; libflitter still expects the file
+# to exist, so ship an empty one. (.dockerignore keeps the real .env out.)
+RUN touch /app/.env
+
 CMD ["node", "index.js"]