From be5e9432c17cb6e6c4046b35199964b63491b81b Mon Sep 17 00:00:00 2001
From: garrettmills <shout@garrettmills.dev>
Date: Mon, 21 Sep 2026 23:34:05 -0500
Subject: [PATCH] Setup Woodpecker CI config

---
 .dockerignore    | 33 +++++++++++++++++++++++++++++++++
 .woodpecker.yaml | 21 +++++++++++++++++++++
 Dockerfile       | 27 ++++++++++++++-------------
 3 files changed, 68 insertions(+), 13 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 .woodpecker.yaml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..652f62d
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,33 @@
+# Never ship the host's node_modules: it clobbers the node_modules that
+# `yarn install` builds inside the image, and native addons (bcrypt) compiled
+# against the host's glibc/ABI will fail to dlopen in the container.
+node_modules/
+
+.git/
+.gitignore
+.idea*
+
+# Secrets / local config. The image gets an empty .env; real config is env vars.
+.env
+*.conf
+
+# Local-only tooling and deploy manifests, not needed at runtime.
+docker-compose.yml
+docker.env
+.drone.yml
+.woodpecker.yaml
+deploy/
+README.md
+TODO.txt
+
+# Runtime scratch dirs: keep the directories, drop any local contents.
+uploads/*
+!uploads/.gitkeep
+tmp.uploads/*
+!tmp.uploads/.gitkeep
+
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
diff --git a/.woodpecker.yaml b/.woodpecker.yaml
new file mode 100644
index 0000000..4db6daf
--- /dev/null
+++ b/.woodpecker.yaml
@@ -0,0 +1,21 @@
+when:
+  - event: push
+    branch: master
+  - event: [tag, manual]
+
+steps:
+  - name: build-and-push
+    # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact
+    # image:tag, so a floating tag here would silently break the build.
+    image: woodpeckerci/plugin-docker-buildx:6.1.1
+    privileged: true
+    settings:
+      registry: registry.apps.millslan.net
+      repo: registry.apps.millslan.net/starship/coreid
+      tags: latest
+      platforms: linux/amd64
+      dockerfile: Dockerfile
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password
diff --git a/Dockerfile b/Dockerfile
index 863d09d..377c0fa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,16 +1,17 @@
-FROM node:16
-
-RUN mkdir /app
-
-COPY package.json /app
-COPY yarn.lock /app
-
-RUN cd /app && yarn install
-
-COPY . /app
-
-RUN rm -rf /app/.env
-RUN touch /app/.env
+FROM node:16-bullseye
 
 WORKDIR /app
+
+# Dependencies first so the install layer caches independently of app source.
+COPY package.json yarn.lock ./
+
+RUN yarn install --frozen-lockfile --network-timeout 600000 \
+ && yarn cache clean
+
+COPY . .
+
+# Config comes from the environment in k8s; libflitter still expects the file
+# to exist, so ship an empty one. (.dockerignore keeps the real .env out.)
+RUN touch /app/.env
+
 CMD ["node", "index.js"]