web/yarn.lock replaces web/package-lock.json. yarn import converted it, so it locks the same package versions with the same integrity hashes. The web-builder stage pins yarn 1.22.22, the version script/bootstrap pins, by its sha512 through corepack, and installs with yarn install --frozen-lockfile. web/build.sh runs the esbuild that yarn installed rather than npx or an esbuild found on the PATH. Model: opus-5-5
This commit is contained in:
+7
-2
@@ -1,9 +1,14 @@
|
||||
# Web build stage — compile SPA from source
|
||||
# node:22-alpine, 2026-03-09
|
||||
FROM node@sha256:8094c002d08262dba12645a3b4a15cd6cd627d30bc782f53229a2ec13ee22a00 AS web-builder
|
||||
# yarn 1.22.22, the version script/bootstrap pins, checked against the
|
||||
# sha512 of its npm package. corepack enable replaces the yarn the image
|
||||
# ships with corepack's own, which runs the version activated here.
|
||||
RUN corepack enable \
|
||||
&& corepack prepare yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e --activate
|
||||
WORKDIR /web
|
||||
COPY web/package.json web/package-lock.json ./
|
||||
RUN npm ci
|
||||
COPY web/package.json web/yarn.lock ./
|
||||
RUN yarn install --frozen-lockfile
|
||||
COPY web/src/ src/
|
||||
COPY web/build.sh build.sh
|
||||
RUN sh build.sh
|
||||
|
||||
Reference in New Issue
Block a user