feat: streamline Docker builds with .dockerignore and pass NPM_TOKEN as a build secret for pnpm install.

.dockerignore

@@ -0,0 +1,12 @@
+node_modules
+.next
+.git
+.npmrc
+dist
+build
+out
+coverage
+.vercel
+.turbo
+*.log
+.DS_Store

.gitea/workflows/pipeline.yml

@@ -13,6 +13,8 @@ jobs:
   qa:
     name: 🧪 Quality Assurance
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -26,7 +28,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node_version: 20
-          cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -47,6 +48,8 @@ jobs:
     needs: qa
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     env:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -65,7 +68,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node_version: 20
-          cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -81,6 +83,8 @@ jobs:
     needs: qa
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -102,6 +106,8 @@ jobs:
           file: packages/infra/docker/Dockerfile.nextjs
           platforms: linux/amd64,linux/arm64
           push: true
+          secrets: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
           tags: |
             registry.infra.mintel.me/mintel/nextjs:${{ github.ref_name }}
             registry.infra.mintel.me/mintel/nextjs:latest
@@ -113,6 +119,8 @@ jobs:
           file: packages/infra/docker/Dockerfile.runtime
           platforms: linux/amd64,linux/arm64
           push: true
+          secrets: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
           tags: |
             registry.infra.mintel.me/mintel/runtime:${{ github.ref_name }}
             registry.infra.mintel.me/mintel/runtime:latest
@@ -124,6 +132,8 @@ jobs:
           file: packages/infra/docker/Dockerfile.gatekeeper
           platforms: linux/amd64,linux/arm64
           push: true
+          secrets: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
           tags: |
             registry.infra.mintel.me/mintel/gatekeeper:${{ github.ref_name }}
             registry.infra.mintel.me/mintel/gatekeeper:latest
@@ -135,6 +145,8 @@ jobs:
           file: packages/infra/docker/Dockerfile.directus
           platforms: linux/amd64,linux/arm64
           push: true
+          secrets: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
           tags: |
             registry.infra.mintel.me/mintel/directus:${{ github.ref_name }}
             registry.infra.mintel.me/mintel/directus:latest

packages/infra/docker/Dockerfile.gatekeeper

@@ -6,15 +6,15 @@ WORKDIR /app
 # Enable pnpm
 RUN corepack enable pnpm
 
-# Install dependencies (using monorepo root context)
-COPY pnpm-lock.yaml pnpm-workspace.yaml package.json .npmrc* ./
-COPY packages/gatekeeper/package.json ./packages/gatekeeper/
-COPY packages/next-utils/package.json ./packages/next-utils/
-COPY packages/tsconfig/package.json ./packages/tsconfig/
-COPY packages/eslint-config/package.json ./packages/eslint-config/
-COPY packages/next-config/package.json ./packages/next-config/
+# Step 2: Install dependencies
+# We copy everything first because we have a .dockerignore
+# and we need the workspace structure for pnpm to work correctly
+COPY . .
 
+# Use a secret for NPM_TOKEN to authenticate with private registry
 RUN --mount=type=cache,target=/root/.local/share/pnpm/store/v3 \
+    --mount=type=secret,id=NPM_TOKEN \
+    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) && \
     pnpm i --frozen-lockfile
 
 # Copy source

packages/infra/docker/Dockerfile.nextjs

@@ -1,24 +1,19 @@
+# Step 1: Base image
 FROM node:20-alpine AS base
-
 RUN apk add --no-cache libc6-compat curl
 WORKDIR /app
-
-# Enable pnpm
 RUN corepack enable pnpm
 
-# Copy root configurations
-COPY pnpm-lock.yaml pnpm-workspace.yaml package.json .npmrc* ./
-
-# Copy all package.json files to allow pnpm install to be cached
-COPY packages/*/package.json ./packages/
-COPY apps/*/package.json ./apps/
-
-# Install dependencies for the entire monorepo
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store/v3 \
-    pnpm i --frozen-lockfile
-
-# Copy the rest of the source code
+# Step 2: Install dependencies
+# We copy everything first because we have a .dockerignore
+# and we need the workspace structure for pnpm to work correctly
 COPY . .
 
-# Post-install/Build shared packages if needed
+# Use a secret for NPM_TOKEN to authenticate with private registry
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store/v3 \
+    --mount=type=secret,id=NPM_TOKEN \
+    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) && \
+    pnpm i --frozen-lockfile
+
+# Step 3: Build shared packages
 RUN pnpm -r build --filter="./packages/*"

packages/infra/gitea/deploy-action.yml

@@ -24,6 +24,8 @@ jobs:
   prepare:
     name: 🔍 Prepare Environment
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     outputs:
       target:           ${{ steps.determine.outputs.target }}
       image_tag:        ${{ steps.determine.outputs.image_tag }}
@@ -136,6 +138,8 @@ jobs:
     needs: prepare
     if: needs.prepare.outputs.target != 'skip'
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -144,7 +148,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
@@ -171,6 +174,8 @@ jobs:
     needs: prepare
     if: needs.prepare.outputs.target != 'skip'
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -194,6 +199,8 @@ jobs:
             NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_base_url }}
             NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
           push: true
+          secrets: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
           tags: registry.infra.mintel.me/mintel/${{ github.event.repository.name }}:${{ needs.prepare.outputs.image_tag }}
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/${{ github.event.repository.name }}:buildcache
           cache-to: type=registry,ref=registry.infra.mintel.me/mintel/${{ github.event.repository.name }}:buildcache,mode=max
@@ -206,6 +213,8 @@ jobs:
     needs: [prepare, build, qa]
     if: needs.prepare.outputs.target != 'skip'
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     env:
       TARGET: ${{ needs.prepare.outputs.target }}
       IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
@@ -272,6 +281,8 @@ jobs:
     needs: [prepare, deploy]
     if: always()
     runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
     steps:
       - name: 🔔 Gotify - Success
         if: needs.deploy.result == 'success'