ci: complete pipeline standardization

Dockerfile

@@ -1,46 +1,49 @@
-# Start from the pre-built Nextjs Base image
+# Stage 1: Builder
 FROM registry.infra.mintel.me/mintel/nextjs:latest AS builder
-
 WORKDIR /app
 
-# Ensure we are in a clean, standalone environment
-RUN rm -rf packages apps pnpm-workspace.yaml 2>/dev/null || true
+# Clean the workspace in case the base image is dirty
+RUN rm -rf ./*
 
-# Build-time environment variables for Next.js
+# Arguments for build-time configuration
 ARG NEXT_PUBLIC_BASE_URL
-ARG UMAMI_API_ENDPOINT
 ARG NEXT_PUBLIC_TARGET
 ARG DIRECTUS_URL
+ARG UMAMI_API_ENDPOINT
 ARG NEXT_PUBLIC_UMAMI_WEBSITE_ID
 ARG NPM_TOKEN
 
+# Environment variables for Next.js build
 ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
-ENV UMAMI_API_ENDPOINT=$UMAMI_API_ENDPOINT
 ENV NEXT_PUBLIC_TARGET=$NEXT_PUBLIC_TARGET
 ENV DIRECTUS_URL=$DIRECTUS_URL
+ENV UMAMI_API_ENDPOINT=$UMAMI_API_ENDPOINT
 ENV NEXT_PUBLIC_UMAMI_WEBSITE_ID=$NEXT_PUBLIC_UMAMI_WEBSITE_ID
-ENV NPM_TOKEN=$NPM_TOKEN
-ENV SENTRY_SUPPRESS_TURBOPACK_WARNING=1
 ENV SKIP_RUNTIME_ENV_VALIDATION=true
+ENV CI=true
 
-# Enable corepack
+# Enable pnpm
 RUN corepack enable
 
-# Copy package files
-COPY package.json pnpm-lock.yaml* .npmrc ./
+# Copy lockfile and manifest for dependency installation caching
+COPY pnpm-lock.yaml package.json .npmrc* ./
 
-# Install dependencies
-RUN pnpm install --no-frozen-lockfile
+# Install dependencies with cache mount
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    --mount=type=secret,id=NPM_TOKEN \
+    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN 2>/dev/null || echo $NPM_TOKEN) && \
+    pnpm install --frozen-lockfile
 
-# Copy local files
+# Copy source code
 COPY . .
 
-# Build the specific application
+# Build application
 RUN pnpm build
 
-# Production runner image
+# Stage 2: Runner
 FROM registry.infra.mintel.me/mintel/runtime:latest AS runner
-# Production environment configuration
+WORKDIR /app
+
 ENV HOSTNAME="0.0.0.0"
 ENV PORT=3000
 ENV NODE_ENV=production
@@ -49,9 +52,6 @@ ENV NODE_ENV=production
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-
-# Ensure the cache directory specifically is writeable (Mintel Standard #16)
-# We copy a small directory or just create it via COPY to avoid RUN chown permission issues
 COPY --from=builder --chown=nextjs:nodejs /app/.next/cache ./.next/cache
 
 USER nextjs