mirror of
https://github.com/makeplane/plane.git
synced 2026-06-14 03:30:00 +00:00
sriram veeraghanta
0acb32e65e
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml - Bump turbo from 2.9.4 to 2.9.14 in root package.json and the four production Dockerfiles (web, live, admin, space). - Move pnpm.overrides, onlyBuiltDependencies, and ignoredBuiltDependencies from package.json into pnpm-workspace.yaml. pnpm v10+ no longer reads the pnpm field in package.json, so the full overrides block and most of onlyBuiltDependencies were being silently ignored. - Add @plane/utils as a workspace dependency to the live server. * chore: drop unused allowBuilds block, bump lodash-es to 4.18.1 - Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not a recognized pnpm v10/v11 key and its values were inconsistent with the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies` configuration. - Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides now applied workspace-wide, 4.18.0 (marked deprecated as a "bad release") was being enforced everywhere. * fix: use pnpm v11 allowBuilds in place of removed legacy keys `onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed in pnpm v11. They were being silently ignored on this branch, which caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`. Replace them with the v11-native `allowBuilds:` block, mapping the previous allowlist to `true` and the previous denylist (sharp) to `false`. Locally verified that the build scripts for @parcel/watcher, @swc/core, esbuild, and msgpackr-extract now run on install.
106 lines
3.3 KiB
Docker
106 lines
3.3 KiB
Docker
FROM node:22-alpine AS base
|
|
|
|
WORKDIR /app
|
|
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
|
|
ENV CI=1
|
|
|
|
RUN corepack enable pnpm
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS builder
|
|
|
|
RUN pnpm add -g turbo@2.9.14
|
|
|
|
COPY . .
|
|
|
|
# Create a pruned workspace for just the space app
|
|
RUN turbo prune --scope=space --docker
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS installer
|
|
|
|
# Build in production mode; we still install dev deps explicitly below
|
|
ENV NODE_ENV=production
|
|
|
|
# Public envs required at build time (pick up via process.env)
|
|
ARG VITE_API_BASE_URL=""
|
|
ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
|
|
ARG VITE_API_BASE_PATH="/api"
|
|
ENV VITE_API_BASE_PATH=$VITE_API_BASE_PATH
|
|
|
|
ARG VITE_ADMIN_BASE_URL=""
|
|
ENV VITE_ADMIN_BASE_URL=$VITE_ADMIN_BASE_URL
|
|
ARG VITE_ADMIN_BASE_PATH="/god-mode"
|
|
ENV VITE_ADMIN_BASE_PATH=$VITE_ADMIN_BASE_PATH
|
|
|
|
ARG VITE_SPACE_BASE_URL=""
|
|
ENV VITE_SPACE_BASE_URL=$VITE_SPACE_BASE_URL
|
|
ARG VITE_SPACE_BASE_PATH="/spaces"
|
|
ENV VITE_SPACE_BASE_PATH=$VITE_SPACE_BASE_PATH
|
|
|
|
ARG VITE_LIVE_BASE_URL=""
|
|
ENV VITE_LIVE_BASE_URL=$VITE_LIVE_BASE_URL
|
|
ARG VITE_LIVE_BASE_PATH="/live"
|
|
ENV VITE_LIVE_BASE_PATH=$VITE_LIVE_BASE_PATH
|
|
|
|
ARG VITE_WEB_BASE_URL=""
|
|
ENV VITE_WEB_BASE_URL=$VITE_WEB_BASE_URL
|
|
ARG VITE_WEB_BASE_PATH=""
|
|
ENV VITE_WEB_BASE_PATH=$VITE_WEB_BASE_PATH
|
|
|
|
ARG VITE_WEBSITE_URL="https://plane.so"
|
|
ENV VITE_WEBSITE_URL=$VITE_WEBSITE_URL
|
|
|
|
ARG VITE_SUPPORT_EMAIL="support@plane.so"
|
|
ENV VITE_SUPPORT_EMAIL=$VITE_SUPPORT_EMAIL
|
|
|
|
COPY .gitignore .gitignore
|
|
COPY --from=builder /app/out/json/ .
|
|
COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
|
|
# Copy full directory structure before fetch to ensure all package.json files are available
|
|
COPY --from=builder /app/out/full/ .
|
|
COPY turbo.json turbo.json
|
|
|
|
# Fetch dependencies to cache store, then install offline with dev deps
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store CI=true pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store --prod=false
|
|
|
|
# Build only the space package
|
|
RUN pnpm turbo run build --filter=space
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS runner
|
|
|
|
ENV NODE_ENV=production
|
|
|
|
# Remove go from Alpine APK database; not needed at runtime and carries stdlib CVEs
|
|
RUN apk del go 2>/dev/null || true
|
|
|
|
# Remove vulnerable picomatch bundled inside npm (CVE-2026-33671)
|
|
# npx only needs picomatch when installing packages, not when running a locally-installed binary
|
|
RUN rm -rf /usr/local/lib/node_modules/npm/node_modules/picomatch
|
|
|
|
COPY --from=installer /app/apps/space/build ./apps/space/build
|
|
COPY --from=installer /app/apps/space/node_modules ./apps/space/node_modules
|
|
COPY --from=installer /app/node_modules ./node_modules
|
|
|
|
# esbuild and tsgolint are build-only Go binaries; remove from runtime image to eliminate stdlib CVEs
|
|
RUN find /app/node_modules \( -name 'esbuild' -o -name 'tsgolint' \) -type f -delete 2>/dev/null || true
|
|
|
|
WORKDIR /app/apps/space
|
|
|
|
EXPOSE 3000
|
|
|
|
RUN apk add --no-cache curl
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:3000/spaces/ >/dev/null || exit 1
|
|
|
|
CMD ["npx", "react-router-serve", "./build/server/index.js"]
|