mosaicstack/stack
19
0
Fork 1
Code Issues 335 Pull Requests 18 Actions Packages Projects Releases 15 Wiki Activity

fix(ci): fix pipeline #365 — web build-shared + orchestrator secret scan

Browse Source 
- Add build-shared step to web.yml so lint/typecheck/test can resolve
  @mosaic/shared types (same fix previously applied to api.yml)
- Remove compiled .spec.js/.test.js files from orchestrator production
  image to prevent Trivy secret scanning false positives from test
  fixtures (fake AWS keys and RSA private keys in secret-scanner tests)

Co-Authored-By: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Jason Woltje
2026-02-12 17:25:49 -06:00
co-authored by Claude Opus 4.6
parent 3833805a93
commit 3b12adf8f7
3 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/orchestrator/Dockerfile
+2
View File
@@ -83,6 +83,8 @@ COPY --from=builder --chown=nestjs:nodejs /app/packages ./packages
# Copy built orchestrator application
COPY --from=builder --chown=nestjs:nodejs /app/apps/orchestrator/dist ./apps/orchestrator/dist
# Remove compiled test files from production (contain test fixtures that trigger Trivy secret scanning)
RUN find ./apps/orchestrator/dist -name '*.spec.js' -o -name '*.spec.js.map' -o -name '*.test.js' -o -name '*.test.js.map' | xargs rm -f 2>/dev/null || true
COPY --from=builder --chown=nestjs:nodejs /app/apps/orchestrator/package.json ./apps/orchestrator/
# Copy app's node_modules which contains symlinks to root node_modules