fix(docker): copy scripts/ into appservice builder (#1446) #1447

2026-08-27T03:39:49Z

fred commented

2026-08-27 03:39:49 +00:00

The root package.json prepare script runs node scripts/install-hooks.mjs on install. docker/appservice.Dockerfile never copies scripts/ into the builder stage, so pnpm install --frozen-lockfile fails and every trunk build-appservice step has been red since pipeline 2799. gateway.Dockerfile and web.Dockerfile already carry the COPY; this adds the identical line (plus the same explanatory comment) to appservice.Dockerfile.

One-line change, mirrors the existing pattern in the two sibling Dockerfiles.

Fixes #1446. The root package.json prepare script runs node scripts/install-hooks.mjs on install. docker/appservice.Dockerfile never copies scripts/ into the builder stage, so pnpm install --frozen-lockfile fails and every trunk build-appservice step has been red since pipeline 2799. gateway.Dockerfile and web.Dockerfile already carry the COPY; this adds the identical line (plus the same explanatory comment) to appservice.Dockerfile. One-line change, mirrors the existing pattern in the two sibling Dockerfiles.

fred added 1 commit 2026-08-27 03:39:49 +00:00

fix(docker): copy scripts/ into appservice builder so the root prepare hook can run (#1446 )

ci/woodpecker/pr/ci Pipeline failed

Details

5aac155ab6

rev-code-01 approved these changes 2026-08-27 03:50:16 +00:00

rev-code-01 left a comment

APPROVED — rev-code-01, pinned to head 5aac155ab633e96314e8f66bfa189250908de453 (re-verified unmoved immediately before posting).

Scope: one file docker/appservice.Dockerfile (+2: comment + COPY scripts/ ./scripts/), fixes #1446. Verified independently of the terra review:

Mechanism confirmed. Root package.json prepare = node scripts/install-hooks.mjs; the appservice builder copied manifests/packages/plugins but not scripts/ before RUN pnpm install --frozen-lockfile — the prepare hook cannot resolve. The fix inserts the identical two-line pattern gateway.Dockerfile:13-14 and web.Dockerfile:11-12 already carry, at the same position (immediately before install).
Red controls run by me (direct, no docker): (A) the exact CI failure reproduced — node scripts/install-hooks.mjs in a manifests-only dir (old builder state) → MODULE_NOT_FOUND … /scripts/install-hooks.mjs, rc=1, byte-identical class to the quoted pipeline-2854 step failure; (B) with scripts/ present (fixed builder state) and git absent from PATH (alpine builder reality, git never installed) → git not found; skipping hook installation, rc=0 — exactly the observed gateway-builder behavior the issue quotes; (C) the script's guard order verified by read: ENOENT-git check (line 79-84) precedes any husky invocation, so the builder path exits cleanly. Two intermediate control attempts that hit my own harness quirks (git resolvable from sh fallback PATH; fake-git returning 127 is a non-ENOENT failure, not absence) were discarded — the controls reported are the discriminating ones.
Payload safety: the COPY is builder-stage only; the runner copies exactly /deploy/node_modules, /deploy/package.json, /app/apps/appservice/dist (Dockerfile:23-25) — scripts/ cannot enter the runner image. No .dockerignore exists (untracked or tracked) to exclude the copy. scripts/install-hooks.mjs exists at this head.
CI evidence measured: 2799 green; 2806 and 2854 both show build-appservice → failure (exit 1) in the publish workflow — content-independent across the two trees, as the issue states; build-web → success in the same pipelines isolates the defect to the appservice Dockerfile (web already had the COPY). Pipeline 2863 is running on this PR head at review time. Note: build-gateway also shows failure (exit 0) in 2806/2854 — not explained by this fix's absence (gateway has had the COPY since before 2799); if it persists after this lands, it is a separate issue and should be triaged separately, not folded into #1446.
Gates at this head (fresh worktree): format:check rc=0, typecheck rc=0 (45/45), lint rc=0 (25/25). Dockerfile-only diff; no code surface.

CI note: 2863 running at review time — merge waits on 2863 terminal green including its build-appservice step, which is itself the fix's verification.

**APPROVED — rev-code-01, pinned to head `5aac155ab633e96314e8f66bfa189250908de453`** (re-verified unmoved immediately before posting). Scope: one file `docker/appservice.Dockerfile` (+2: comment + `COPY scripts/ ./scripts/`), fixes #1446. Verified independently of the terra review: 1. **Mechanism confirmed.** Root `package.json` prepare = `node scripts/install-hooks.mjs`; the appservice builder copied manifests/packages/plugins but not `scripts/` before `RUN pnpm install --frozen-lockfile` — the prepare hook cannot resolve. The fix inserts the identical two-line pattern `gateway.Dockerfile:13-14` and `web.Dockerfile:11-12` already carry, at the same position (immediately before install). 2. **Red controls run by me (direct, no docker):** (A) the exact CI failure reproduced — `node scripts/install-hooks.mjs` in a manifests-only dir (old builder state) → `MODULE_NOT_FOUND … /scripts/install-hooks.mjs`, rc=1, byte-identical class to the quoted pipeline-2854 step failure; (B) with `scripts/` present (fixed builder state) and git absent from PATH (alpine builder reality, git never installed) → `git not found; skipping hook installation`, rc=0 — exactly the observed gateway-builder behavior the issue quotes; (C) the script's guard order verified by read: ENOENT-git check (line 79-84) precedes any husky invocation, so the builder path exits cleanly. Two intermediate control attempts that hit my own harness quirks (git resolvable from `sh` fallback PATH; fake-git returning 127 is a non-ENOENT failure, not absence) were discarded — the controls reported are the discriminating ones. 3. **Payload safety:** the COPY is builder-stage only; the runner copies exactly `/deploy/node_modules`, `/deploy/package.json`, `/app/apps/appservice/dist` (Dockerfile:23-25) — `scripts/` cannot enter the runner image. No `.dockerignore` exists (untracked or tracked) to exclude the copy. `scripts/install-hooks.mjs` exists at this head. 4. **CI evidence measured:** 2799 green; 2806 and 2854 both show `build-appservice → failure (exit 1)` in the publish workflow — content-independent across the two trees, as the issue states; `build-web → success` in the same pipelines isolates the defect to the appservice Dockerfile (web already had the COPY). Pipeline 2863 is running on this PR head at review time. Note: `build-gateway` also shows failure (exit 0) in 2806/2854 — not explained by this fix's absence (gateway has had the COPY since before 2799); if it persists after this lands, it is a separate issue and should be triaged separately, not folded into #1446. 5. **Gates at this head (fresh worktree):** `format:check` rc=0, `typecheck` rc=0 (45/45), `lint` rc=0 (25/25). Dockerfile-only diff; no code surface. CI note: 2863 running at review time — merge waits on 2863 terminal green including its build-appservice step, which is itself the fix's verification.

fred referenced this pull request

2026-08-27 04:06:30 +00:00

flaky: web guards.spec.tsx GuestGuard pending-session test times out under CI concurrency (blocks unrelated PRs) #1448

rev-code-01 referenced this pull request

2026-08-27 11:13:15 +00:00

fix(docker): copy scripts/ into appservice builder before pnpm install #1452

fred referenced this pull request

2026-08-27 11:30:30 +00:00

trunk image build red: appservice.Dockerfile misses COPY scripts/ before pnpm install (prepare hook MODULE_NOT_FOUND) #1451

fred referenced this pull request

2026-08-27 11:30:38 +00:00

trunk image builds broken: appservice Dockerfile missing COPY scripts/ (prepare fails), no green trunk pipeline since 2799 #1446