From aede0d3c2aa60a350ff9ec70b8c8da93cfccfd8c Mon Sep 17 00:00:00 2001 From: Thibault Le Ouay Ducasse Date: Mon, 19 Oct 2026 15:57:31 +0200 Subject: [PATCH] fix: address review comments and the doc-ref check - cite the side-car script by its repo path in apps/workflows/AGENTS.md - declare @types/node in every tsc-checked package that uses Node APIs - note that pnpm verify:test still needs Deno - drop ca-certificates from the server image: it reaches libSQL over HTTP Co-Authored-By: Claude Opus 5.5 --- CONTRIBUTING.md | 5 +- apps/server/Dockerfile | 2 +- apps/server/dofigen.lock | 78 ++++++++++++++--------------- apps/server/dofigen.yml | 6 +-- apps/server/package.json | 1 + apps/workflows/AGENTS.md | 2 +- apps/workflows/package.json | 1 + packages/api/package.json | 1 + packages/services/package.json | 1 + packages/subscriptions/package.json | 1 + packages/theme-store/package.json | 1 + pnpm-lock.yaml | 18 +++++++ 12 files changed, 71 insertions(+), 46 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2f33d2cfb..9146fe34c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -33,8 +33,9 @@ To contribute code changes, follow these steps: no database and takes seconds. `pnpm verify:test` runs the tests for the packages your diff touches; those do need a local libSQL server. - Note: `packages/test-utils` still type-checks with [Deno](https://deno.com/), - so `pnpm verify` needs it installed locally. + Note: tests still run on `deno test` and `packages/test-utils` still + type-checks with [Deno](https://deno.com/), so both `pnpm verify` and + `pnpm verify:test` need it installed locally. See the [Requirements](./README.md#requirements) list in the README for the full toolchain (Node.js, pnpm, Bun, Deno, Turso CLI). 4. Make commits with clear and descriptive messages. Each commit should have a single logical purpose. diff --git a/apps/server/Dockerfile b/apps/server/Dockerfile index 6efa3d688..62da251ac 100644 --- a/apps/server/Dockerfile +++ b/apps/server/Dockerfile @@ -98,7 +98,7 @@ COPY \ --link \ "/app/apps/server/dist" "/app/dist" USER 0:0 -RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* USER 1000:1000 EXPOSE 3000 HEALTHCHECK \ diff --git a/apps/server/dofigen.lock b/apps/server/dofigen.lock index 8884c6623..a9b3206b7 100644 --- a/apps/server/dofigen.lock +++ b/apps/server/dofigen.lock @@ -10,14 +10,43 @@ effective: | - /packages/api - /packages/integrations/vercel builders: + build: + fromImage: + path: node + digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 + label: + org.opencontainers.image.base.name: docker.io/node:26.8.1-slim + org.opencontainers.image.base.digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 + org.opencontainers.image.stage: build + workdir: /app/apps/server + env: + NODE_ENV: production + copy: + - paths: + - . + target: /app/ + - fromBuilder: install + paths: + - /app/node_modules + target: /app/node_modules + - fromBuilder: install + paths: + - /app/apps/server/node_modules + target: /app/apps/server/node_modules + - fromBuilder: install + paths: + - /app/packages + target: /app/packages + run: + - ./node_modules/.bin/tsdown install: fromImage: path: node digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 label: org.opencontainers.image.stage: install - org.opencontainers.image.base.name: docker.io/node:26.8.1-slim org.opencontainers.image.base.digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 + org.opencontainers.image.base.name: docker.io/node:26.8.1-slim workdir: /app/ run: - npm install -g corepack@0.36.0 @@ -98,47 +127,18 @@ effective: | source: packages/services/package.json - target: packages/importers/package.json source: packages/importers/package.json - build: - fromImage: - path: node - digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 - label: - org.opencontainers.image.base.name: docker.io/node:26.8.1-slim - org.opencontainers.image.stage: build - org.opencontainers.image.base.digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 - workdir: /app/apps/server - env: - NODE_ENV: production - copy: - - paths: - - . - target: /app/ - - fromBuilder: install - paths: - - /app/node_modules - target: /app/node_modules - - fromBuilder: install - paths: - - /app/apps/server/node_modules - target: /app/apps/server/node_modules - - fromBuilder: install - paths: - - /app/packages - target: /app/packages - run: - - ./node_modules/.bin/tsdown fromImage: path: node digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 label: - org.opencontainers.image.title: OpenStatus Server - io.dofigen.version: 2.8.0 - org.opencontainers.image.vendor: OpenStatus - org.opencontainers.image.base.digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 org.opencontainers.image.base.name: docker.io/node:26.8.1-slim + io.dofigen.version: 2.8.0 org.opencontainers.image.source: https://github.com/openstatusHQ/openstatus org.opencontainers.image.authors: OpenStatus Team + org.opencontainers.image.title: OpenStatus Server + org.opencontainers.image.vendor: OpenStatus org.opencontainers.image.description: REST API server with Hono framework for OpenStatus + org.opencontainers.image.base.digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 user: user: '1000' group: '1000' @@ -153,7 +153,7 @@ effective: | chmod: '555' root: run: - - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* + - apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* entrypoint: - node - /app/dist/serve.mjs @@ -173,7 +173,7 @@ images: digest: sha256:c0753125a3789977aefe869cbebccf70e3cfd7ea84ca48547458f02e4f1d7146 resources: dofigen.yml: - hash: bbc4228e0545edff425276e2d7dd7227943d003af4ae5bb30c89bc524275451c + hash: c879241ce1630e5039425ef4629d578946dff5df9fbda5474b96dcc57f6cc27b content: | # Files to exclude from Docker context ignore: @@ -261,13 +261,13 @@ resources: run: - ./node_modules/.bin/tsdown - # Runtime stage: Node plus curl (healthcheck) and the system CA store, which libsql's native - # TLS reads — Node's own fetch bundles its CAs, the addon does not. + # Runtime stage: Node plus curl for the healthcheck. No ca-certificates: the server talks to libSQL + # over HTTP (pure JS) and Node bundles its own CA store, so nothing reads the system one. fromImage: node:26.8.1-slim root: run: # One chained command: dofigen emits a heredoc RUN, which doesn't stop on a failed line - - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* + - apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* workdir: /app/ # Metadata labels diff --git a/apps/server/dofigen.yml b/apps/server/dofigen.yml index b87dc39bc..c233ddb14 100644 --- a/apps/server/dofigen.yml +++ b/apps/server/dofigen.yml @@ -84,13 +84,13 @@ builders: run: - ./node_modules/.bin/tsdown -# Runtime stage: Node plus curl (healthcheck) and the system CA store, which libsql's native -# TLS reads — Node's own fetch bundles its CAs, the addon does not. +# Runtime stage: Node plus curl for the healthcheck. No ca-certificates: the server talks to libSQL +# over HTTP (pure JS) and Node bundles its own CA store, so nothing reads the system one. fromImage: node:26.8.1-slim root: run: # One chained command: dofigen emits a heredoc RUN, which doesn't stop on a failed line - - apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* + - apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* workdir: /app/ # Metadata labels diff --git a/apps/server/package.json b/apps/server/package.json index 9193e3746..68be92d3b 100644 --- a/apps/server/package.json +++ b/apps/server/package.json @@ -90,6 +90,7 @@ "@std/expect": "jsr:^1.0.19", "@std/testing": "jsr:^1.0.19", "@std/yaml": "jsr:1.3.0", + "@types/node": "catalog:", "@types/validator": "catalog:", "dotenv": "catalog:", "tsdown": "catalog:", diff --git a/apps/workflows/AGENTS.md b/apps/workflows/AGENTS.md index 348103b1b..84da5983f 100644 --- a/apps/workflows/AGENTS.md +++ b/apps/workflows/AGENTS.md @@ -9,7 +9,7 @@ Constraints that follow from the build: - `@libsql/client`, `libsql` and `@google-cloud/tasks` stay external in `tsdown.config.ts` (native addon, CJS `__dirname` reads) and ship as a side-car `node_modules` in the image. A new dependency with either trait - joins that list and the `externals` in `scripts/sidecar-package.mjs`, which + joins that list and the `externals` in `apps/workflows/scripts/sidecar-package.mjs`, which writes the side-car's pinned `package.json`. - Tests run `deno test --parallel`, so test files share one process environment. Never drive a branch by assigning to `process.env` mid-test — diff --git a/apps/workflows/package.json b/apps/workflows/package.json index ca2361e4e..2c52a4e10 100644 --- a/apps/workflows/package.json +++ b/apps/workflows/package.json @@ -58,6 +58,7 @@ "@openstatus/test-utils": "workspace:*", "@openstatus/tsconfig": "workspace:*", "@oxc-node/core": "catalog:", + "@types/node": "catalog:", "tsdown": "catalog:", "typescript": "catalog:" } diff --git a/packages/api/package.json b/packages/api/package.json index d42aff56c..a94373caa 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -69,6 +69,7 @@ "@openstatus/tsconfig": "workspace:*", "@std/expect": "jsr:^1.0.19", "@std/testing": "jsr:^1.0.19", + "@types/node": "catalog:", "@types/react": "catalog:", "@types/react-dom": "catalog:", "typescript": "catalog:" diff --git a/packages/services/package.json b/packages/services/package.json index b32d43069..da014c1bc 100644 --- a/packages/services/package.json +++ b/packages/services/package.json @@ -178,6 +178,7 @@ "@openstatus/tsconfig": "workspace:*", "@std/expect": "jsr:^1.0.19", "@std/testing": "jsr:^1.0.19", + "@types/node": "catalog:", "typescript": "catalog:" } } diff --git a/packages/subscriptions/package.json b/packages/subscriptions/package.json index 734741695..d50647e2f 100644 --- a/packages/subscriptions/package.json +++ b/packages/subscriptions/package.json @@ -32,6 +32,7 @@ "@openstatus/tsconfig": "workspace:*", "@std/expect": "jsr:^1.0.19", "@std/testing": "jsr:^1.0.19", + "@types/node": "catalog:", "typescript": "catalog:" } } diff --git a/packages/theme-store/package.json b/packages/theme-store/package.json index 5b6b92cc7..b0c485e03 100644 --- a/packages/theme-store/package.json +++ b/packages/theme-store/package.json @@ -15,6 +15,7 @@ "@openstatus/tsconfig": "workspace:*", "@std/expect": "jsr:^1.0.19", "@std/testing": "jsr:^1.0.19", + "@types/node": "catalog:", "typescript": "catalog:" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d4184c5e0..a179dda09 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1264,6 +1264,9 @@ importers: '@std/yaml': specifier: jsr:1.3.0 version: '@jsr/std__yaml@1.3.0' + '@types/node': + specifier: 'catalog:' + version: 26.6.2 '@types/validator': specifier: 'catalog:' version: 13.15.10 @@ -1960,6 +1963,9 @@ importers: '@oxc-node/core': specifier: 'catalog:' version: 0.1.5 + '@types/node': + specifier: 'catalog:' + version: 26.6.2 tsdown: specifier: 'catalog:' version: 0.23.0(oxc-resolver@11.24.2)(tsx@4.23.15)(typescript@7.0.2) @@ -2173,6 +2179,9 @@ importers: '@std/testing': specifier: jsr:^1.0.19 version: '@jsr/std__testing@1.0.20' + '@types/node': + specifier: 'catalog:' + version: 26.6.2 '@types/react': specifier: 'catalog:' version: 19.3.0 @@ -2993,6 +3002,9 @@ importers: '@std/testing': specifier: jsr:^1.0.19 version: '@jsr/std__testing@1.0.20' + '@types/node': + specifier: 'catalog:' + version: 26.6.2 typescript: specifier: 'catalog:' version: 7.0.2 @@ -3055,6 +3067,9 @@ importers: '@std/testing': specifier: jsr:^1.0.19 version: '@jsr/std__testing@1.0.20' + '@types/node': + specifier: 'catalog:' + version: 26.6.2 typescript: specifier: 'catalog:' version: 7.0.2 @@ -3086,6 +3101,9 @@ importers: '@std/testing': specifier: jsr:^1.0.19 version: '@jsr/std__testing@1.0.20' + '@types/node': + specifier: 'catalog:' + version: 26.6.2 typescript: specifier: 'catalog:' version: 7.0.2 -- 2.54.0