Skip to content

fix(worker): fail the image build on a stale or missing lockfile #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrichr merged 1 commit into from
Aug 2, 2026
Merged

fix(worker): fail the image build on a stale or missing lockfile #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions apps/worker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,25 @@ RUN corepack enable && corepack prepare pnpm@9.15.0 --activate

WORKDIR /app

# Copy only what pnpm needs for dependency resolution (layer cache)
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* turbo.json ./
# Copy only what pnpm needs for dependency resolution (layer cache).
#
# `pnpm-lock.yaml` is copied WITHOUT a glob on purpose. The previous
# `pnpm-lock.yaml*` tolerated the file being absent, so a build with no
# lockfile at all still succeeded and resolved whatever was newest that day.
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml turbo.json ./
COPY packages/shared/package.json packages/shared/
COPY apps/worker/package.json apps/worker/

# Install all deps (including devDependencies needed for build)
RUN pnpm install --frozen-lockfile || pnpm install
# Install all deps (including devDependencies needed for build).
#
# No `|| pnpm install` fallback. That fallback silently defeated the lockfile:
# when the lockfile was stale or unreadable, `--frozen-lockfile` failed, the
# fallback re-resolved every dependency from scratch, and the build went green
# with a dependency set nobody had reviewed. The deployed image was therefore
# not reproducible from the commit it claimed to come from, and lockfile drift
# was invisible. Fail loudly instead: a stale lockfile is a change to make in
# the repository, not a thing for the release build to paper over.
RUN pnpm install --frozen-lockfile

# ---------------------------------------------------------------------------
# Stage 2: Build TypeScript
Expand Down
Loading