mirror of
https://github.com/pezkuwichain/pezkuwi-subquery.git
synced 2026-10-20 18:56:24 +00:00
Satoshi Qazi Muhammed
01a4903337
@pezkuwi/rpc-provider lists @bizinikiwi/connect as an optional dependency, so npm installed it, with smoldot, into both images. Both are GPL-3.0, and the bots never load them: they reach the chains over WsProvider. The images now install with --omit=optional; with that install both bots load and read the relay, Asset Hub and People chains. The lockfiles still list the packages, so Dependency Review, which denies GPL-3.0, flagged them on the new payout-bot lockfile (the noter's had them before). It allows exactly those three packages, and the bots job fails if an image contains @bizinikiwi or smoldot, so the allowance cannot outlive the reason for it.
16 lines
505 B
Docker
16 lines
505 B
Docker
FROM node:24-alpine
|
|
|
|
WORKDIR /app
|
|
|
|
# Install exactly what package-lock.json records, so the image runs the
|
|
# versions that were reviewed and tested rather than whatever the ranges
|
|
# resolve to on the day it is built. The optional dependencies are the light
|
|
# client (@bizinikiwi/connect, smoldot), which the bot never loads: it talks to
|
|
# the chains over WsProvider.
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --omit=dev --omit=optional --no-audit --no-fund
|
|
|
|
COPY bot.js ./
|
|
|
|
CMD ["node", "bot.js"]
|