mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 21:15:40 +00:00
pezkuwichain
27b4057bd4
Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
live tests run in CI (they need a live chain) — a mockable CI test subset is a
follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
react-router v7 open-redirect remains, deferred as a breaking major); backend tar
^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
files (mimari.txt, _scratch_credit_serok.mjs).
54 lines
2.5 KiB
Docker
54 lines
2.5 KiB
Docker
# pwap/web — Static SPA build for distribution.
|
|
# Build context is the pwap repo ROOT (not web/) because vite aliases like
|
|
# @pezkuwi/utils, @shared/* resolve to ../shared/* — both web/ and shared/
|
|
# must be in the build context.
|
|
# Stage 1: build with Node. Stage 2: pure dist/ in busybox (smallest possible
|
|
# attacker surface — no shell, no package manager, no node runtime).
|
|
# Tag the resulting image with the git SHA in CI so rollback is just
|
|
# "pull pwap-web:<old-sha>".
|
|
|
|
# ─── Stage 1: Build ────────────────────────────────────────────
|
|
FROM node:20-alpine AS builder
|
|
WORKDIR /build/web
|
|
|
|
# Copy package files first to leverage Docker layer cache when only src changes
|
|
COPY web/package.json web/package-lock.json ./
|
|
RUN npm ci
|
|
|
|
# Copy shared/ first (less frequently changed), then web/ source
|
|
COPY shared/ /build/shared/
|
|
COPY web/ /build/web/
|
|
|
|
# Build args for environment-specific values (passed from CI)
|
|
ARG VITE_NETWORK=MAINNET
|
|
ARG VITE_WS_ENDPOINT=wss://rpc.pezkuwichain.io
|
|
ARG VITE_WS_ENDPOINT_FALLBACK_1=wss://mainnet.pezkuwichain.io
|
|
ARG VITE_ASSET_HUB_ENDPOINT=wss://asset-hub-rpc.pezkuwichain.io
|
|
ARG VITE_PEOPLE_CHAIN_ENDPOINT=wss://people-rpc.pezkuwichain.io
|
|
ARG VITE_WALLETCONNECT_PROJECT_ID=8292a793b7640e8364c378e331e76d04
|
|
ARG VITE_SUPABASE_URL
|
|
ARG VITE_SUPABASE_ANON_KEY
|
|
|
|
ENV VITE_NETWORK=$VITE_NETWORK
|
|
ENV VITE_WS_ENDPOINT=$VITE_WS_ENDPOINT
|
|
ENV VITE_WS_ENDPOINT_FALLBACK_1=$VITE_WS_ENDPOINT_FALLBACK_1
|
|
ENV VITE_ASSET_HUB_ENDPOINT=$VITE_ASSET_HUB_ENDPOINT
|
|
ENV VITE_PEOPLE_CHAIN_ENDPOINT=$VITE_PEOPLE_CHAIN_ENDPOINT
|
|
ENV VITE_WALLETCONNECT_PROJECT_ID=$VITE_WALLETCONNECT_PROJECT_ID
|
|
ENV VITE_SUPABASE_URL=$VITE_SUPABASE_URL
|
|
ENV VITE_SUPABASE_ANON_KEY=$VITE_SUPABASE_ANON_KEY
|
|
|
|
RUN npm run build
|
|
|
|
# ─── Stage 2: Distribution image ───────────────────────────────
|
|
# busybox:musl gives us a tiny base (~1.5MB) with a shell for `cp` operations
|
|
# during deploy extraction, but no npm/curl/wget/ssh — minimal attack surface
|
|
# if the image were ever exposed.
|
|
FROM busybox:musl
|
|
WORKDIR /dist
|
|
COPY --from=builder /build/web/dist /dist
|
|
LABEL org.opencontainers.image.source="https://github.com/pezkuwichain/pwap"
|
|
LABEL org.opencontainers.image.description="pwap/web static SPA — Pezkuwi wallet/exchange frontend"
|
|
LABEL org.opencontainers.image.licenses="MIT"
|
|
CMD ["sh", "-c", "echo 'pwap-web image — extract /dist via: docker create + docker cp'; sleep infinity"]
|