ConusAI vendor v0.1.0-dev.20261027+9b1131fb

test/dockerfile.test.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+// The image the three processes run from (spec §13). These are the properties a deployment
+// depends on, and each one has cost a deployment somewhere: a manifest the install stage does not
+// copy, a root process, a base image nobody pinned to the Node the app is written for.
+
+import { readdirSync, readFileSync } from "node:fs"
+import { describe, expect, it } from "vitest"
+import { parse } from "yaml"
+
+const dockerfile = readFileSync(new URL("../Dockerfile", import.meta.url), "utf8")
+const workspace = parse(readFileSync(new URL("../pnpm-workspace.yaml", import.meta.url), "utf8")) as {
+  minimumReleaseAgeExclude: string[]
+}
+
+describe("the Dockerfile", () => {
+  it("is multi-stage, with the runtime stage compose.yaml names", () => {
+    expect(dockerfile).toMatch(/^FROM node:24-slim AS deps$/m)
+    expect(dockerfile).toMatch(/^FROM deps AS build$/m)
+    expect(dockerfile).toMatch(/^FROM node:24-slim AS runtime$/m)
+  })
+
+  it("copies the manifest of every workspace package before installing", () => {
+    // The install stage resolves the whole workspace, so a package whose manifest is missing
+    // fails the install with "no package named @app/<id> is present in the workspace".
+    const packages = readdirSync(new URL("..", import.meta.url), { withFileTypes: true })
+    expect(packages.some((entry) => entry.name === "pnpm-workspace.yaml")).toBe(true)
+    for (const dir of ["config", "modules", "apps/web", "apps/worker"]) {
+      expect(dockerfile, `${dir}/package.json is not copied`).toContain(`COPY ${dir}/package.json ./${dir}/`)
+    }
+  })
+
+  it("runs as a user that owns none of the files it runs", () => {
+    expect(dockerfile).toMatch(/^USER node$/m)
+    expect(dockerfile).toContain("--chown=root:root")
+  })
+
+  it("takes the registry credential as a build secret, never as a layer or a build argument", () => {
+    // Two build paths deliver the same credential under two ids: a preset single-image build
+    // mounts it as `npmrc`, a compose build as `conusai_npmrc` (the platform prefixes its compose
+    // secrets so a tenant's own can never collide). The install must accept either — a
+    // deployment that built through the preset path got no credential at all and pnpm fell back
+    // to the public registry, where the vendor scopes 404 (stage, deployment 4, 2026-10-20).
+    expect(dockerfile).toContain("--mount=type=secret,id=conusai_npmrc,target=/run/secrets/conusai_npmrc")
+    expect(dockerfile).toContain("--mount=type=secret,id=npmrc,target=/run/secrets/npmrc")
+    expect(dockerfile).not.toMatch(/ARG .*(TOKEN|PASSWORD|SECRET)/)
+    expect(dockerfile).not.toMatch(/_authToken/)
+  })
+
+  it("excludes the vendor scopes from the release-age cooldown", () => {
+    // minimumReleaseAge blocks versions published in the last seven days — but every dev
+    // bundle publishes the vendor packages minutes before a deployment installs them, from
+    // the ConusAI vendor registry, so the cooldown must never apply to either scope
+    // (stage, deployment 5, 2026-10-20: ERR_PNPM_NO_MATURE_MATCHING_VERSION).
+    expect(workspace.minimumReleaseAgeExclude).toContain("@conusai-sdk/*")
+    expect(workspace.minimumReleaseAgeExclude).toContain("@conusai-kit/*")
+  })
+
+  it("starts no process by default: compose.yaml names the one each service runs", () => {
+    const cmd = dockerfile.match(/^CMD (.*)$/m)?.[1] ?? ""
+    expect(cmd).toContain("compose.yaml")
+    expect(cmd).not.toContain("next")
+  })
+})