From eb1d627096053fa3acac0576b9f66ba7d6017493 Mon Sep 17 00:00:00 2001 From: Anso Date: Tue, 28 Apr 2026 02:35:50 -0400 Subject: [PATCH] perf(docker): switch builder stages to npm ci (#822) Both frontend-builder and backend-builder ran `npm install` even though `prod-deps` already used `npm ci`. `npm install` walks the dep graph and silently rewrites the lockfile when there is drift, which costs build time and lets a stale lockfile slip into a release image. `npm ci` enforces the lockfile, fails fast on drift, and skips the resolution work since the dep tree is fully described by the lockfile. Both lockfiles are in sync (verified with `npm install --package-lock-only` reporting "up to date"), so the change is a pure tightening with no behavior delta in the happy path. --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 948b6929..9aa5b8ab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ WORKDIR /app/frontend COPY frontend/package*.json frontend/.npmrc ./ RUN npm config set fetch-retry-maxtimeout 120000 && \ npm config set fetch-retries 5 && \ - npm install + npm ci COPY frontend/ ./ # vite.config.ts reads the root package.json for the app version @@ -31,7 +31,7 @@ RUN apk add --no-cache python3 make g++ COPY backend/package*.json backend/.npmrc ./ RUN npm config set fetch-retry-maxtimeout 120000 && \ npm config set fetch-retries 5 && \ - npm install + npm ci COPY backend/ ./ # prebuild hook (generate-version.js) reads the root package.json for the app version