a3ac273b90
GitLeaks: 8 false-positives на vgrf_ru (IndexNow public key + legacy WP plugin code) — добавлен .gitleaks.toml с allowlist: - public/<32hex>.txt + корневой <32hex>.txt (IndexNow validation files) - wp-content/** (legacy WordPress plugin code, не настоящие секреты) - const KEY = '<32hex>' паттерн Hadolint DL4006: добавлен SHELL pipefail в начале каждой stage. npm audit: убран из Dockerfile (там кэшировался Docker layer'ом и по факту не запускался при unchanged package-lock.json). Вынесен в .gitea/workflows/security.yml как отдельный job — каждый push, реально. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
25 lines
843 B
Docker
25 lines
843 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ─── Stage 1: build static site (Astro SSG) ────────────────────────────────
|
|
FROM node:22-alpine AS build
|
|
WORKDIR /app
|
|
SHELL ["/bin/sh", "-o", "pipefail", "-c"]
|
|
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm install --no-audit --no-fund
|
|
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# ─── Stage 2: nginx runtime ─────────────────────────────────────────────────
|
|
FROM nginx:1.29-alpine
|
|
|
|
RUN rm -rf /usr/share/nginx/html/*
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
EXPOSE 80
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD wget -q --spider http://127.0.0.1/ || exit 1
|