@deployfoundation/foundation-deploy 0.2.50 → 0.2.51

package/agent-image/Dockerfile

@@ -20,6 +20,8 @@
 #     playwright-core 1.63.0 (exact pins + frozen lockfile in
 #     packages/infra/agent-image/open-slide/), whose Chrome Headless Shell
 #     build is pinned by the playwright-core version
+#   - Node.js 24.22.1 (LTS) with npm, and pnpm through corepack, for the
+#     repositories the agent clones and tests (see the node-provider stage)
 #
 # Secrets bootstrap: the container receives ONE pointer env var,
 # RUNTIME_SECRET_ID. At start, server.ts fetches that JSON secret from Secrets
@@ -40,6 +42,9 @@ ARG GH_VERSION=2.97.0
 # no ECR access; a deploy pipeline can override it with a mirrored tag to stay
 # clear of Docker Hub's anonymous rate limit.
 ARG BUN_IMAGE=oven/bun:1.4.0-slim
+# NODE_IMAGE: where the real Node.js comes from (node-provider stage). AWS's
+# mirror of the Docker official image, like golang below.
+ARG NODE_IMAGE=public.ecr.aws/docker/library/node:24.22.1-trixie-slim
 # GH_IMAGE: where the gh BINARY comes from. The default names the `gh-source`
 # stage below, so a local build compiles it; an override points at a prebuilt
 # image, and under BuildKit an unreferenced stage never runs — which takes the
@@ -129,6 +134,15 @@ COPY skills/slides/export_deck.mjs skills/slides/starter.tsx ./
 # below is what makes the choice load-bearing.
 FROM ${GH_IMAGE} AS gh-provider
 
+# --- Node.js (repositories the agent works in) -------------------------------
+# The bun base ships only Bun's `node` shim (/usr/local/bun-node-fallback-bin),
+# which refuses real Node invocations ("Missing script to execute"). Turns in a
+# Node repository then began by downloading and unpacking a Node tarball before
+# they could typecheck or test anything (Olivia, every PR turn, 2026-10). The
+# runtime stage copies the official build's binary and its bundled npm and
+# corepack from here; nothing else from this image is used.
+FROM ${NODE_IMAGE} AS node-provider
+
 # --- runtime ----------------------------------------------------------------
 FROM ${BUN_IMAGE}
 
@@ -142,8 +156,12 @@ ARG FOUNDATION_GITHUB_APP_ID=0
 # credential probe checks — without this pointer the omp Bedrock provider
 # refuses with "No API key found". The real IMDS control is the tool policy
 # denying 169.254.169.254, not an env var a raw curl could ignore.
+#
+# No NODE_ENV=production: nothing in Foundation reads it (the install below
+# passes --production itself), and the agent's shell inherits the container
+# env, so `pnpm install` and `npm install` in a cloned repository skipped its
+# devDependencies and every typecheck or test then failed on missing modules.
 ENV AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 \
-    NODE_ENV=production \
     PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     # omp env sheet: relocate the agent base to the baked container dir
@@ -239,6 +257,23 @@ RUN chmod 0755 /opt/sky/bin/export_deck
 ENV OPEN_SLIDE_HOME=/opt/open-slide \
     PLAYWRIGHT_BROWSERS_PATH=/opt/open-slide/browsers
 
+# --- Node.js, npm and pnpm (node-provider stage) -----------------------------
+# /usr/local/bin precedes the bun base's fallback directory on PATH, so `node`
+# is the real binary from here on; the build fails if it is not. pnpm is a
+# corepack shim: it runs the version a repository's `packageManager` names,
+# fetched on first use into the runtime user's cache, so no repository's pin is
+# baked into the product. The prompt corepack shows before that fetch would
+# stall a non-interactive shell.
+COPY --from=node-provider /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-provider /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+    && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack \
+    && corepack enable --install-directory /usr/local/bin pnpm \
+    && test "$(command -v node)" = /usr/local/bin/node \
+    && node --version && npm --version && corepack --version
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
 # /opt/sky/bin FIRST so `gh` and `aws` resolve to the wrappers, never the real
 # binaries.
 ENV PATH="/opt/sky/bin:${PATH}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.50",
+  "version": "0.2.51",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,