@nathapp/na-cli 1.0.6 → 1.0.8

package/README.md

@@ -39,7 +39,7 @@ You can provide answers directly via command-line flags. If both `--template` an
     - `--k8s_chart_registry_host`: `aliyun`, `aws`, `dockerhub`, or `custom`.
     - `--k8s_image_name`: Full image name (default: `bitnami/kafka`).
     - `--k8s_image_version`: Version tag (default: `1.0.0`).
-    - `--k8s_chart_kind`: `Deployment`, `StatefulSet`, or `CronJob` (default: `Deployment`).
+    - `--k8s_chart_kind`: `Deployment`, `StatefulSet`, `CronJob`, or `Job` (default: `Deployment`). A generated `Job` chart runs as a `post-install,post-upgrade` Helm hook (a plain Job's pod template is immutable, so upgrades would fail). Switching it to `pre-install,pre-upgrade` (e.g. migrations before the app rolls out) only works if everything it references is created outside the chart (`fromKeyRef` secrets/config, an existing pull secret): pre-install hooks run before the release's own objects exist.
     - `--k8s_chart_registry_region`: (For Aliyun/AWS) default: `ap-southeast-3`.
     - `--k8s_chart_aws_account_id`: (For AWS) default: `123456789`.
 
@@ -61,6 +61,23 @@ The CLI understands the relationship between infrastructure projects and service
 
 This allows you to manage modular services within a master deployment project without manually navigating to sub-folders.
 
+#### Deployment defaults (`k8s-deployment` / `k8s-helm-chart`)
+
+- **Ingress**: Traefik (`className: traefik`, `web` entrypoint), no TLS in the chart. TLS is
+  expected to terminate upstream (e.g. Cloudflare Tunnel). Hosts are flat:
+  `{{SERVICE_BASE_NAME}}-<chart>.{{SERVICE_BASE_DOMAIN}}`, where `SERVICE_BASE_NAME` is the release name.
+- **TCP routing**: set `ingressRouteTCP` in a chart's values to render a Traefik `IngressRouteTCP`.
+- **Review apps**: merge requests run `make review`, deploying release `<project>-<branch-slug>`
+  with `test-values.yaml` into `REVIEW_KUBE_NAMESPACE` (default `<CI_KUBE_NAMESPACE>-review`,
+  never the production namespace). Names over 30 chars become `<first 24>-<5-digit cksum>`.
+  GitLab stops it via `stop-review` when the MR is merged or closed, or after one week.
+  Review apps run branch code with cluster access: scope `KUBECONFIG` per environment
+  (`production` = protected credential, `review/*` = credential limited to the review namespace).
+- **CI image**: `HELM_CI_IMAGE` (default `alpine/helm:3.22.0`). Pin deploy jobs to a runner that
+  can reach the cluster with `default.tags`.
+- **Lint**: `make lint` render-checks both releases with `helm template` against `values.yaml`
+  and `test-values.yaml`.
+
 ---
 
 ### 3. Environment Variable Conversion
@@ -86,9 +103,18 @@ na yml-env -i config.yaml -o .env
 ## Available Templates
 The CLI currently supports the following project types:
 - `db-schema`: Database migration and schema projects.
-- `k8s-deployment`: Basic Kubernetes manifests.
+- `k8s-deployment`: Umbrella Helm deployment project (resources + services releases, GitLab CI with review apps).
 - `k8s-helm-chart`: Comprehensive Helm chart bootstrapping.
 - `mxw-base-api-express`: Express-based API boilerplate.
 - `ts-library`: TypeScript library project.
 - `nestjs-api`: Professional NestJS setup with platform choices.
 - `vuexy-portal`: Frontend portal based on the Vuexy template.
+
+---
+
+## Development
+
+```bash
+bun install
+bun run test     # builds dist/, then runs test/ (helm-dependent tests skip when helm is absent)
+```

package/bunfig.toml

@@ -0,0 +1,3 @@
+[test]
+# Only run the CLI tests; templates/ and dist/templates/ contain sample test suites.
+root = "./test"

package/dist/templates/k8s-deployment/.gitignore-rename

@@ -1 +1,3 @@
 .DS_Store
+/charts/
+_env.yaml

package/dist/templates/k8s-deployment/resources/charts/mysql/charts/mysql-install/values.yaml

@@ -1,4 +1,4 @@
-enabled: true
+enabled: false
 kind: Job
 
 annotations:

package/dist/templates/k8s-deployment/resources/charts/mysql/values.yaml

@@ -4,12 +4,16 @@ kind: StatefulSet
 replicaCount: 1
 image:
   repository: mysql
-  tag: "5.7.31"
+  tag: "8.4"
   pullPolicy: IfNotPresent
 
 service:
   type: ClusterIP
   port: 3306
 
+# MySQL 8.4 notes: the container refuses to start with an empty root password, so set it
+# (from a CI variable, never committed); mysql_native_password is off by default, so old
+# clients need `mysql-native-password=ON` under [mysqld] in a mounted mysql.cnf (config +
+# volumeMounts); a 5.7 data volume cannot be opened by 8.4 directly (upgrade via 8.0).
 secret:
   MYSQL_ROOT_PASSWORD: ""

package/dist/templates/k8s-deployment/resources/charts/redis/values.yaml

@@ -4,7 +4,7 @@ kind: StatefulSet
 replicaCount: 1
 image:
   repository: redis
-  tag: "6.0.8-alpine"
+  tag: "7.4-alpine"
   pullPolicy: IfNotPresent
 
 service:

package/dist/templates/k8s-deployment/services/charts/hooks/charts/pre-delete-rsc/values.yaml

@@ -8,7 +8,7 @@ annotations:
 
 image:
   repository: alpine/helm
-  tag: "3.3.4"
+  tag: "3.22.0"
   pullPolicy: IfNotPresent
 
 restartPolicy: Never

package/dist/templates/k8s-deployment/services/charts/sample-nginx/templates/ingressroutetcp.yaml

@@ -0,0 +1 @@
+{{- include "root.ingressroutetcp" $ }}

package/dist/templates/k8s-deployment/services/charts/sample-nginx/values.yaml

@@ -28,16 +28,14 @@ service:
   port: 80
 
 ingress:
+  className: "traefik"
   annotations:
-   nginx.ingress.kubernetes.io/ssl-redirect: "true"
-   nginx.ingress.kubernetes.io/rewrite-target: /$1
+    traefik.ingress.kubernetes.io/router.entrypoints: web
   hosts:
-   - host: www.sample.com
-     paths: ["/api/?(.*)"]
-  tls:
-   - secretName: SERVICE_BASE_DOMAIN_CERT
-     hosts:
-       - www.sample.com
+    - host: "{{SERVICE_BASE_NAME}}-sample.{{SERVICE_BASE_DOMAIN}}"
+      paths:
+        - path: "/"
+          pathType: "Prefix"
 
 readinessProbe:
   httpGet:

package/dist/templates/k8s-deployment/templates/_cronjob.tpl

@@ -217,7 +217,7 @@ spec:
                 claimName: {{ include (print $.Chart.Name ".fullname") $ }}-{{ .claimName }}
                 {{- end }}
               {{- else }}
-                {{- toYaml . | nindent 12 }}
+            - {{ toYaml . | nindent 14 | trim }}
               {{- end }}
             {{- end }}
           {{- end }}

package/dist/templates/k8s-deployment/templates/_deployment.tpl

@@ -238,9 +238,9 @@ spec:
             claimName: {{ include (print $.Chart.Name ".fullname") $ }}-{{ .claimName }}
             {{- end }}
           {{- else }}
-            {{- toYaml . | nindent 8 }}
+        - {{ toYaml . | nindent 10 | trim }}
           {{- end }}
         {{- end }}
       {{- end }}
 {{- end }}
-{{- end }}
+{{- end }}

package/dist/templates/k8s-deployment/templates/_ingressroutetcp.tpl

@@ -0,0 +1,135 @@
+{{- define "root.ingressroutetcp" -}}
+{{- if and .Values.enabled .Values.ingressRouteTCP -}}
+{{- $fullName := include (print $.Chart.Name ".fullname") . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: {{ .Values.ingressRouteTCP.name | default (printf "%s-tcp" $fullName) }}
+  {{- if .Values.ingressRouteTCP.annotations }}
+  annotations:
+    {{- with .Values.ingressRouteTCP.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  labels:
+    {{- include (print $.Chart.Name ".labels") . | nindent 4 }}
+spec:
+  {{- if .Values.ingressRouteTCP.entryPoints }}
+  entryPoints:
+    {{- range .Values.ingressRouteTCP.entryPoints }}
+    - {{ include "root.global" (list $ .) }}
+    {{- end }}
+  {{- end }}
+  routes:
+    {{- if .Values.ingressRouteTCP.routes }}
+      {{- range $routeIndex, $route := .Values.ingressRouteTCP.routes }}
+    - match: {{ include "root.global" (list $ $route.match) }}
+      {{- if $route.priority }}
+      priority: {{ $route.priority }}
+      {{- end }}
+      {{- if $route.middlewares }}
+      middlewares:
+        {{- range $route.middlewares }}
+        - name: {{ include "root.global" (list $ .name) }}
+          {{- if .namespace }}
+          namespace: {{ include "root.global" (list $ .namespace) }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $route.services }}
+      services:
+        {{- range $route.services }}
+        - name: {{ include "root.global" (list $ .name) | default $fullName }}
+          {{- if .namespace }}
+          namespace: {{ include "root.global" (list $ .namespace) }}
+          {{- end }}
+          {{- if .port }}
+          port: {{ .port }}
+          {{- else if $svcPort }}
+          port: {{ $svcPort }}
+          {{- end }}
+          {{- if .weight }}
+          weight: {{ .weight }}
+          {{- end }}
+          {{- if .terminationDelay }}
+          terminationDelay: {{ .terminationDelay }}
+          {{- end }}
+          {{- if .proxyProtocol }}
+          proxyProtocol:
+            version: {{ .proxyProtocol.version }}
+          {{- end }}
+          {{- if .serversTransport }}
+          serversTransport: {{ include "root.global" (list $ .serversTransport) }}
+          nativeLB: {{ .nativeLB | default false }}
+          nodePortLB: {{ .nodePortLB | default false }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- end }}
+    {{- end }}
+    {{- if .Values.ingressRouteTCP.host }}
+    - match: HostSNI(`{{ include "root.global" (list . .Values.ingressRouteTCP.host) }}`)
+      {{- if .Values.ingressRouteTCP.middlewares }}
+      middlewares:
+        {{- range .Values.ingressRouteTCP.middlewares }}
+        - name: {{ include "root.global" (list $ .name) }}
+          {{- if .namespace }}
+          namespace: {{ include "root.global" (list $ .namespace) }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      services:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+          {{- if .Values.ingressRouteTCP.terminationDelay }}
+          terminationDelay: {{ .Values.ingressRouteTCP.terminationDelay }}
+          {{- end }}
+          {{- if .Values.ingressRouteTCP.proxyProtocol }}
+          proxyProtocol:
+            version: {{ .Values.ingressRouteTCP.proxyProtocol.version }}
+          {{- end }}
+          {{- if .Values.ingressRouteTCP.serversTransport }}
+          serversTransport: {{ include "root.global" (list . .Values.ingressRouteTCP.serversTransport) }}
+          {{- end }}
+          nativeLB: {{ .Values.ingressRouteTCP.nativeLB | default false }}
+          nodePortLB: {{ .Values.ingressRouteTCP.nodePortLB | default false }}
+    {{- end }}
+  {{- if .Values.ingressRouteTCP.tls }}
+  tls:
+    {{- with .Values.ingressRouteTCP.tls }}
+    {{- if .secretName }}
+    secretName: {{ include "root.global" (list $ .secretName) }}
+    {{- end }}
+    {{- if .options }}
+    options:
+      name: {{ include "root.global" (list $ .options.name) }}
+      {{- if .options.namespace }}
+      namespace: {{ include "root.global" (list $ .options.namespace) }}
+      {{- end }}
+    {{- end }}
+    {{- if .certResolver }}
+    certResolver: {{ include "root.global" (list $ .certResolver) }}
+    {{- end }}
+    {{- if .domains }}
+    domains:
+      {{- range .domains }}
+      - main: {{ include "root.global" (list $ .main) }}
+        {{- if .sans }}
+        sans:
+          {{- range .sans }}
+          - {{ include "root.global" (list $ .) }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+    {{- if .store }}
+    store: {{ include "root.global" (list $ .store) }}
+    {{- end }}
+    {{- if .passthrough }}
+    passthrough: {{ .passthrough }}
+    {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}

package/dist/templates/k8s-deployment/templates/_job.tpl

@@ -225,7 +225,7 @@ spec:
             claimName: {{ include (print $.Chart.Name ".fullname") $ }}-{{ .claimName }}
             {{- end }}
           {{- else }}
-            {{- toYaml . | nindent 8 }}
+        - {{ toYaml . | nindent 10 | trim }}
           {{- end }}
         {{- end }}
       {{- end }}

package/dist/templates/k8s-deployment/templates/_pod.tpl

@@ -206,9 +206,9 @@ spec:
         claimName: {{ include (print $.Chart.Name ".fullname") $ }}-{{ .claimName }}
         {{- end }}
       {{- else }}
-        {{- toYaml . | nindent 4 }}
+    - {{ toYaml . | nindent 6 | trim }}
       {{- end }}
     {{- end }}
   {{- end }}
 {{- end }}
-{{- end }}
+{{- end }}

package/dist/templates/k8s-deployment/templates/_statefulset.tpl

@@ -236,9 +236,9 @@ spec:
             claimName: {{ include (print $.Chart.Name ".fullname") $ }}-{{ .claimName }}
             {{- end }}
           {{- else }}
-            {{- toYaml . | nindent 8 }}
+        - {{ toYaml . | nindent 10 | trim }}
           {{- end }}
         {{- end }}
       {{- end }}
 {{- end }}
-{{- end }}
+{{- end }}

package/dist/templates/k8s-deployment/templates/root-pull-secret.yaml

@@ -1,11 +1,13 @@
-{{- if .Values.global.secret.pull }}
+{{- /* global.secret may be absent, null or "" */ -}}
+{{- $pull := ((.Values.global | default dict).secret | default dict).pull }}
+{{- if $pull }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ print $.Release.Name "-pull" }}
 type: kubernetes.io/dockerconfigjson
 data:
-  {{- with .Values.global.secret.pull }}
+  {{- with $pull }}
   .dockerconfigjson: {{ .auth | b64enc | printf "{\"auths\":{\"%s\":{\"auth\":\"%s\"}}}" .host | b64enc }}
   {{- end }}
 {{- end }}

package/dist/templates/k8s-deployment/templates/root-secret.yaml

@@ -1,11 +1,13 @@
-{{- if .Values.global.secret.root }}
+{{- /* global.secret may be absent, null or "" */ -}}
+{{- $root := ((.Values.global | default dict).secret | default dict).root }}
+{{- if $root }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ print $.Release.Name "-root" }}
 type: Opaque
 data:
-  {{- with .Values.global.secret.root }}
+  {{- with $root }}
     {{- range $key, $value := . }}
       {{- $key | nindent 2 }}{{- ": " -}}
       {{- if eq (typeOf $value) "string" -}}

package/dist/templates/k8s-deployment/test-values.yaml

@@ -0,0 +1,10 @@
+# Values for non-default-branch releases (merge request review apps).
+# Layered on top of the chart's values.yaml by `make run-install` / `make review`.
+#
+# The release name is <project>-<branch-slug>, so each review app already gets its
+# own hosts: <project>-<branch-slug>-<service>.<SERVICE_BASE_DOMAIN>
+# Keep SERVICE_BASE_DOMAIN the Cloudflare zone itself (one label deep): the free
+# Universal SSL wildcard does not cover *.sub.example.com.
+global:
+  root:
+    SERVICE_BASE_DOMAIN: "example.com"

package/dist/templates/k8s-deployment/values.yaml

@@ -29,7 +29,7 @@ global:
   root:
     SERVICE_DOMAIN: "WKS"
     SERVICE_BASE_SCHEMA: "https"
-    SERVICE_BASE_DOMAIN: "api.example.com"
+    SERVICE_BASE_DOMAIN: "example.com"
     SERVICE_BASE_DOMAIN_CERT: "ssl-example.com"       
     MYSQL_BASE_SCHEMA: "mysql"
     MYSQL_BASE_DATABASE: "dev"

package/dist/templates/k8s-helm-chart/templates/ingressroutetcp.yaml

@@ -0,0 +1 @@
+{{- include "root.ingressroutetcp" $ }}

package/dist/templates/k8s-helm-chart/templates/job.yaml

@@ -0,0 +1 @@
+{{- include "root.job" $ }}

package/dist/templates/k8s-helm-chart/values.yaml

@@ -1,6 +1,19 @@
 enabled: true
 kind: <%= chartKind %>
-replicaCount: 1
+<% if (chartKind === 'Job') { %>
+# A Job's pod template is immutable, so a plain Job fails any `helm upgrade` that changes it
+# (e.g. a new image tag). As a Helm hook it is recreated on every install/upgrade instead.
+# post-install/post-upgrade runs after this release's own Secret, ConfigMap, ServiceAccount
+# and pull secret exist. pre-install/pre-upgrade (e.g. DB migrations before the new app rolls
+# out) runs BEFORE them on the first install, so then every reference must be external:
+# secret/config entries via fromKeyRef, an existing imagePullSecrets name, and volumes from
+# objects created outside the chart.
+annotations:
+  helm.sh/hook: post-install,post-upgrade
+  helm.sh/hook-weight: "0"
+  helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+restartPolicy: Never
+<% } %>replicaCount: 1
 image:
   repository: <%= containerRegistry %>
   tag: "<%= containerVersion %>"
@@ -8,28 +21,121 @@ image:
 
 imagePullSecrets: "{{Release.Name}}-pull"
 
+# Plain values, injected as env:
+# env:
+#   NODE_ENV: "production"
+# ConfigMap entries (also injected as env); a value may reference an external ConfigMap:
+# config:
+#   LOG_LEVEL: "info"
+#   DB_NAME:
+#     fromKeyRef: "master-db-config"
+# Secret entries (also injected as env). Never commit real values here: reference an
+# existing Secret, or pass them from CI variables.
+# secret:
+#   DATABASE_URL:
+#     fromKeyRef: "<%= chartName %>-db"
+
+# Overrides the image command, wrapped in /bin/sh -c:
+# beforeScript:
+#   - "echo starting"
+# script:
+#   - "node dist/main.js"
+
+# initContainers:
+#   - name: volume-permissions
+#     image: busybox:1.36
+#     command: ["sh", "-c", "chown 1000:1000 /data"]
+#     volumeMounts:
+#       - name: data-storage
+#         mountPath: /data
+
+# securityContext:
+#   runAsUser: 1000
+#   runAsGroup: 3000
+#   fsGroup: 2000
+
+# Set requests on anything that runs as a review app, so previews cannot starve the cluster.
+# resources:
+#   requests:
+#     cpu: 50m
+#     memory: 128Mi
+#   limits:
+#     memory: 512Mi
+
 service:
   type: ClusterIP
   port: 80
   targetPort: 80
+  # Extra ports (e.g. SMTP next to a web UI):
+  # ports:
+  #   - port: 2500
+  #     name: smtp
+  # Proxy to a host outside the cluster instead of pods:
+  # type: ExternalName
+  # externalName: 10.0.0.10
 
+# TLS terminates at the Cloudflare edge and reaches Traefik over the tunnel as plain
+# HTTP, so no tls block by default. The host is flat (one label under the base domain)
+# to stay inside Cloudflare's one-level Universal SSL wildcard; SERVICE_BASE_NAME is the
+# release name, which differs per branch (at most 30 chars, so keep chart names to 32
+# chars or less to stay under the 63-char DNS label limit).
+# For direct exposure with cert-manager, use the websecure entrypoint and add:
+#   tls:
+#     - secretName: SERVICE_BASE_DOMAIN_CERT
+#       hosts:
+#         - "{{SERVICE_BASE_NAME}}-<%= chartName %>.{{SERVICE_BASE_DOMAIN}}"
 ingress:
-  className: "nginx"
+  className: "traefik"
   annotations:
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/rewrite-target: /$1
-    nginx.ingress.kubernetes.io/use-gzip: "true"
-    nginx.ingress.kubernetes.io/gzip-min-length: "20"
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    # Attach Traefik middlewares (<namespace>-<name>@kubernetescrd), e.g. a noindex header:
+    # traefik.ingress.kubernetes.io/router.middlewares: "default-noindex-headers@kubernetescrd"
+    # Backend speaks HTTPS:
+    # traefik.ingress.kubernetes.io/service.serversscheme: https
 
   hosts:
-    - host: www.example.com
+    - host: "{{SERVICE_BASE_NAME}}-<%= chartName %>.{{SERVICE_BASE_DOMAIN}}"
       paths:
-        - path: "/?(.*)"
-          pathType: "ImplementationSpecific"
-  tls:
-    - secretName: SERVICE_BASE_DOMAIN_CERT
-      hosts:
-        - SERVICE_BASE_DOMAIN
+        - path: "/"
+          pathType: "Prefix"
+
+# Traefik IngressRoute instead of Ingress (multiple routes, priorities, cross-namespace
+# services such as an auth outpost). Disable `ingress` when using it.
+# ingressRoute:
+#   entryPoints:
+#     - web
+#   routes:
+#     - match: Host(`{{SERVICE_BASE_NAME}}-<%= chartName %>.{{SERVICE_BASE_DOMAIN}}`)
+#       kind: Rule
+#       priority: 10
+#       services:
+#         - port: 80
+#           # scheme: https
+#           # serversTransport: "{{Release.Name}}-<%= chartName %>-transport"
+#       # middlewares:
+#       #   - name: noindex-headers
+#       #     namespace: default
+
+# Backend transport for ingressRoute services (e.g. self-signed HTTPS upstream).
+# Default name: <release>-<chart>-transport.
+# serversTransport:
+#   insecureSkipVerify: true
+
+# A Traefik Middleware owned by this chart. Default name: <release>-<chart>.
+# middleware:
+#   headers:
+#     customResponseHeaders:
+#       X-Robots-Tag: "noindex, nofollow"
+
+# Raw TCP routing through Traefik (databases, brokers), matched by SNI. SNI only exists
+# inside TLS, so a named host needs `tls` (passthrough, or Traefik terminating); without
+# TLS only the catch-all HostSNI(`*`) matches.
+# ingressRouteTCP:
+#   entryPoints:
+#     - websecure
+#   host: "{{SERVICE_BASE_NAME}}-<%= chartName %>-tcp.{{SERVICE_BASE_DOMAIN}}"
+#   tls:
+#     passthrough: true
 
 readinessProbe:
   httpGet:
@@ -37,3 +143,11 @@ readinessProbe:
     port: 80
   initialDelaySeconds: 10
   periodSeconds: 5
+
+# volumeMounts:
+#   - name: data-storage
+#     mountPath: /data
+# volumes:
+#   - name: data-storage
+#     persistentVolumeClaim:
+#       claimName: "{{Release.Name}}-<%= chartName %>"

package/dist/templates/nestjs-api/.gitignore-rename

@@ -16,6 +16,7 @@ lerna-debug.log*
 
 # Tests
 /coverage
+*.tsbuildinfo
 /.nyc_output
 
 # IDEs and editors

package/dist/templates/nestjs-api/.oxlintrc.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "oxc"],
+  "categories": {
+    "correctness": "error"
+  },
+  "env": {
+    "node": true,
+    "es2022": true,
+    "vitest": true
+  },
+  "ignorePatterns": ["dist/", "node_modules/", "coverage/", ".turbo/"],
+  "rules": {
+    "typescript/no-explicit-any": "off",
+    "typescript/explicit-module-boundary-types": "off",
+    "no-unused-vars": "off"
+  }
+}

package/dist/templates/nestjs-api/Dockerfile

@@ -1,39 +1,33 @@
-## this is a multi-stage build dockerfile optimized for kaniko cache
+## multi-stage build optimized for kaniko cache
+## keep the bun image version in step with `packageManager`: bun.lock is versioned per bun release
 FROM nathapp/apline-jq:3.18 AS deps
 
 # https://stackoverflow.com/a/58487433
-# To prevent cache invalidation from changes in fields other than dependencies
+# Strip the version so a release bump does not invalidate the dependency layers
+COPY package.json /tmp/
+RUN jq '{ name, dependencies, devDependencies, scripts, packageManager }' < /tmp/package.json > /tmp/deps.json
 
-COPY package.json package-lock.json /tmp/
 
-RUN jq '{ name, dependencies, devDependencies, scripts }' < /tmp/package.json > /tmp/deps.json
-RUN jq '{ name, lockfileVersion, requires, packages, dependencies }' < /tmp/package-lock.json > /tmp/deps-lock.json
-
-
-FROM nathapp/node-bun:22.21.0-1.2.23-alpine AS builder
+FROM nathapp/node-bun:24.22.0-1.4.3-alpine-builder AS builder
 WORKDIR /app/
 
 COPY --from=deps /tmp/deps.json ./package.json
-COPY --from=deps /tmp/deps-lock.json ./package-lock.json
-
-ADD ./bun.lockb ./tsconfig.json ./tsconfig.build.json ./nest-cli.json /app/
+COPY bun.lock ./
 
 ## install dependencies first
-RUN bun install --freeze-lockfile
-ADD ./src /app/src
-#COPY . .
+RUN bun install --frozen-lockfile
+COPY tsconfig.json tsconfig.build.json nest-cli.json ./
+COPY src ./src
 RUN bun run build
 
 
-FROM nathapp/node-bun:22.21.0-1.2.23-alpine
+FROM nathapp/node-bun:24.22.0-1.4.3-alpine
 WORKDIR /app/
 
-COPY bun.lockb ./
 COPY --from=deps /tmp/deps.json ./package.json
-COPY --from=deps /tmp/deps-lock.json ./package-lock.json
-
-RUN bun install --freeze-lockfile --production
+COPY bun.lock ./
+RUN bun install --frozen-lockfile --production --ignore-scripts
 
 COPY --from=builder /app/dist /app/dist
-COPY package*.json ./
-CMD ["bun", "run", "start:prod"]
+COPY package.json ./
+CMD ["bun", "run", "start:prod"]