@sidebase/base-config 0.2.0 → 0.2.1

package/presets/nuxt-app/Dockerfile

@@ -5,24 +5,22 @@ ARG PNPM_VERSION=${PNPM_VERSION}
 # --- BUILD STAGE ---
 FROM $NODE_VERSION AS production-base
 
-# A pre-`FROM` ARG is visible only to `FROM`. Re-declare it bare to inherit the
-# global value inside this stage, or $PNPM_VERSION expands to empty below.
+# A pre-`FROM` ARG is visible only to `FROM`. Re-declare it bare here, or
+# $PNPM_VERSION expands to empty below and pnpm installs at latest.
 ARG PNPM_VERSION
 
 WORKDIR /app
 
-# Installed directly rather than through corepack: Node 25 no longer bundles
-# corepack, and `versions.node` declares no ceiling. npm's global bin is already
-# on PATH, so no PNPM_HOME wiring is needed.
+# Not corepack: Node 25 no longer bundles it. npm's global bin is already on
+# PATH, so this needs no PNPM_HOME wiring.
 RUN npm i -g pnpm@$PNPM_VERSION
 
 # Copy pnpm files
 COPY package.json pnpm-lock.yaml .npmrc* ./
 ${DOCKER_PRE_INSTALL}
-# load packages into the virtual store using only information from a lockfile.
-# --ignore-scripts: only package files exist at this layer, so lifecycle scripts
-# (e.g. `postinstall: nuxt prepare`) would run against no sources; the explicit
-# build steps below (docker.buildSteps) cover them against the full tree.
+# --ignore-scripts: only package files exist at this layer, so a `postinstall`
+# like `nuxt prepare` would run against no sources. The build steps below run it
+# against the full tree instead.
 RUN pnpm install --ignore-scripts --frozen-lockfile --prefer-offline
 
 ARG ARG_NUXT_BUILD_CLIENT_SOURCE_MAPS=false
@@ -37,27 +35,24 @@ ${DOCKER_BUILD_STEPS}
 # --- FINAL PRODUCTION STAGE ---
 FROM $NODE_VERSION-slim AS production
 
-# openssl is always installed: the Prisma query engine generated in the build
-# stage (debian-openssl-3.0.x) dynamically links libssl3, which slim images do
-# not ship. Without it the app crashes on its first query. APT_PACKAGES adds
-# project-owned extras on top (docker.aptPackages knob, e.g. "ffmpeg").
+# openssl is always installed: the Prisma query engine links libssl3, which slim
+# images do not ship, and the app would crash on its first query without it.
+# APT_PACKAGES adds project extras on top (docker.aptPackages).
 ARG APT_PACKAGES="${APT_PACKAGES}"
 RUN apt-get update && apt-get install -y --no-install-recommends openssl $APT_PACKAGES \
     && rm -rf /var/lib/apt/lists/*
 
-# copy necessary directories from the production-base stage to the final production
-# stage, owned by the runtime uid 1000 rather than root (see the USER switch below)
+# Owned by uid 1000 so a future non-root switch needs no extra chown pass.
 COPY --chown=node:node --from=production-base /app/.output /app/.output
 
 WORKDIR /app
 
 ${DOCKER_PRISMA_RUNTIME}
 ${DOCKER_FINAL_STAGE}
-# Drop to the unprivileged `node` user (uid 1000) the base image already ships.
-# FIXED and outside every knob, so an override cannot re-root the container.
-# Everything the runtime reads or executes is node-owned, and `npm exec` writes
-# its npx cache under /home/node/.npm, which the official image creates writable.
-USER node
+# The container stays root on purpose. A `USER node` switch here breaks any
+# deployment that overrides the CMD with a command needing root: the prisma-studio
+# pods apt-install postgresql-client on start, which fails as an unprivileged user.
+# Set docker.finalStage to "USER node" to opt back in.
 
 # start the app
 CMD [ "sh", "-c", "${DOCKER_START_COMMAND}" ]

package/presets/nuxt-app/github/workflows/ci.yml

@@ -1,15 +1,14 @@
-# Managed by streamctl (full-own, render: ci). NODE_VERSION is a render knob
-# sourced from the version baseline. pnpm is not pinned here: action-setup reads
-# `packageManager` from package.json, the single reconciled source.
-# The build-and-deploy-* preview/staging/production suite is deferred to 0.2.0.
+# Managed by streamctl (full-own, render: ci). Edits here are overwritten on sync.
+# NODE_VERSION comes from the version baseline. pnpm is not pinned here because
+# action-setup reads `packageManager` from package.json.
 name: CI
 
 on:
   pull_request:
     branches: [main]
 
-# Least privilege: the jobs only read the repo. Install/build steps run
-# third-party code, so a read-only default token limits a malicious script.
+# The jobs only read the repo. Install and build run third-party code, so a
+# read-only default token limits what a malicious package can do.
 permissions:
   contents: read
 

package/presets/nuxt-app/github/workflows/pr-preview-cleanup.yml

@@ -5,8 +5,8 @@ on:
     types:
       - unlabeled
 
-# Default-deny at workflow level so any future job starts read-only; the
-# cleanup job below grants itself the exact write scopes it needs.
+# Default-deny so any future job starts read-only. The cleanup job below grants
+# itself the exact write scopes it needs.
 permissions:
   contents: read
 

package/presets/nuxt-app/preset.json

@@ -29,7 +29,7 @@
         "DOCKER_BUILD_ARGS": { "configPath": "docker.buildArgs", "default": "" },
         "DOCKER_BUILD_STEPS": { "configPath": "docker.buildSteps", "default": "RUN pnpm nuxi prepare\nRUN pnpm prisma generate\nRUN pnpm run build" },
         "DOCKER_FINAL_STAGE": { "configPath": "docker.finalStage", "default": "" },
-        "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI version for `migrate deploy`. Defaults to the baseline; override with --build-arg.\nARG PRISMA_VERSION=${PRISMA_VERSION_DEFAULT}\n\n# install prisma to run the `migrate deploy`. Runs as root because /app is\n# root-owned from WORKDIR; hand the install output to the runtime user in the\n# same layer so no later chown duplicates node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
+        "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI for `migrate deploy`. Override the pin with --build-arg.\nARG PRISMA_VERSION=${PRISMA_VERSION_DEFAULT}\n\n# Chowned to uid 1000 in the same layer, so a later USER switch needs no\n# second pass over node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
         "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.1", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
         "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && node --max-old-space-size-percentage=75 .output/server/index.mjs" }
       },

package/presets/nuxt-app/templates/ci/e2e-job.yml

@@ -34,9 +34,6 @@
       - run: pnpm install --frozen-lockfile
       # tests may import the generated Prisma client
       - run: pnpm prisma generate
-      # Schema setup (db push / migrate) and seeding are left to the consumer's
-      # test:e2e script on purpose: they are coupled to fixture seeding, which only
-      # the app's own harness owns, and CI cannot guess the reset/migrate/seed
-      # strategy. This job provides a healthy, reachable DB (DATABASE_URL above) and
-      # the generated client; test:e2e must create and seed its own schema.
+      # This job provides a reachable DB and the generated client. Schema setup and
+      # seeding belong to test:e2e, which owns the fixture strategy CI cannot guess.
       - run: pnpm test:e2e