@smi-digital/create-smi-app 2.14.1 → 2.14.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.14.1",
+  "version": "2.14.2",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/base/gitignore.template

@@ -4,4 +4,7 @@ node_modules
 !production.*.env
 
 # Ansible Vault Password (NEVER COMMIT THIS)
-.vault-password
+.vault-password
+
+# Jetbrains IDE
+.idea

package/templates/integrations/strapi-astro/Dockerfile.backend.template

@@ -43,5 +43,25 @@ COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 EXPOSE 1337
+
+# KNOWN GAP — this image runs as root, unlike frontend/Dockerfile.
+#
+# Strapi writes into /opt/app/public, which is a mounted volume at runtime, and
+# the entrypoint reseeds it on every start. The deploy provisions that volume
+# owned by root, so adding `USER node` here leaves the container unable to write
+# to it and the entrypoint fails on boot. Making this non-root is a change to how
+# the volume is provisioned — cd-library and the Ansible role — not a Dockerfile
+# edit, so it cannot be fixed in this template alone.
+#
+# Every backend in the fleet carries this same suppression. It is here so a new
+# project starts consistent with them rather than failing its first Semgrep run,
+# not because running as root is intended. If the provisioning side is ever
+# changed to create the volume as uid 1000, delete these two lines and add
+# `USER node` — this template is the right place to start that.
+#
+# Suppressed narrowly, by rule and on these two lines only, so that a NEW
+# root-running image elsewhere in the project still fails the scan.
+# nosemgrep: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
 ENTRYPOINT ["docker-entrypoint.sh"]
+# nosemgrep: dockerfile.security.missing-user.missing-user
 CMD ["npm", "run", "start"]