@tdk-landscape/tdk-cli-core 1.3.15 → 1.3.22

package/engine/topologies/platform/docker/build/golden_image_build.star

@@ -0,0 +1,82 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN IMAGE BUILDERS
+# =============================================================================
+
+load('./golden_image_constants.star', 'GOLDEN_DOCKERFILE', 'GOLDEN_IMAGE_PREFIX')
+
+
+def build_golden_layers(project_root='.'):
+    """
+    Build all golden layer images using local_resource.
+    Returns the resource name for dependency tracking.
+
+    project_root: path back to the project root from wherever
+    local_resource cmds actually run (the Tiltfile's own directory,
+    .tdk/.tdk-out/ - not the project root), e.g. '../../'. GOLDEN_DOCKERFILE
+    is itself project-root-relative, so it must be prefixed with this to
+    resolve correctly - passing project_root='.' (the default) only works
+    when the Tiltfile happens to live at the project root.
+    """
+    resource_name = 'golden-layers-build'
+    dockerfile_from_tiltfile = (
+        GOLDEN_DOCKERFILE if project_root in (None, '.', '')
+        else project_root.rstrip('/') + '/' + GOLDEN_DOCKERFILE
+    )
+
+    build_cmd = """
+echo "🏗️  Building golden layered images (8 total)..."
+echo "  📦 L1: OS base + runtime"
+echo "  📦 L2: Dependencies"
+echo "  📦 L3-Backend: Backend build tools (Prisma)"
+echo "  📦 L3-Frontend: Frontend build tools"
+echo "  📦 L3-Migrator: Migrator build tools (Prisma)"
+echo "  📦 L4-Backend: Backend runtime"
+echo "  📦 L4-Frontend: Frontend runtime"
+echo "  📦 L4-Migrator: Migrator runtime"
+
+docker build -f {dockerfile} \\
+  --target l1_golden -t {prefix}-l1:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l2_golden -t {prefix}-l2:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l3_backend_golden -t {prefix}-l3-backend:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l3_frontend_golden -t {prefix}-l3-frontend:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l3_migrator_golden -t {prefix}-l3-migrator:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l4_backend_bun -t {prefix}-l4-backend:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l4_backend_node -t {prefix}-l4-backend-node:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l4_frontend_golden -t {prefix}-l4-frontend:{tag} {context} && \\
+docker build -f {dockerfile} \\
+  --target l4_migrator_golden -t {prefix}-l4-migrator:{tag} {context}
+
+echo "✅ Golden layers built (9 images):"
+echo "  ✓ {prefix}-l1:{tag}"
+echo "  ✓ {prefix}-l2:{tag}"
+echo "  ✓ {prefix}-l3-backend:{tag}"
+echo "  ✓ {prefix}-l3-frontend:{tag}"
+echo "  ✓ {prefix}-l3-migrator:{tag}"
+echo "  ✓ {prefix}-l4-backend:{tag} (Bun - 128MB)"
+echo "  ✓ {prefix}-l4-backend-node:{tag} (Node.js - 20MB, LIGHTWEIGHT)"
+echo "  ✓ {prefix}-l4-frontend:{tag}"
+echo "  ✓ {prefix}-l4-migrator:{tag}"
+""".format(
+        dockerfile=dockerfile_from_tiltfile,
+        prefix=GOLDEN_IMAGE_PREFIX,
+        tag='latest',
+        context=project_root,
+    ).strip()
+
+    local_resource(
+        resource_name,
+        cmd=build_cmd,
+        labels=['infra.docker', 'golden-layers'],
+        deps=[dockerfile_from_tiltfile],
+        allow_parallel=True,
+        auto_init=True,
+    )
+
+    return resource_name

package/engine/topologies/platform/docker/build/golden_image_constants.star

@@ -0,0 +1,93 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN IMAGE CONSTANTS
+# =============================================================================
+
+# Load project configuration to get the project name as prefix
+# Falls back to 'tdk-project' if project.json is not found
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_IMAGE_PREFIX = _load_golden_prefix()
+
+GOLDEN_IMAGE_PREFIX = _GOLDEN_IMAGE_PREFIX
+GOLDEN_DOCKERFILE = '.tdk/.tdk-out/golden-layers.Dockerfile'
+
+GOLDEN_LAYERS = {
+    'l1': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l1',
+        'tag': 'latest',
+        'description': 'OS base + runtime environment',
+        'target': 'l1_golden',
+    },
+    'l2': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l2',
+        'tag': 'latest',
+        'description': 'Dependencies + node_modules',
+        'target': 'l2_golden',
+    },
+    'l3-backend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l3-backend',
+        'tag': 'latest',
+        'description': 'Backend build tools (Prisma only, Infisical CLI skipped to avoid CDN hangs)',
+        'target': 'l3_backend_golden',
+    },
+    'l3-frontend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l3-frontend',
+        'tag': 'latest',
+        'description': 'Frontend build tools (no Prisma)',
+        'target': 'l3_frontend_golden',
+    },
+    'l3-migrator': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l3-migrator',
+        'tag': 'latest',
+        'description': 'Migrator build tools (Prisma only, Infisical CLI skipped to avoid CDN hangs)',
+        'target': 'l3_migrator_golden',
+    },
+    'l4-backend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-backend',
+        'tag': 'latest',
+        'description': 'Backend production runtime (Bun, no Infisical CLI)',
+        'target': 'l4_backend_bun',
+    },
+    'l4-backend-node': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-backend-node',
+        'tag': 'latest',
+        'description': 'Backend production runtime (Node.js - lightweight, no Infisical CLI)',
+        'target': 'l4_backend_node',
+    },
+    'l4-frontend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-frontend',
+        'tag': 'latest',
+        'description': 'Frontend production runtime',
+        'target': 'l4_frontend_golden',
+    },
+    'l4-migrator': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-migrator',
+        'tag': 'latest',
+        'description': 'Migrator production runtime (no Infisical CLI - uses env vars)',
+        'target': 'l4_migrator_golden',
+    },
+}
+
+
+def get_layer_reference(layer):
+    """Returns the full image reference for a specific layer."""
+    if layer not in GOLDEN_LAYERS:
+        fail("Invalid layer: " + layer + ". Must be one of: l1, l2, l3, l4")
+
+    layer_info = GOLDEN_LAYERS[layer]
+    return '{name}:{tag}'.format(
+        name=layer_info['name'],
+        tag=layer_info['tag'],
+    )
+
+CONSTANTS = {}

package/engine/topologies/platform/docker/build/golden_image_dockerfile.star

@@ -0,0 +1,291 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN IMAGE DOCKERFILE GENERATOR
+# =============================================================================
+
+# === INLINED CONSTANTS for pure extension loading ===
+get_docker_healthcheck_config = lambda: {"path": "/health", "interval_seconds": 10, "timeout_seconds": 5, "start_period_seconds": 30, "retries": 3, "frontend_start_period_seconds": 30}
+# === END INLINED CONSTANTS ===
+
+
+load('../../../tilt/common/utils.star', 'Utils')
+
+
+# Load centralized healthcheck configuration
+_docker_health = get_docker_healthcheck_config()
+
+
+# Load project name for dynamic naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+def generate_golden_dockerfile():
+    """Generate the multi-stage golden-layers.Dockerfile."""
+    prefix = _GOLDEN_PREFIX
+    header = Utils.get_template_header(
+        'dockerfile',
+        'GoldenImage.generate_layered_dockerfile()',
+        prefix + '-l1-l4',
+        'GOLDEN LAYERED IMAGES | L1-L4 Pre-built Layers',
+    )
+
+    return header + """
+# =============================================================================
+# 🏗️ GOLDEN LAYERED IMAGES - Multi-Stage Base Images
+# =============================================================================
+# This Dockerfile builds 8 golden images:
+#   - """ + prefix + """-l1:latest - OS base + Bun runtime
+#   - """ + prefix + """-l2:latest - Dependencies installed
+#   - """ + prefix + """-l3-backend:latest - Backend build tools (Prisma, no Infisical CLI)
+#   - """ + prefix + """-l3-frontend:latest - Frontend build tools (no Prisma)
+#   - """ + prefix + """-l3-migrator:latest - Migrator build tools (Prisma, no Infisical CLI)
+#   - """ + prefix + """-l4-backend:latest - Backend production runtime
+#   - """ + prefix + """-l4-frontend:latest - Frontend production runtime (Nginx)
+#   - """ + prefix + """-l4-migrator:latest - Migrator production runtime
+#
+# Services use these as base images to skip heavy dependency installation.
+#
+# ⚠️ SKIP_INFISICAL_SETUP Support:
+#   All generated Dockerfiles support --build-arg SKIP_INFISICAL_SETUP=1
+#   to bypass Infisical CLI installation (avoids Cloudsmith CDN hangs).
+#   When SKIP_INFISICAL_SETUP=1, secrets are read from env vars only.
+#   See: engine/topologies/platform/docker/layers/l3_builder_layers.star
+# =============================================================================
+
+# =============================================================================
+# L1: OS BASE + RUNTIME ENVIRONMENT
+# =============================================================================
+FROM oven/bun:1.3.11-alpine AS l1_golden
+
+LABEL layer="l1" \
+      description="OS base with runtime environment" \
+      maintainer="{prefix}"
+
+# System dependencies for all services
+RUN apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    curl \
+    file \
+    bash \
+    openssl
+
+# Create app user/group for security
+RUN addgroup -S app && adduser -S app -G app
+
+# Runtime environment
+ENV NODE_ENV=development \
+    BUN_INSTALL_CACHE_DIR=/cache/bun
+
+WORKDIR /app
+
+
+# =============================================================================
+# L2: DEPENDENCY RESOLVER
+# =============================================================================
+FROM l1_golden AS l2_golden
+
+LABEL layer="l2" \
+      description="Base with common dependencies installed" \
+      maintainer="{prefix}"
+
+# Install minimal debugging tools (removed: vim, python3, make, g++ = -67MB)
+RUN apk add --no-cache \
+    curl \
+    netcat-openbsd \
+    jq \
+    bind-tools
+
+# Pre-create cache directories
+RUN mkdir -p /cache/bun /cache/prisma
+
+# Bun is already installed in base image
+RUN echo "Bun version: $(bun --version)"
+
+
+# =============================================================================
+# L3-BACKEND: BACKEND BUILD TOOLS (PRISMA)
+# =============================================================================
+FROM l2_golden AS l3_backend_golden
+
+LABEL layer="l3-backend" \
+      description="Backend build tools with Prisma" \
+      maintainer="{prefix}"
+
+# Install Prisma CLI globally (pinned for deterministic builds)
+RUN bun add -g prisma@7.5.0 @prisma/client@7.5.0
+
+# Verify Prisma installation
+RUN echo "Prisma version: $(bunx prisma --version | head -1)"
+
+# ⚠️ CRITICAL: Infisical CLI is NOT installed in golden L3 images
+# Reason: curl to dl.cloudsmith.io hangs during Docker builds when CDN is slow
+# Solution: Use SKIP_INFISICAL_SETUP=1 build arg or runtime env var injection
+# Services read secrets from environment variables at runtime (no CLI needed)
+# See: .tilt/topologies/platform/docker/layers/l3_builder_layers.star
+
+
+# =============================================================================
+# L3-FRONTEND: FRONTEND BUILD TOOLS (NO PRISMA)
+# =============================================================================
+FROM l2_golden AS l3_frontend_golden
+
+LABEL layer="l3-frontend" \
+      description="Frontend build tools without Prisma" \
+      maintainer="{prefix}"
+
+# Frontend doesn't need Prisma, just verify Bun
+RUN echo "Bun version: $(bun --version)"
+
+
+# =============================================================================
+# L3-MIGRATOR: MIGRATOR BUILD TOOLS (PRISMA)
+# =============================================================================
+FROM l2_golden AS l3_migrator_golden
+
+LABEL layer="l3-migrator" \
+      description="Migrator build tools with Prisma" \
+      maintainer="{prefix}"
+
+# Install Prisma CLI globally (required for migrations, pinned)
+RUN bun add -g prisma@7.5.0 @prisma/client@7.5.0
+
+# Verify Prisma installation
+RUN echo "Prisma version: $(bunx prisma --version | head -1)"
+
+# ⚠️ CRITICAL: Infisical CLI is NOT installed in golden L3 images
+# Reason: curl to dl.cloudsmith.io hangs during Docker builds when CDN is slow
+# Solution: Use SKIP_INFISICAL_SETUP=1 build arg or runtime env var injection
+# Services read secrets from environment variables at runtime (no CLI needed)
+# See: .tilt/topologies/platform/docker/layers/l3_builder_layers.star
+
+
+# =============================================================================
+# L4-BACKEND-BUN: BACKEND PRODUCTION RUNTIME (BUN)
+# =============================================================================
+FROM l1_golden AS l4_backend_bun
+
+LABEL layer="l4-backend-bun" \
+      description="Backend production runtime (Bun)" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Install hugo for services that require static site generation (specified via manifest features)
+RUN apk add --no-cache hugo
+
+# ⚠️ Infisical CLI is NOT installed in golden L4 images
+# Services use TypeScript SDK (fetch API) or read from env vars - no CLI needed
+# The entrypoint.sh gracefully handles missing CLI (falls back to env vars)
+# Build with --build-arg SKIP_INFISICAL_SETUP=1 to skip CLI installation
+
+USER bun
+
+# Backend-specific healthcheck (checks Bun runtime)
+HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={start_period}s --retries={retries} \
+  CMD bun --version || exit 1
+
+WORKDIR /app
+
+
+# =============================================================================
+# L4-BACKEND-NODE: BACKEND PRODUCTION RUNTIME (NODE.JS - LIGHTWEIGHT!)
+# =============================================================================
+FROM node:22-alpine AS l4_backend_node
+
+LABEL layer="l4-backend-node" \
+      description="Backend production runtime (Node.js - lightweight)" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Minimal runtime dependencies
+RUN apk add --no-cache ca-certificates tzdata curl
+
+# Create app user for security
+RUN addgroup -S app && adduser -S app -G app
+
+# ⚠️ Infisical CLI is NOT installed in golden L4 images
+# Services read secrets from environment variables at runtime
+
+USER app
+
+# Backend-specific healthcheck (checks Node.js runtime)
+HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={start_period}s --retries={retries} \
+  CMD node --version || exit 1
+
+WORKDIR /app
+
+
+# Alias for backwards compatibility - defaults to Bun (most efficient)
+FROM l4_backend_bun AS l4_backend_golden
+
+
+# =============================================================================
+# L4-FRONTEND: FRONTEND PRODUCTION RUNTIME
+# =============================================================================
+FROM nginx:alpine AS l4_frontend_golden
+
+LABEL layer="l4-frontend" \
+      description="Frontend production runtime with Nginx" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Install curl for healthchecks
+RUN apk add --no-cache curl
+
+# Frontend-specific healthcheck (checks Nginx)
+HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={frontend_start_period}s --retries={retries} \
+  CMD curl -f http://localhost/ || exit 1
+
+WORKDIR /usr/share/nginx/html
+
+
+# =============================================================================
+# L4-MIGRATOR: MIGRATOR PRODUCTION RUNTIME
+# =============================================================================
+FROM l1_golden AS l4_migrator_golden
+
+LABEL layer="l4-migrator" \
+      description="Migrator runtime with Prisma" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Copy global Prisma installation from L3
+COPY --from=l3_migrator_golden /root/.bun/install/global /root/.bun/install/global
+
+# ⚠️ Infisical CLI is NOT included in golden L4 images
+# The migrator reads secrets directly from environment variables at runtime
+# (no entrypoint wrapper needed for database migrations)
+# Use --build-arg SKIP_INFISICAL_SETUP=1 to skip CLI installation in derived images
+
+# Ensure Bun cache path is writable for non-root runtime healthcheck commands.
+RUN mkdir -p /cache/bun && chown -R bun:bun /cache/bun
+
+USER bun
+
+# Migrator-specific healthcheck (checks Prisma CLI)
+HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={start_period}s --retries={retries} \
+  CMD bunx prisma --version || exit 1
+
+WORKDIR /app
+""".format(
+    interval=_docker_health["interval_seconds"],
+    timeout=_docker_health["timeout_seconds"],
+    start_period=_docker_health["start_period_seconds"],
+    retries=_docker_health["retries"],
+    frontend_start_period=_docker_health["frontend_start_period_seconds"],
+    prefix=_GOLDEN_PREFIX,
+)