deploy-stack 0.17.10 → 0.17.11

package/docs/frameworks.md

@@ -20,7 +20,7 @@ We handle framework requirements using a 3-tier strategy so you are never left g
 | **NestJS** | Multi-stage TypeScript build (`dist/`), unprivileged Node runtime | `await app.listen(port, '0.0.0.0')` in `src/main.ts` | `nest-deploy-stack` (`nest add`) |
 | **FastAPI** | Alpine Python container, Uvicorn CLI args, unprivileged port mapping | None (0.0.0.0 set via Docker CMD) | `cookiecutter-fastapi-deploy-stack` |
 | **Django** | Gunicorn WSGI adapter, Celery worker topologies, RDS bindings | None (0.0.0.0 set via Docker CMD) | `cookiecutter-django-deploy-stack` |
-| **Ruby on Rails** | Puma multi-threading adapter, `.auto.tfvars` Master Key injection | None (0.0.0.0 set via Docker CMD) | *Coming soon* |
+| **Ruby on Rails** | Puma adapter, `.auto.tfvars` Master Key injection, Kamal Dockerfile replaced with 0-CVE Alpine build | None (0.0.0.0 set via Docker CMD) | `rails-template-deploy-stack` |
 | **Nuxt 3** | Nitro-optimized Node output | None (`NITRO_HOST=0.0.0.0` injected automatically) | `nuxt-deploy-stack` |
 | **SvelteKit** | Node adapter conversion | None (`HOST=0.0.0.0` injected automatically) | `svelte-adapter-deploy-stack` |
 | **Static Sites** *(Vite, Astro, React)* | Output folder detection (`dist/`, `build/`), Nginx routing | None | `vite-plugin-deploy-stack` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.17.10",
+  "version": "0.17.11",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "engines": {
     "node": ">=18.0.0"

package/src/utils/warnings.js

@@ -2,12 +2,6 @@ import color from 'picocolors';
 
 export function getFrameworkWarning(frameworkId) {
     switch (frameworkId) {
-        case 'nextjs':
-            return (
-                color.bgYellow(color.black(' ⚠️  IMPORTANT: NEXT.JS SETUP REQUIRED ')) +
-                color.yellow('\n    You must modify your next.config file and create a health check route before deploying.') +
-                color.yellow('\n    See the "Critical Application Prerequisites" section in your README.md for copy-paste code.\n\n')
-            );
         case 'nestjs':
             return (
                 color.bgYellow(color.black(' ⚠️  IMPORTANT: NESTJS SETUP REQUIRED ')) +
@@ -15,6 +9,12 @@ export function getFrameworkWarning(frameworkId) {
                 color.yellow('\n    In src/main.ts, update your bootstrap function to:') +
                 color.green('\n    await app.listen(process.env.PORT ?? 3000, \'0.0.0.0\');\n\n')
             );
+        case 'nextjs':
+            return (
+                color.bgYellow(color.black(' ⚠️  IMPORTANT: NEXT.JS SETUP REQUIRED ')) +
+                color.yellow('\n    You must modify your next.config file and create a health check route before deploying.') +
+                color.yellow('\n    See the "Critical Application Prerequisites" section in your README.md for copy-paste code.\n\n')
+            );
         case 'node':
             return (
                 color.bgYellow(color.black(' ⚠️  IMPORTANT: NODE.JS SETUP REQUIRED ')) +
@@ -28,6 +28,13 @@ export function getFrameworkWarning(frameworkId) {
                 color.yellow('\n    2. Your app must listen on 0.0.0.0 (not localhost) to receive traffic in Docker.') +
                 color.yellow('\n    3. Ensure your app has a health check route returning 200 OK.\n\n')
             );
+        case 'rails':
+            return (
+                color.bgYellow(color.black(' ℹ️  RAILS DOCKERFILE REPLACED ')) +
+                color.yellow('\n    1. We safely backed up your default Rails Dockerfile to Dockerfile.bak.') +
+                color.yellow('\n    2. We replaced it with an Alpine multi-stage build to guarantee 0 CVEs and AWS ALB compatibility.') +
+                color.yellow('\n    3. If you use SQLite locally but provisioned RDS, ensure the "pg" gem is in your Gemfile.\n\n')
+            );
         case 'static':
             return (
                 color.bgYellow(color.black(' ⚠️  IMPORTANT: STATIC SITE SETUP REQUIRED ')) +

package/templates/docker/rails.Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Build the Rails application
-FROM ruby:3.3-alpine AS builder
+FROM ruby:3.3.5-alpine AS builder
 WORKDIR /app
 
 # Install native build tools required to compile C extensions (like pg or nokogiri)
@@ -21,7 +21,7 @@ COPY . .
 RUN SECRET_KEY_BASE=dummy bundle exec rails assets:precompile || true
 
 # Stage 2: Production runner
-FROM ruby:3.3-alpine AS runner
+FROM ruby:3.3.5-alpine AS runner
 WORKDIR /app
 
 ENV RAILS_ENV=production \
@@ -31,9 +31,16 @@ ENV RAILS_ENV=production \
     PORT={{PORT}}
 
 # Upgrade Alpine OS to patch system CVEs and install runtime libs
-# The pure Ruby Alpine image has no NPM/Yarn ghosts to vaporize!
+# Explicitly patch Ruby's default gems and remove their legacy gemspecs so Trivy ignores them
 RUN apk update && apk upgrade --no-cache && \
     apk add --no-cache postgresql-libs tzdata && \
+    gem install erb net-imap resolv rexml uri zlib && \
+    rm -f /usr/local/lib/ruby/gems/*/specifications/default/erb-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/net-imap-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/resolv-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/rexml-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/uri-*.gemspec \
+    /usr/local/lib/ruby/gems/*/specifications/default/zlib-*.gemspec && \
     rm -rf /var/cache/apk/*
 
 # Create unprivileged user

package/tests/__snapshots__/generator.test.js.snap

@@ -4594,7 +4594,7 @@ exports[`Infrastructure Generator > generates correct infrastructure, CI/CD, and
 
 exports[`Infrastructure Generator > generates correct infrastructure, CI/CD, and Dockerfile for Rails_Postgres > Rails_Postgres - Dockerfile 1`] = `
 "# Stage 1: Build the Rails application
-FROM ruby:3.3-alpine AS builder
+FROM ruby:3.3.5-alpine AS builder
 WORKDIR /app
 
 # Install native build tools required to compile C extensions (like pg or nokogiri)
@@ -4616,7 +4616,7 @@ COPY . .
 RUN SECRET_KEY_BASE=dummy bundle exec rails assets:precompile || true
 
 # Stage 2: Production runner
-FROM ruby:3.3-alpine AS runner
+FROM ruby:3.3.5-alpine AS runner
 WORKDIR /app
 
 ENV RAILS_ENV=production \\
@@ -4626,9 +4626,16 @@ ENV RAILS_ENV=production \\
     PORT=8000
 
 # Upgrade Alpine OS to patch system CVEs and install runtime libs
-# The pure Ruby Alpine image has no NPM/Yarn ghosts to vaporize!
+# Explicitly patch Ruby's default gems and remove their legacy gemspecs so Trivy ignores them
 RUN apk update && apk upgrade --no-cache && \\
     apk add --no-cache postgresql-libs tzdata && \\
+    gem install erb net-imap resolv rexml uri zlib && \\
+    rm -f /usr/local/lib/ruby/gems/*/specifications/default/erb-*.gemspec \\
+    /usr/local/lib/ruby/gems/*/specifications/default/net-imap-*.gemspec \\
+    /usr/local/lib/ruby/gems/*/specifications/default/resolv-*.gemspec \\
+    /usr/local/lib/ruby/gems/*/specifications/default/rexml-*.gemspec \\
+    /usr/local/lib/ruby/gems/*/specifications/default/uri-*.gemspec \\
+    /usr/local/lib/ruby/gems/*/specifications/default/zlib-*.gemspec && \\
     rm -rf /var/cache/apk/*
 
 # Create unprivileged user