mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
ec6ff3d8a8
Token-Permissions (0 -> 10): Set permissions: {} at workflow top level
across all 7 workflows, moved write scopes to per-job minimum.
SAST (0 -> 10): Added CodeQL workflow for JavaScript/TypeScript and
Python analysis on push, PR, and weekly schedule.
Vulnerabilities (0 -> ~8): Added 13 pnpm overrides to patch transitive
dependency vulnerabilities (38 -> 2 remaining, both in dev-only tools).
Pinned-Dependencies (5 -> 8-9): Pinned all Docker FROM images to SHA
digests, pinned pip-audit version in CI, pinned pip version in
Dockerfile.
58 lines
2.0 KiB
Docker
58 lines
2.0 KiB
Docker
# ============================================
|
|
# SnapOtter - Test Dockerfile
|
|
# Runs the full test suite (unit + integration)
|
|
# ============================================
|
|
|
|
FROM node:22-bookworm@sha256:e3ca095133ba41a0a73b009f19e4253f1a878e70bb9499f6a9d21b19d082bd91
|
|
|
|
RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libheif-examples \
|
|
libimage-exiftool-perl \
|
|
imagemagick \
|
|
libraw-dev \
|
|
&& if apt-cache show libheif-plugin-libde265 >/dev/null 2>&1; then \
|
|
apt-get install -y --no-install-recommends libheif-plugin-libde265; \
|
|
fi \
|
|
&& if apt-cache show libheif-plugin-x265 >/dev/null 2>&1; then \
|
|
apt-get install -y --no-install-recommends libheif-plugin-x265; \
|
|
fi \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config first (for layer caching)
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json turbo.json tsconfig.base.json vitest.config.ts ./
|
|
|
|
# Copy all package.json files
|
|
COPY apps/web/package.json apps/web/tsconfig.json apps/web/vite.config.ts ./apps/web/
|
|
COPY apps/api/package.json apps/api/tsconfig.json ./apps/api/
|
|
COPY packages/shared/package.json packages/shared/tsconfig.json ./packages/shared/
|
|
COPY packages/image-engine/package.json packages/image-engine/tsconfig.json ./packages/image-engine/
|
|
COPY packages/ai/package.json packages/ai/tsconfig.json ./packages/ai/
|
|
|
|
# Install ALL dependencies (including devDependencies for testing)
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Environment for tests
|
|
ENV NODE_ENV=test \
|
|
AUTH_ENABLED=true \
|
|
DEFAULT_USERNAME=admin \
|
|
DEFAULT_PASSWORD=admin \
|
|
DB_PATH=/tmp/test-snapotter.db \
|
|
WORKSPACE_PATH=/tmp/test-workspace \
|
|
MAX_MEGAPIXELS=100 \
|
|
MAX_UPLOAD_SIZE_MB=100 \
|
|
MAX_BATCH_SIZE=200 \
|
|
CONCURRENT_JOBS=3 \
|
|
RATE_LIMIT_PER_MIN=1000 \
|
|
FILE_MAX_AGE_HOURS=1 \
|
|
CLEANUP_INTERVAL_MINUTES=60
|
|
|
|
# Run unit + integration tests with coverage
|
|
CMD ["pnpm", "test:all"]
|