Remove unused npm from documentation runtime image #3

Merged

gitchegumi merged 1 commit from kiyi/remove-npm-from-docs-runtime into main

2026-09-24 21:05:37 -05:00

kiyi commented

2026-09-24 20:56:42 -05:00

Member

Fixes the failed Build scanned documentation image run. The source gate and container build passed; the final-image gate blocked eight findings in the pinned Node base image’s global npm packages.

The production server runs with node server.js and uses its standalone dependencies. Remove the unused global npm installation and npm/npx links from the final stage while retaining npm in the build stage.

Validation: npm run check and npm run build passed locally. The public diff is limited to the Dockerfile. Docker is unavailable locally, so the final-image scan must be rerun on protected main after merge.

Fixes the failed [Build scanned documentation image run](https://git.gitchegumi.com/Homelab/Documentation/actions/runs/7/jobs/1/attempt/1). The source gate and container build passed; the final-image gate blocked eight findings in the pinned Node base image’s global npm packages. The production server runs with `node server.js` and uses its standalone dependencies. Remove the unused global npm installation and npm/npx links from the final stage while retaining npm in the build stage. Validation: `npm run check` and `npm run build` passed locally. The public diff is limited to the Dockerfile. Docker is unavailable locally, so the final-image scan must be rerun on protected `main` after merge.

kiyi added 1 commit

2026-09-24 20:56:42 -05:00

Remove unused npm from documentation runtime image

Documentation site checks / validate (pull_request) Successful in 1m54s

Details

Source security / security (pull_request) Successful in 7m43s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

fc76908880

The scanned image build failed on eight blocking vulnerabilities under the base image’s global npm installation. The standalone Next.js server starts with node and does not use the npm CLI, so remove npm and its command links only from the final runtime stage.

Validated locally with npm run check and npm run build. The image scan still needs the protected main workflow after merge.