fix: up to yarn berry + fetch + docker opti (#147)

* fix: up to yarn berry + fetch + docker opti

* fix: dockerfile

* fix: dockerfile perms

* fix: wip

* fix: add securityContext

.dockerignore

@@ -0,0 +1,9 @@
+.dockerignore
+Dockerfile
+.git
+.github
+.kontinuous
+.socialgouv.yaml
+.releaserc.yml
+*.md
+LICENSE

.gitignore

@@ -6,3 +6,11 @@ yarn-error.log*
 dist/
 node_modules/
 coverage/
+
+# Yarn Berry
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions

.kontinuous/values.yaml

@@ -11,3 +11,7 @@ app:
         name: archifiltre-statistics-sealed-secret
     - configMapRef:
         name: archifiltre-statistics-configmap
+  securityContext:
+    fsGroup: 1000
+    runAsUser: 1000
+    runAsGroup: 1000

.yarn/plugins/@yarnpkg/plugin-fetch.cjs

@@ -0,0 +1,19 @@
+/* eslint-disable */
+//prettier-ignore
+module.exports = {
+name: "@yarnpkg/plugin-fetch",
+factory: function (require) {
+var plugin=(()=>{var ie=Object.defineProperty;var le=(n,t,e)=>t in n?ie(n,t,{enumerable:!0,configurable:!0,writable:!0,value:e}):n[t]=e;var c=(n=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(n,{get:(t,e)=>(typeof require<"u"?require:t)[e]}):n)(function(n){if(typeof require<"u")return require.apply(this,arguments);throw new Error('Dynamic require of "'+n+'" is not supported')});var a=(n,t)=>()=>(t||n((t={exports:{}}).exports,t),t.exports);var u=(n,t,e)=>(le(n,typeof t!="symbol"?t+"":t,e),e);var $=a((_e,A)=>{"use strict";A.exports=function(t){return t.map(function(e){return e&&typeof e=="object"?e.op.replace(/(.)/g,"\\$1"):/["\s]/.test(e)&&!/'/.test(e)?"'"+e.replace(/(['\\])/g,"\\$1")+"'":/["'\s]/.test(e)?'"'+e.replace(/(["\\$`!])/g,"\\$1")+'"':String(e).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g,"$1\\$2")}).join(" ")}});var v=a((ze,Y)=>{var C=c("fs"),pe=c("path"),{parseSyml:ue}=c("@yarnpkg/parsers"),B=["npm","portal","link"];Y.exports=function(){let t=C.readFileSync("yarn.lock","utf8"),e=ue(t),r=Object.keys(e).filter(o=>o.includes("@workspace:")),s=r.map(o=>{let[,i]=e[o].resolution.trim().split("@workspace:");return i==="."?null:i}).filter(Boolean);r.forEach(o=>{let{dependencies:i,dependenciesMeta:p,peerDependencies:b,peerDependenciesMeta:P,resolution:D,bin:oe}=e[o],[ce,w]=D.trim().split("@workspace:"),ae=pe.join(w,"package.json"),y={name:ce,version:"0.0.0",description:"**DON'T COMMIT** Generated file for caching",private:!0,dependencies:i,peerDependencies:b,peerDependenciesMeta:P,bin:oe};if(p){let h={};Object.keys(p).forEach(m=>{h[m]=i[m],delete i[m]}),y.optionalDependencies=h}if(w==="."){s.length>0&&(y.workspaces={packages:s});let h=Object.keys(e),m=l=>{let k=l.trim().split("@");return l.startsWith("@")?k=k.slice(0,2):k=k.slice(0,1),k.join("@")};y.resolutions=h.filter(l=>{if(l.includes("@workspace:")||l.includes(", ")||!B.some(f=>l.includes(`@${f}:`)))return!1;let k=m(l);return h.every(f=>l===f?!0:f.split(",").map(g=>m(g)).every(g=>g!==k))}).reduce((l,k)=>(B.forEach(f=>{if(!k.includes(`@${f}:`))return;let[g,x]=k.trim().split(`@${f}:`);switch(f){case"npm":l[g]=x.includes("@")?`${f}:${x}`:x;break;case"portal":case"link":l[g]=`${f}:${x.split("::")[0]}`;break}}),l),{})}C.mkdirSync(w,{recursive:!0}),C.writeFileSync(ae,`${JSON.stringify(y,null,2)}
+`)})}});var j=a((Ge,H)=>{var ke=v();H.exports=n=>{n.context.stdout.write(`[YARN-FETCH] extracting package.json file(s) from yarn.lock
+`),ke()}});var M=a((Ze,L)=>{var d=c("fs"),fe=c("path"),{execSync:de}=c("child_process"),{parseSyml:me}=c("@yarnpkg/parsers"),{BaseCommand:ge}=c("@yarnpkg/cli"),{Command:he,Option:R}=c("clipanion"),ye=$(),xe=j(),q;L.exports=(q=class extends ge{protectPackageJson=R.Boolean("--protect-package-json");args=R.Proxy();async execute(){let{protectPackageJson:t=process.stdout.isTTY}=this,e=[];if(t){this.context.stdout.write(`[YARN-FETCH] backup possible package.json file(s)
+`);let s=d.readFileSync("yarn.lock","utf8"),o=me(s);e=Object.keys(o).filter(p=>p.includes("@workspace:")).map(p=>{let{resolution:b}=o[p],[,P]=b.trim().split("@workspace:");return fe.join(P,"package.json")}),e.forEach(p=>{d.existsSync(p)&&!d.existsSync(`${p}.yarn-plugin-fetch-bak`)&&d.copyFileSync(p,`${p}.yarn-plugin-fetch-bak`)})}xe(this);let r=`yarn ${ye(this.args)}`;this.context.stdout.write(`[YARN-FETCH] ${r}
+`);try{de(r,{stdio:"inherit"})}catch(s){throw s}finally{t&&(this.context.stdout.write(`[YARN-FETCH] restoring possible package.json file(s)
+`),e.forEach(s=>{d.existsSync(`${s}.yarn-plugin-fetch-bak`)?d.renameSync(`${s}.yarn-plugin-fetch-bak`,s):d.unlinkSync(s)}))}}},u(q,"paths",[["fetch"]]),u(q,"usage",he.Usage({description:"fetch dependencies from yarn.lock in Docker build",details:`
+      expand yarn.lock to package.json file(s) and install dependencies in Docker build.
+    `,examples:[["yarn fetch --immutable","yarn fetch workspace my-package focus"]]})),q)});var K=a((Xe,I)=>{var{BaseCommand:qe}=c("@yarnpkg/cli"),be=j(),S;I.exports=(S=class extends qe{async execute(){be(this)}},u(S,"paths",[["fetch-tools","expand-lock"]]),S)});var _=a((tt,W)=>{function Pe(n,t,e){let r=t.split("."),s=n;for(let o of r){if(s[o]===void 0)return e;s=s[o]}return s}function we(n,t,e){let r=t.split("."),s=n;for(let o=0;o<r.length-1;o++){let i=r[o];(!s[i]||typeof s[i]!="object")&&(s[i]={}),s=s[i]}return s[r[r.length-1]]=e,n}function $e(n,t){let e=t.split("."),r=n;for(let s=0;s<e.length-1;s++){let o=e[s];if(!r[o])return!1;r=r[o]}return delete r[e[e.length-1]],!0}W.exports={get:Pe,set:we,unset:$e}});var F=a((st,G)=>{var z=c("fs"),{get:Ce,set:je,unset:Se}=_();G.exports=function(t,e){let r=JSON.parse(z.readFileSync("package.json","utf-8")),s=Ce(r,t);s!==void 0&&(je(r,e,s),Se(r,t),z.writeFileSync("package.json",JSON.stringify(r,null,2)))}});var E=a((nt,U)=>{var Fe=F();U.exports=function(){Fe("scripts._postinstall","scripts.postinstall")}});var Q=a((ot,Z)=>{var{BaseCommand:Ee}=c("@yarnpkg/cli"),Je=E(),J;Z.exports=(J=class extends Ee{async execute(){Je()}},u(J,"paths",[["fetch-tools","disable-postinstall"]]),J)});var N=a((at,V)=>{var Ne=F();V.exports=function(){Ne("scripts.postinstall","scripts._postinstall")}});var ee=a((lt,X)=>{var{BaseCommand:Te}=c("@yarnpkg/cli"),Oe=N(),T;X.exports=(T=class extends Te{async execute(){Oe()}},u(T,"paths",[["fetch-tools","disable-postinstall"]]),T)});var ne=a((kt,se)=>{var{execSync:De}=c("child_process"),{BaseCommand:Ae}=c("@yarnpkg/cli"),{Option:te}=c("clipanion"),Be=$(),Ye=E(),ve=N(),O;se.exports=(O=class extends Ae{postinstall=te.Boolean("--postinstall");args=te.Proxy();async execute(){this.postinstall||(this.context.stdout.write(`[YARN-FETCH] disable postinstall command in package.json
+`),ve());let t=`yarn workspaces focus --production ${Be(this.args)}`;this.context.stdout.write(`[YARN-FETCH] ${t}
+`),De(t,{stdio:"inherit"}),this.postinstall||(this.context.stdout.write(`[YARN-FETCH] re-enable postinstall command in package.json
+`),Ye())}},u(O,"paths",[["fetch-tools","production"]]),O)});var Ke=a((dt,re)=>{var He=M(),Re=K(),Le=Q(),Me=ee(),Ie=ne();re.exports={commands:[He,Re,Me,Le,Ie]}});return Ke();})();
+return plugin;
+}
+};

.yarnrc.yml

@@ -0,0 +1,9 @@
+nodeLinker: node-modules
+
+plugins:
+  - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
+    spec: "@yarnpkg/plugin-workspace-tools"
+  - path: .yarn/plugins/@yarnpkg/plugin-fetch.cjs
+    spec: "https://raw.githubusercontent.com/devthejo/yarn-plugin-fetch/master/bundles/@yarnpkg/plugin-fetch.js"
+
+yarnPath: .yarn/releases/yarn-3.6.3.cjs

Dockerfile

@@ -1,18 +1,18 @@
-FROM node:15-alpine
-
+FROM node:15-alpine AS node
+USER 1000
 WORKDIR /app
 
-RUN chown node:node /app
-
-COPY . .
+FROM node AS builder
 
-#RUN yarn --frozen-lockfile --production
-RUN yarn --frozen-lockfile --prefer-offline && yarn cache clean
+COPY yarn.lock .yarnrc.yml ./
+COPY --chown=1000:1000 .yarn .yarn
+RUN yarn fetch --immutable && yarn cache clean
 
+COPY --chown=1000:1000 . .
 RUN yarn build
+RUN yarn workspaces focus --production
 
-USER node
-
+FROM node AS runner
 ENV NODE_ENV=production
-
-ENTRYPOINT ["yarn", "start"]
+ENTRYPOINT ["node","dist/src/app.js"]
+COPY --from=builder /app /app

package.json

@@ -46,5 +46,6 @@
     "hooks": {
       "pre-push": "yarn lint && yarn test"
     }
-  }
+  },
+  "packageManager": "yarn@3.6.3"
 }