Skip to content

Commit 9d5df95

Browse files
CopilotwarengonzagaCopilot
authored
🔒 security (infra): tighten Docker base image cleanup (#145)
* Initial plan * 🔧 update (docker): remove lingering corepack shim Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> * 🔧 update (docker): clarify comment to match actual cleanup commands * ⚙️ setup: add useArrayLiteralNotation rule to biome config Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * ⚙️ setup: update biome schema to 2.5.9 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * 🔧 update (infra): fix package.json indentation * 🔧 update (infra): format package manifest Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> Co-authored-by: Waren Gonzaga <opensource@warengonzaga.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
1 parent dc91d10 commit 9d5df95

3 files changed

Lines changed: 74 additions & 74 deletions

File tree

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ FROM node:${NODE_VERSION} AS base
3333
# Install security updates for Alpine packages
3434
RUN apk update && apk upgrade --no-cache && \
3535
apk add --no-cache dumb-init && \
36-
# Remove corepack cache and bundled manager data to reduce vulnerable surface area.
36+
# Remove corepack and Node package manager binaries/caches to reduce vulnerable surface area.
3737
rm -rf /root/.cache/node/corepack /usr/local/lib/node_modules/corepack && \
38-
rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \
38+
rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/corepack /usr/local/bin/npm /usr/local/bin/npx && \
3939
rm -rf /var/cache/apk/*
4040

4141
# Set working directory for all subsequent stages

‎biome.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"$schema": "https://biomejs.dev/schemas/2.5.2/schema.json",
2+
"$schema": "https://biomejs.dev/schemas/2.5.9/schema.json",
33
"assist": { "actions": { "source": { "organizeImports": "on" } } },
44
"linter": {
55
"enabled": true,

‎package.json‎

Lines changed: 71 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,73 +1,73 @@
11
{
2-
"name": "unthread-discord-bot",
3-
"description": "Turn Discord community servers into real-time support ticket hubs — powered by Unthread.io",
4-
"version": "1.1.9",
5-
"private": true,
6-
"main": "dist/index.js",
7-
"scripts": {
8-
"build": "tsc",
9-
"type-check": "tsc --noEmit",
10-
"start": "bun run build && node dist/deploy_commands.js && node dist/index.js",
11-
"dev": "bun --watch src/index.ts",
12-
"deploycommand": "bun run build && node dist/deploy_commands.js",
13-
"cmd:deploy": "bun run build && node dist/command_deploy.js",
14-
"cmd:reset": "bun run build && node dist/command_reset.js",
15-
"lint": "bunx biome check .",
16-
"lint:fix": "bunx biome check --write .",
17-
"format": "bunx biome format --write .",
18-
"test": "bun test src/__tests__/config src/__tests__/utils src/__tests__/infrastructure.test.ts",
19-
"test:coverage": "bun test --coverage src/__tests__/config src/__tests__/utils src/__tests__/infrastructure.test.ts",
20-
"test:watch": "bun test --watch src/__tests__/config src/__tests__/utils",
21-
"test:integration": "bun test src/__tests__/integration",
22-
"test:all": "bun test src/__tests__",
23-
"docker:build": "docker build -t unthread-discord-bot .",
24-
"docker:build:secure": "docker build --no-cache -t unthread-discord-bot .",
25-
"docker:build:sbom": "docker build --sbom=true --provenance=mode=max -t unthread-discord-bot .",
26-
"docker:run": "docker run --env-file .env unthread-discord-bot",
27-
"sbom:generate": "./scripts/generate-sbom.sh"
28-
},
29-
"keywords": [],
30-
"author": "Waren Gonzaga <opensource@warengonzaga.com> (https://warengonzaga.com)",
31-
"contributors": [
32-
"WG Tech Labs <opensource@wgtechlabs.com> (https://wgtechlabs.com)"
33-
],
34-
"license": "AGPL-3.0",
35-
"repository": {
36-
"type": "git",
37-
"url": "git+https://github.com/wgtechlabs/unthread-discord-bot.git"
38-
},
39-
"bugs": {
40-
"url": "https://github.com/wgtechlabs/unthread-discord-bot/issues"
41-
},
42-
"engines": {
43-
"node": "^22.0.0 || ^24.0.0 || ^26.0.0"
44-
},
45-
"packageManager": "bun@1.3.13",
46-
"dependencies": {
47-
"@types/ioredis": "^5.0.0",
48-
"@wgtechlabs/log-engine": "2.3.1",
49-
"discord.js": "^14.26.4",
50-
"dotenv": "^17.4.2",
51-
"express": "^5.2.1",
52-
"ioredis": "^6.0.0",
53-
"pg": "^8.21.0",
54-
"redis": "^6.0.1"
55-
},
56-
"devDependencies": {
57-
"@biomejs/biome": "^2.5.1",
58-
"@types/bun": "^1.3.14",
59-
"@types/express": "^5.0.6",
60-
"@types/node": "^26.0.1",
61-
"@types/pg": "^8.20.0",
62-
"esbuild": "^0.28.0",
63-
"nodemon": "^3.1.14",
64-
"ts-node": "^10.9.2",
65-
"typescript": "^7.0.2"
66-
},
67-
"overrides": {
68-
"brace-expansion": "^5.0.7",
69-
"tar": "^7.5.19",
70-
"undici": "^6.28.0",
71-
"ws": "^8.21.0"
72-
}
2+
"name": "unthread-discord-bot",
3+
"description": "Turn Discord community servers into real-time support ticket hubs — powered by Unthread.io",
4+
"version": "1.1.9",
5+
"private": true,
6+
"main": "dist/index.js",
7+
"scripts": {
8+
"build": "tsc",
9+
"type-check": "tsc --noEmit",
10+
"start": "bun run build && node dist/deploy_commands.js && node dist/index.js",
11+
"dev": "bun --watch src/index.ts",
12+
"deploycommand": "bun run build && node dist/deploy_commands.js",
13+
"cmd:deploy": "bun run build && node dist/command_deploy.js",
14+
"cmd:reset": "bun run build && node dist/command_reset.js",
15+
"lint": "bunx biome check .",
16+
"lint:fix": "bunx biome check --write .",
17+
"format": "bunx biome format --write .",
18+
"test": "bun test src/__tests__/config src/__tests__/utils src/__tests__/infrastructure.test.ts",
19+
"test:coverage": "bun test --coverage src/__tests__/config src/__tests__/utils src/__tests__/infrastructure.test.ts",
20+
"test:watch": "bun test --watch src/__tests__/config src/__tests__/utils",
21+
"test:integration": "bun test src/__tests__/integration",
22+
"test:all": "bun test src/__tests__",
23+
"docker:build": "docker build -t unthread-discord-bot .",
24+
"docker:build:secure": "docker build --no-cache -t unthread-discord-bot .",
25+
"docker:build:sbom": "docker build --sbom=true --provenance=mode=max -t unthread-discord-bot .",
26+
"docker:run": "docker run --env-file .env unthread-discord-bot",
27+
"sbom:generate": "./scripts/generate-sbom.sh"
28+
},
29+
"keywords": [],
30+
"author": "Waren Gonzaga <opensource@warengonzaga.com> (https://warengonzaga.com)",
31+
"contributors": [
32+
"WG Tech Labs <opensource@wgtechlabs.com> (https://wgtechlabs.com)"
33+
],
34+
"license": "AGPL-3.0",
35+
"repository": {
36+
"type": "git",
37+
"url": "git+https://github.com/wgtechlabs/unthread-discord-bot.git"
38+
},
39+
"bugs": {
40+
"url": "https://github.com/wgtechlabs/unthread-discord-bot/issues"
41+
},
42+
"engines": {
43+
"node": "^22.0.0 || ^24.0.0 || ^26.0.0"
44+
},
45+
"packageManager": "bun@1.3.13",
46+
"dependencies": {
47+
"@types/ioredis": "^5.0.0",
48+
"@wgtechlabs/log-engine": "2.3.1",
49+
"discord.js": "^14.26.4",
50+
"dotenv": "^17.4.2",
51+
"express": "^5.2.1",
52+
"ioredis": "^6.0.0",
53+
"pg": "^8.21.0",
54+
"redis": "^6.0.1"
55+
},
56+
"devDependencies": {
57+
"@biomejs/biome": "^2.5.1",
58+
"@types/bun": "^1.3.14",
59+
"@types/express": "^5.0.6",
60+
"@types/node": "^26.0.1",
61+
"@types/pg": "^8.20.0",
62+
"esbuild": "^0.28.0",
63+
"nodemon": "^3.1.14",
64+
"ts-node": "^10.9.2",
65+
"typescript": "^7.0.2"
66+
},
67+
"overrides": {
68+
"brace-expansion": "^5.0.7",
69+
"tar": "^7.5.19",
70+
"undici": "^6.28.0",
71+
"ws": "^8.21.0"
72+
}
7373
}

0 commit comments

Comments
 (0)