[ccp-redbeard]

Adds a container image for the assembly dapp, so it can be served from inside EKS on a private origin (dapps.<tier>.priv.evefrontier.com) as well as from Amplify.

What

• packages/apps/assembly/Dockerfile:
  • Builds the SPA with bun/nx, with --base=/ so deep links load their assets.
  • Compiles Caddy v2.11.7 on SUSE BCI Go 1.27.
  • Ships both on a zypper-updated BCI Micro 16.0 root on scratch, running as non-root 65534, listening on :8080.
  • Caddy is built through a wrapper module, the way xcaddy does, so golang.org/x/net can be raised to v0.60.0. v2.11.7 ships v0.59.0, which has a Critical (GO-2026-6612).
• packages/apps/assembly/Caddyfile:
  • /healthz.
  • /assets/* is cached for a year (immutable), and a missing asset returns 404.
  • All other paths fall back to index.html with no-cache.
  • Responses are compressed with zstd or gzip.
• .github/workflows/image.yaml:
  • Runs on dapp/v* tags and checks that the tag matches packages/apps/assembly/package.json.
  • Grype scans the sources once.
  • Then, for each of 4 tiers × 2 architectures (native runners), it builds the image, scans it with grype, and pushes it to ECR as <version>-<tier>-<arch> (for example 0.3.8-uat-arm64).
  • The tier values mirror the Amplify dapps branch environment.
• .grype.yaml: fails on Critical findings, except those the distro marks won't-fix.

Notes

• All config is still VITE_* inlined at build time, hence one image per tier. A single image for all tiers would need the app to read its config at runtime.
• Amplify is unchanged and keeps deploying from the tier branches.
• Pushing needs ccpgames/eve-frontier-infra-aws#1838, which trusts refs/tags/dapp/v* on the ECR push role.

Verified locally

• Built the uat image and ran it: health check, SPA fallback, cache headers, zstd, asset 404, and the uat package ID baked into the bundle all behave as expected.
• The grype critical gate passes on the image.
• The arm64 image path has not been run yet; CI builds it on a native arm64 runner.

🤖 Generated with Claude Code

[github-actions]

Coverage Report for @evefrontier/dapp-kit

Status	Category	Percentage	Covered / Total
🔵	Lines	89.16%	864 / 969
🔵	Statements	87.17%	931 / 1068
🔵	Functions	84.64%	193 / 228
🔵	Branches	74.33%	588 / 791

File Coverage

No changed files found.

Generated in workflow #124 for commit 543271d by the Vitest Coverage Report Action

[Copilot]

🟡 Changes recommended

Frontend dependency scanning is incomplete, and missing assets can receive year-long immutable caching headers.

2 open issues

• Source scan misses Bun lockfile dependencies · New
• Immutable cache headers applied to missing assets · New

What changed in this PR

Adds a container deployment path for the assembly dapp on a private EKS origin while preserving Amplify deployments.

Changes:

• Builds the SPA and Caddy into a non-root BCI Micro image.
• Configures health checks, compression, SPA routing, and asset caching.
• Adds release-tag validation, vulnerability scans, and tier-specific image publishing for AMD64 and ARM64.

File	Description
packages/​apps/​assembly/​Dockerfile	Builds the SPA and patched Caddy runtime image.
packages/​apps/​assembly/​Caddyfile	Defines health checks, routing, compression, and caching.
.grype.yaml	Excludes vulnerabilities marked won't-fix from scanning results.
.github/​workflows/​image.yaml	Validates releases, scans sources and images, and publishes to ECR.
.dockerignore	Excludes local dependencies, build outputs, and selected configuration files.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The unverified ARM64 image path and external ECR trust prerequisite need end-to-end validation before approval.

No open issues 🎉

2 resolved since last review

• Immutable cache headers applied to missing assets
• Source scan misses Bun lockfile dependencies

_{Review effort: Balanced}