Docker

.github/workflows/ci.yml

@@ -31,6 +31,7 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     needs: quality
+    if: github.event_name == 'pull_request'
     permissions:
       contents: read
       packages: write
@@ -40,7 +41,6 @@ jobs:
       - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
-        if: github.event_name == 'pull_request'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -57,8 +57,9 @@ jobs:
       - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
         with:
           context: .
-          # Sur main : build de validation uniquement. Les tags semver + latest sont poussés par release-docker.yml.
-          push: ${{ github.event_name == 'pull_request' }}
+          # Validation Docker pour les PR. Sur main, seul le job release construit
+          # l'image quand semantic-release publie vraiment une version.
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
@@ -67,7 +68,7 @@ jobs:
   release:
     name: semantic-release
     runs-on: ubuntu-latest
-    needs: docker
+    needs: quality
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: write

Dockerfile

@@ -1,28 +1,32 @@
+# syntax=docker/dockerfile:1.7
+
 # ── Étape 1 : dépendances ─────────────────────────────────────────────────────
 FROM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS deps
 WORKDIR /app
 
-RUN apk add --no-cache python3 make g++
+RUN --mount=type=cache,target=/var/cache/apk \
+  apk add --update-cache --cache-dir /var/cache/apk python3 make g++
 
 COPY package.json package-lock.json ./
-RUN HUSKY=0 npm ci
+RUN --mount=type=cache,target=/root/.npm \
+  HUSKY=0 npm ci --prefer-offline --no-audit
 
 # ── Étape 2 : build ───────────────────────────────────────────────────────────
-FROM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS builder
-WORKDIR /app
+FROM deps AS builder
 
 ENV NEXT_TELEMETRY_DISABLED=1
 
-COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 
-RUN npm run build
+RUN --mount=type=cache,target=/app/.next/cache \
+  npm run build
 
 # ── Étape 3 : image de production ─────────────────────────────────────────────
 FROM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS runner
 WORKDIR /app
 
-RUN apk add --no-cache libstdc++
+RUN --mount=type=cache,target=/var/cache/apk \
+  apk add --update-cache --cache-dir /var/cache/apk libstdc++
 
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
@@ -40,6 +44,18 @@ RUN mkdir -p /app/data && chown hobbyhoops:hobbyhoops /app/data
 
 COPY --chmod=755 scripts/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
+RUN rm -rf \
+  /sbin/apk \
+  /etc/apk \
+  /lib/apk \
+  /var/cache/apk \
+  /var/lib/apk \
+  /usr/local/bin/corepack \
+  /usr/local/bin/npm \
+  /usr/local/bin/npx \
+  /usr/local/lib/node_modules/corepack \
+  /usr/local/lib/node_modules/npm
+
 USER hobbyhoops
 
 EXPOSE 3000