Dockerfile

FROM node:24-alpine AS builder

ARG NODE_ENV=production
ARG APP_ENV=production
ARG BUILD_TARGET=azure
ARG NPM_TOKEN
ARG SENTRY_DSN=""
ARG SENTRY_AUTH_TOKEN=""
ARG GA_TRACKING_CODE=""

# VITE_API_URL, VITE_IDP_URL come from committed .env.development / .env.production
# SENTRY_AUTH_TOKEN: build-only; enables Vite sourcemaps + Sentry upload (see vite.config.ts)
ENV NODE_ENV=${NODE_ENV} \
    APP_ENV=${APP_ENV} \
    BUILD_TARGET=${BUILD_TARGET} \
    NPM_TOKEN=${NPM_TOKEN} \
    SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN} \
    VITE_SENTRY_DSN=${SENTRY_DSN} \
    VITE_GA_TRACKING_CODE=${GA_TRACKING_CODE} \
    HUSKY=0

WORKDIR /app

COPY package.json pnpm-lock.yaml ./

RUN apk add --no-cache libc6-compat

RUN set -eux; \
    TOKEN="$(printf %s "${NPM_TOKEN:-}" | tr -d '\r\n')"; \
    test -n "$TOKEN" || { echo "error: build-arg NPM_TOKEN is required for @oacore (GitHub Packages)." >&2; exit 1; }; \
    printf '%s\n' '@oacore:registry=https://npm.pkg.github.com' "//npm.pkg.github.com/:_authToken=${TOKEN}" > .npmrc; \
    corepack enable; \
    corepack prepare pnpm@9 --activate; \
    NODE_ENV=development pnpm install --frozen-lockfile; \
    rm -f .npmrc

COPY . .

RUN case "$APP_ENV" in \
      staging) pnpm run build:staging ;; \
      development) pnpm run build:dev ;; \
      production) pnpm run build ;; \
      *) pnpm run build ;; \
    esac

FROM nginx:1.27-alpine AS runtime

WORKDIR /usr/share/nginx/html

RUN rm -rf /usr/share/nginx/html/* \
    && rm -f /etc/nginx/conf.d/default.conf

COPY nginx/default.conf /etc/nginx/conf.d/default.conf
COPY --from=builder /app/dist /usr/share/nginx/html

EXPOSE 8080

CMD ["nginx", "-g", "daemon off;"]