Artifacts & Package Management

# === Every line creates a new LAYER ===

FROM node:20-alpine        # Base image. alpine = tiny (5 MB)

LABEL maintainer="devops@example.com"
LABEL version="1.0.0"

WORKDIR /app               # All subsequent commands run here

# COPY package*.json first (separate layer)
# Why: this layer is cached unless package.json changes
# npm install won't re-run if only src/ files changed
COPY package*.json ./
RUN npm ci --only=production  # prod deps only — no jest, eslint

# COPY source AFTER install (cache optimisation)
COPY src/ ./src/

# Security: never run as root in production!
RUN addgroup -S appgroup && \
    adduser  -S appuser -G appgroup
USER appuser

EXPOSE 3000                # Documents the port (doesn't publish)

HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget -qO- http://localhost:3000/health || exit 1

CMD ["node", "src/index.js"]  # Start command (exec form)

# ═══ STAGE 1: Build ══════════════════════════
# Has: node, npm, all devDependencies, build tools
FROM node:20-alpine AS builder
WORKDIR /app

COPY package*.json ./
RUN npm ci                 # ALL deps including devDeps

COPY src/ ./src/
RUN npm run build          # transpile/bundle → dist/

# ═══ STAGE 2: Runtime ════════════════════════
# Has: ONLY what's needed to run in production
# No jest, eslint, typescript, webpack, etc.
FROM node:20-alpine AS runtime
WORKDIR /app

# Security: non-root user
RUN addgroup -S appgroup && \
    adduser  -S appuser -G appgroup

# Only copy what we need from builder
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist         ./dist

USER appuser
EXPOSE 3000
CMD ["node", "dist/index.js"]

# === Size comparison ===
# Single stage (node:20):          ~1.1 GB
# Single stage (node:20-alpine):   ~170 MB
# Multi-stage (node:20-alpine):     ~80 MB
# Multi-stage (distroless):         ~50 MB

name: Docker Build & Push

on:
  push:
    branches: [ main ]      # Push image on every merge
  push:
    tags: [ 'v*.*.*' ]      # Also push on git tags

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: \${{ github.repository }}  # owner/repo

jobs:
  build-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write    # ← needed to push to GHCR

    steps:
      - uses: actions/checkout@v4

      # Login to GitHub Container Registry
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: \${{ github.actor }}
          password: \${{ secrets.GITHUB_TOKEN }}

      # Extract metadata for tags
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/\${{ env.IMAGE_NAME }}
          tags: |
            type=sha                        # sha-abc1234
            type=ref,event=branch           # main
            type=semver,pattern={{version}} # v2.4.1

      # Build and push
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: \${{ steps.meta.outputs.tags }}
          labels: \${{ steps.meta.outputs.labels }}
          cache-from: type=gha    # GitHub Actions cache
          cache-to: type=gha,mode=max

# === Basic scan ===
npm audit
# Output:
# found 3 vulnerabilities (1 moderate, 2 high)
# Run 'npm audit fix' to fix them

# === Auto-fix safe updates ===
npm audit fix

# === Fix including breaking changes ===
npm audit fix --force   # careful — may break things

# === JSON output for CI parsing ===
npm audit --json | jq '.metadata.vulnerabilities'

# === Fail CI if HIGH or CRITICAL vulns ===
npm audit --audit-level=high
# exits 1 if any HIGH/CRITICAL found → CI fails

# === List all outdated packages ===
npm outdated

# === Check specific package ===
npm audit --json | jq '.vulnerabilities | keys[]'

- name: Security audit
  run: npm audit --audit-level=high
  # Fails if HIGH or CRITICAL vulnerabilities found

- name: Scan Docker image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ghcr.io/\${{ env.IMAGE_NAME }}:latest
    format: table
    exit-code: '1'           # Fail if vulns found
    severity: HIGH,CRITICAL

const http = require('http');

const PORT = process.env.PORT || 3000;

const server = http.createServer((req, res) => {
  if (req.url === '/health') {
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ status: 'ok', version: '1.0.0' }));
  } else {
    res.writeHead(200, { 'Content-Type': 'text/plain' });
    res.end('Hello from my-devops-app!\n');
  }
});

server.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

module.exports = server; // for testing

# Stage 1: Build (has devDeps + build tools)
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY src/ ./src/

# Stage 2: Runtime (lean, secure)
FROM node:20-alpine AS runtime
WORKDIR /app
RUN addgroup -S appgroup && \
    adduser  -S appuser -G appgroup
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/src ./src
USER appuser
EXPOSE 3000
HEALTHCHECK CMD wget -qO- http://localhost:3000/health
CMD ["node", "src/index.js"]

node_modules
.git
coverage
*.md
.env
.github
tests

# === Base ===
FROM node:20-alpine         # Base image (ALWAYS use specific tag)
FROM scratch               # Empty base (for static binaries)
FROM node:20 AS builder   # Named stage for multi-stage

# === Metadata ===
LABEL key="value"          # Key-value metadata
ARG VERSION=1.0            # Build-time variable (not in image)
ENV NODE_ENV=production    # Runtime environment variable

# === Filesystem ===
WORKDIR /app               # Set working directory
COPY src/ ./src/           # Copy from host to image
COPY --from=builder /app . # Copy from another stage
ADD archive.tar.gz /app/   # Like COPY but auto-extracts

# === Execution ===
RUN npm ci                 # Run during build (creates layer)
RUN ["npm", "ci"]          # Exec form (no shell)
CMD ["node", "app.js"]    # Default start command (overridable)
ENTRYPOINT ["node"]       # Fixed executable (CMD appends args)

# === Network / Volumes ===
EXPOSE 3000                # Document port (doesn't publish)
VOLUME ["/data"]           # Declare persistent data mount point

# === Security ===
USER appuser               # Switch to non-root user
HEALTHCHECK --interval=30s \
  CMD wget -qO- localhost:3000/health

# === Build ===
docker build -t name:tag .
docker build --target builder .  # Build specific stage only
docker build --no-cache .        # Ignore layer cache

# Build
docker build -t myapp:1.0.0 .
docker build -t myapp:1.0.0 -f Dockerfile.prod .

# List images
docker images
docker images myapp             # filter by name

# Tag
docker tag myapp:1.0.0 ghcr.io/user/myapp:1.0.0
docker tag myapp:1.0.0 myapp:latest

# Push / Pull
docker push ghcr.io/user/myapp:1.0.0
docker pull ghcr.io/user/myapp:latest

# Remove
docker rmi myapp:1.0.0
docker image prune              # remove dangling images

# Inspect
docker inspect myapp:1.0.0
docker history myapp:1.0.0     # show layers
docker image ls --format "table {{.Repository}}\t{{.Size}}"

# === Tag with multiple identifiers ===
# using docker/metadata-action@v5:

tags: |
  type=sha                    # sha-abc1234 ← always unique
  type=raw,value=latest       # latest ← always current
  type=ref,event=branch       # main ← branch name
  type=semver,pattern={{version}}  # v2.4.1 ← git tag
  type=semver,pattern={{major}}.{{minor}}  # v2.4

# === Result for push to main: ===
# ghcr.io/user/myapp:sha-a3f7c2d ← unique, immutable
# ghcr.io/user/myapp:main         ← always latest on main
# ghcr.io/user/myapp:latest       ← latest of all builds

# === Result for git tag v2.4.1: ===
# ghcr.io/user/myapp:v2.4.1       ← semantic version
# ghcr.io/user/myapp:2.4          ← minor version
# ghcr.io/user/myapp:latest       ← latest

# === Deploying: use SHA tag ===
# helm upgrade myapp chart/ \
#   --set image.tag=sha-a3f7c2d
# → Exact reproducible deployment, easy rollback

FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY src/ ./src/

FROM node:20-alpine
WORKDIR /app
RUN addgroup -S app && adduser -S app -G app
COPY --from=builder /app .
USER app
EXPOSE 3000
CMD ["node", "src/index.js"]

node_modules
.git
coverage
*.md
.env
.github
tests