From 7caa46c2da7f3d4dd116f19acf3902a50772673b Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Thu, 17 Sep 2026 15:37:58 -0400 Subject: [PATCH] fix(build): exclude local package-lock.json from Docker build context MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lockfile is gitignored (each machine keeps its own), but .dockerignore did not exclude it, so any stale local lock rode into every docker build via `COPY package*.json`. Because the forked foliate-js declares "version": "0.0.0" on every commit, npm treats the git pin as already satisfied by name@version and never re-resolves the new commit hash — silently installing and bundling the old code. This bit both the host npm cache mount (documented at Dockerfile:18-20) and, today, `make rebuild-app-force`: a fresh no-cache image was built with the pre-feature 1305a52 foliate-js (chunk fixed-layout-B8-qRQLl.js) despite package.json pinning e16530a, while the Gitea runner (fresh checkout, no lockfile, cold cache) built correctly. With no lockfile in the context, npm install resolves git pins fresh from package.json each build (tarballs are cached by commit-specific URLs), so the persistent npm cache mount cannot serve old commits across pin bumps. Local lockfiles can no longer poison builds even if regenerated on the host. Verified: after evicting the poisoned cache mounts (docker builder prune --filter type=exec.cachemount) and rebuilding, the container serves fixed-layout-BE0KdOql.js with both dblclick handlers present, matching the reference build. --- .dockerignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.dockerignore b/.dockerignore index 5b7fcc1..69b613a 100644 --- a/.dockerignore +++ b/.dockerignore @@ -20,6 +20,9 @@ logs/ # Dependencies (install fresh in container) node_modules/ +# Local-only lockfile: a stale one pins old foliate-js commits into builds +# (npm reuses name@version without re-resolving the git pin) +package-lock.json # Environment .env