From 83133eef17f027869b33cd157567502da64c8b20 Mon Sep 17 00:00:00 2001
From: Lizandro Guarnizo <77708265+lizandrogd@users.noreply.github.com>
Date: Tue, 9 Jun 2026 22:00:11 -0500
Subject: [PATCH] ci: single-stage builder + hoisted (elimina deps stage, muy
 problematico)

---
 apps/api/Dockerfile | 11 +++--------
 apps/web/Dockerfile |  9 +--------
 2 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index 0a39169..f61f4aa 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -3,24 +3,19 @@ FROM node:22-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
 WORKDIR /app
 
-FROM base AS deps
-COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
-COPY apps/api/package.json ./apps/api/
-COPY packages/database/ ./packages/database/
-RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install --no-frozen-lockfile
-
 FROM base AS builder
 COPY . .
-COPY --from=deps /app/node_modules ./node_modules
-RUN rm -f pnpm-lock.yaml && pnpm install --no-frozen-lockfile --force
+RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install --no-frozen-lockfile --force
 RUN pnpm --filter @moraworld/database exec prisma generate && pnpm --filter @moraworld/database build
 RUN pnpm --filter @moraworld/api build
 
 FROM node:22-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
+RUN addgroup -S app && adduser -S app app
 COPY --from=builder /app/apps/api/dist ./dist
 COPY --from=builder /app/apps/api/package.json ./
 COPY --from=builder /app/node_modules ./node_modules
+USER app
 EXPOSE 3001
 CMD ["node", "dist/main.js"]
\ No newline at end of file
diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index c366424..3134a2a 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -3,16 +3,9 @@ FROM node:22-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
 WORKDIR /app
 
-FROM base AS deps
-COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
-COPY apps/web/package.json ./apps/web/
-COPY packages/database/ ./packages/database/
-RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install --no-frozen-lockfile
-
 FROM base AS builder
 COPY . .
-COPY --from=deps /app/node_modules ./node_modules
-RUN rm -f pnpm-lock.yaml && pnpm install --no-frozen-lockfile --force
+RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install --no-frozen-lockfile --force
 ARG NEXT_PUBLIC_API_URL=http://localhost:3001
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
 RUN pnpm --filter @moraworld/web build