feat: migrate kukkuu admin yarn to pnpm

* chore: migrate from yarn to pnpm

KK-1539

- Pin pnpm@11.5.0 via packageManager field + engines.pnpm
- Convert yarn.lock to pnpm-lock.yaml via pnpm import
- Translate yarn resolutions to pnpm overrides in pnpm-workspace.yaml
- Add supply-chain guardrail: minimumReleaseAge 10080
- Allow native build scripts: esbuild, full-icu, @ffmpeg-installer
- Declare formerly-phantom deps that yarn's flat node_modules
  hoisted (lodash, react-query, react-hook-form, react-router,
  react-router-dom, ra-core, ra-i18n-polyglot, @mui/styled-engine),
  deduped to the versions react-admin already resolves
- Drop stale v5 @types/react-router* (code uses v6, ships own types)
- Remove CRA-leftover src/react-app-env.d.ts (imported react-scripts)
- Update Dockerfile to install pnpm via corepack (ubi9/Node 20)
- CI to City-of-Helsinki/.github ci-pnpm-node.yml reusable workflow
- Replace yarn with pnpm in husky hooks, lint-staged, README, scripts
- Add yarn.lock, .yarn/, .yarnrc.yml to .gitignore

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: runtime env config, Node 24 and Helsinki base images

KK-1539

Phase 2 of the pnpm migration: adopt the runtime environment
configuration approach from kukkuu-ui (PR #757) and move onto the
shared Helsinki base images on Node 24.

- Add envUtils getEnvValue(key): window._env_ -> process.env ->
  import.meta.env fallback (src/common/utils/envUtils.ts)
- Generate public/env-config.js via scripts/update-runtime-env.ts,
  load it in index.html; add src/types/env.d.ts and tsx devDep
- Prefix start/build scripts with update-runtime-env
- Migrate all import.meta.env.VITE_* reads to getEnvValue
- Bump to Node 24 (.nvmrc, engines.node, @types/node, CI)
- Dockerfile: ubi9/nodejs-24-pnpm-builder-base builder +
  ubi10/nginx-126-spa-standard production with runtime env.sh
  injection; COPY .env.example as .env; drop build-time VITE_ args
  (kept VITE_CSP_REPORT_URI for the index.html CSP)
- Remove the custom .prod/nginx.conf.template (base image provides
  nginx and the /readiness endpoint)
- Ignore generated env-config.js in eslint/prettier

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: restrict runtime env-config.js to VITE_ keys (no secret leakage)

KK-1539

env-config.js is served publicly, so anything in window._env_ is
world-readable. Harden the runtime env injection so it cannot expose
secrets, restoring the secure-by-default boundary that Vite's envPrefix
gave the old import.meta.env model.

- update-runtime-env.ts: emit only VITE_-prefixed keys (plus NODE_ENV)
  into env-config.js, mirroring Vite's envPrefix. Secrets such as
  BROWSER_TESTS_JWT_SIGN_SECRET can no longer leak into the browser
  bundle even if present in the build/runtime environment.
- .env.example: drop BROWSER_TESTS_* keys. This file is also copied
  into the production image as the env-config.js key template;
  browser-test settings (incl. secrets) belong in .env.test.local
  (see .env.test.local.example).

Recommended hardening for other City-of-Helsinki SPAs using the same
runtime env-config.js pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* build: temporaly ref to review pipeline

* chore: sync pnpm lockfile with main's vite 8 / vitest 4 bumps

* fix: parse boolean env vars correctly, fix OIDC scope error label

Address bot review findings on PR #394:

- Add getEnvBoolean() helper. getEnvValue() returns env values as strings,
  so Boolean(value) treated "false"/"0" as true. This broke
  IS_TEST_ENVIRONMENT (".env.example"/".env.test" set it to 0, so it was
  always true) and made VITE_OIDC_AUTOMATIC_SILENT_RENEW_ENABLED impossible
  to disable. The helper recognizes true/1 and false/0 (case-insensitive).
- Fix trailing-comma typo in the VITE_OIDC_SCOPE getEnvOrError label.
- Add regression tests for IS_TEST_ENVIRONMENT parsing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* build: trim Docker build context via .dockerignore

Address review feedback (mikkojamG) on the broad `COPY . ./` in the
build stage. The final production image is already lean (only /build
is copied into the nginx stage), but the shared appbase/staticbuilder
layers and the build context pulled in everything. Exclude paths
outside the production build graph (tsconfig "include" is ["src"]):
tests, browser-tests, docs, pipelines, .github, and the
codegen/lint/release tooling and quality reports.

Also:
- exclude *.local env files so local secrets (e.g. the browser-test
  JWT secret in .env.test.local) are never baked into an image layer.
- fix a stale entry: LICENSE -> LICENSE.md (old pattern never matched).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* build: copy only build-needed files in Dockerfile

Replace the broad `COPY . ./` in the build stage with explicit copies,
matching the pattern used in other City-of-Helsinki UI repos (e.g.
kerrokantasi-ui). Per stage:
- copy scripts/, public/ and .env* before running update-runtime-env;
- copy the build configs (Vite, .babelrc for @vitejs/plugin-react, and
  the eslint/prettier configs run by @nabla/vite-plugin-eslint) plus
  src/ for the `tsc && vite build`.

Editing src/ no longer invalidates the install/update-runtime-env
layers, and only the production build graph enters the image.

Verified locally: staticbuilder, production and development targets all
build successfully (tsc + vite build pass, assets emitted).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: sanitize env before copying to container

* fix: set dev OIDC config for review env browser tests

The browser-test harness mints its login-bypass session for the
dev OIDC client (kukkuu-admin-ui-dev) and uses the dev API, but the
deployed review app read its client id from env-config.js, which
fell back to the test default (kukkuu-admin-ui-test) from
.env.example. oidc-client-ts keys the stored session as
oidc.user:{authority}:{client_id}, so the mismatch meant the app
never found the injected session and every test was stuck on the
login page.

Override the dev VITE_OIDC_* / VITE_API_URI values in the review
pipeline's configMap so the runtime env-config.js matches what the
harness expects. The kukkuu-pipelines template ref (pnpm_KK-1539)
currently omits these; this override can be dropped once that ref
is reverted to default.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* build: removed temporal ref

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Tero Virtanen <tero.tapio.virtanen@gmail.com>

Author: 3 people

.dockerignore

@@ -1,12 +1,55 @@
+# Keep the build context small and the appbase/staticbuilder layers cache-stable:
+# only src/, index.html, public/, scripts/ and the build configs are needed for
+# `pnpm build` (tsconfig "include" is just ["src"]). Everything excluded here is
+# outside the production build graph.
+
+# Dependencies & build output (reinstalled/regenerated in the image)
 node_modules
+build
 npm-debug.log
+.eslintcache
+
+# Docker / compose (not needed inside the image)
 Dockerfile*
 docker-compose*
 compose.*
 .dockerignore
+
+# VCS & editor
 .git
 .gitignore
-README.md
-LICENSE
 .vscode
-build
+
+# Local env files that may contain secrets. The image gets its config at runtime
+# (env.sh) and its key template from .env.example — never bake local secrets into
+# an image layer.
+*.local
+
+# Docs, CI/CD and repo meta — not part of the production build
+README.md
+LICENSE.md
+CHANGELOG.md
+CODEOWNERS
+docs
+.github
+pipelines
+
+# Tests & test tooling (the build only compiles src/)
+tests
+browser-tests
+.testcaferc.json
+
+# GraphQL codegen (run separately, not during the production build)
+codegen.ts
+apollo.config.js
+
+# Lint / commit / release tooling (git-hook & release-time only)
+.husky
+lint-staged.config.js
+commitlint.config.cjs
+release-please-config.json
+.release-please-manifest.json
+
+# Quality reports
+sonar-project.properties
+sonar-report.json

.env.example

@@ -12,6 +12,8 @@ VITE_API_URI=https://kukkuu.api.test.hel.ninja/graphql
 VITE_IS_TEST_ENVIRONMENT=0
 VITE_IDLE_TIMEOUT_IN_MS=3600000
 
-BROWSER_TESTS_UID=
-BROWSER_TESTS_PWD=
-BROWSER_TESTS_ENV_URL=http://localhost:3001
+# NOTE: Only client-safe VITE_* variables (and PORT) belong here. This file is
+# the source of truth for the app's runtime config and is also copied into the
+# production image as the env-config.js key template, which is served publicly.
+# Browser-test settings (incl. secrets) live in .env.test.local — see
+# .env.test.local.example.

.eslintignore

@@ -1,2 +1,4 @@
 src/domain/api/generatedTypes/graphql.tsx
 build/*
+public/env-config.js
+public/test-env-config.js

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   common:
-    uses: City-of-Helsinki/.github/.github/workflows/ci-node.yml@main
+    uses: City-of-Helsinki/.github/.github/workflows/ci-pnpm-node.yml@main
     secrets: inherit
     with:
-      node-version: 20
+      node-version: 24

.gitignore

@@ -11,8 +11,13 @@
 # production
 /build
 
+# runtime env config generated by scripts/update-runtime-env.ts
+public/env-config.js
+public/test-env-config.js
+
 # misc
 .DS_Store
+.eslintcache
 .env.local
 .env.development.local
 .env.test.local
@@ -22,6 +27,9 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+yarn.lock
+.yarn/
+.yarnrc.yml
 
 # browser test screenshots
 screenshots

.husky/pre-commit

@@ -1,2 +1,2 @@
-yarn doctoc .
-yarn lint-staged --relative
+pnpm doctoc .
+pnpm lint-staged --relative

.nvmrc

@@ -1 +1 @@
-v20.19.5
+v24.15.0

.prettierignore

@@ -1,3 +1,5 @@
 .yarn
 graphql.ts
-graphql.tsx
+graphql.tsx
+public/env-config.js
+public/test-env-config.js

.prod/nginx.conf.template

@@ -1,45 +1,54 @@
-# ===============================================
-FROM registry.access.redhat.com/ubi9/nodejs-20 AS appbase
-# ===============================================
-
-# install yarn
-USER root
-RUN curl --silent --location https://dl.yarnpkg.com/rpm/yarn.repo | tee /etc/yum.repos.d/yarn.repo
-RUN yum -y install yarn
-
+# ============================================================
+# STAGE 1: Build base (install dependencies)
+# ============================================================
+FROM helsinki.azurecr.io/ubi9/nodejs-24-pnpm-builder-base AS appbase
 WORKDIR /app
 
-# Offical image has npm log verbosity as info. More info - https://github.com/nodejs/docker-node#verbosity
-ENV NPM_CONFIG_LOGLEVEL warn
-
-# set our node environment, either development or production
-# defaults to production, compose overrides this to development on build and run
-ARG NODE_ENV=${NODE_ENV:-"production"}
-ENV NODE_ENV $NODE_ENV
-
-# Global npm deps in a non-root user directory
-ENV NPM_CONFIG_PREFIX=/app/.npm-global
-ENV PATH=$PATH:/app/.npm-global/bin
-
-# Yarn
-ENV YARN_VERSION 1.22.22
-RUN yarn policies set-version ${YARN_VERSION}
-
-# Copy package.json and package-lock.json/yarn.lock files
-COPY --chown=default:root package*.json *yarn* ./
-
-# Install npm dependencies
-ENV PATH /app/node_modules/.bin:$PATH
-
-RUN yarn install --frozen-lockfile --ignore-scripts && yarn cache clean --force
-
-# =============================
+# Defaults to production; compose overrides this to development on build and run.
+ARG NODE_ENV=production
+ENV NODE_ENV=$NODE_ENV
+
+# 1. Install dependencies (cached unless the manifests change).
+# corepack in the base image uses the pnpm version from package.json's
+# "packageManager" field automatically.
+COPY --chown=default:root package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN pnpm install --frozen-lockfile --ignore-scripts && pnpm store prune
+
+# 2. Generate a build-time public/env-config.js. Its *contents* are overwritten
+# at container start by the base image's env.sh with the real runtime values.
+# update-runtime-env only needs the script, the public/ output dir and the .env
+# key templates, so copy just those — editing src/ won't invalidate this layer.
+COPY --chown=default:root scripts ./scripts
+COPY --chown=default:root public ./public
+COPY --chown=default:root .env* ./
+RUN pnpm update-runtime-env
+
+# 3. Copy only the sources the production build (`tsc && vite build`) consumes.
+# tsconfig "include" is ["src"]; the build also reads these root configs — Vite
+# itself, the babel presets used by @vitejs/plugin-react, and the eslint/prettier
+# configs run by @nabla/vite-plugin-eslint. Tests, docs, codegen and other
+# tooling are intentionally left out (and also pruned via .dockerignore).
+COPY --chown=default:root \
+  index.html \
+  vite.config.ts \
+  tsconfig.json \
+  vite-env.d.ts \
+  .babelrc \
+  .eslintrc.cjs \
+  .eslintignore \
+  .prettierrc.json \
+  .prettierignore \
+  ./
+COPY --chown=default:root src ./src
+
+# ============================================================
+# STAGE 2: Development
+# ============================================================
 FROM appbase AS development
-# =============================
+WORKDIR /app
 
-# Set NODE_ENV to development in the development container
 ARG NODE_ENV=development
-ENV NODE_ENV $NODE_ENV
+ENV NODE_ENV=$NODE_ENV
 
 # Enable hot reload by default by polling for file changes.
 #
@@ -48,77 +57,51 @@ ENV NODE_ENV $NODE_ENV
 ARG CHOKIDAR_USEPOLLING=true
 ENV CHOKIDAR_USEPOLLING=${CHOKIDAR_USEPOLLING}
 
-# copy in our source code last, as it changes the most
-COPY --chown=default:root . .
+# `pnpm start` runs update-runtime-env then vite (port from PORT env, default 3001).
+CMD ["pnpm", "start", "--no-open", "--host"]
 
-# Bake package.json start command into the image
-CMD ["yarn", "start", "--no-open", "--host"]
-
-# ===================================
+# ============================================================
+# STAGE 3: Static builder for production
+# ============================================================
 FROM appbase AS staticbuilder
-# ===================================
-
-ARG VITE_API_URI
-ARG VITE_OIDC_SERVER_TYPE
-ARG VITE_OIDC_RETURN_TYPE
-ARG VITE_OIDC_AUTHORITY
-ARG VITE_OIDC_CLIENT_ID
-ARG VITE_OIDC_KUKKUU_API_CLIENT_ID
-ARG VITE_OIDC_SCOPE
-ARG VITE_OIDC_AUDIENCES
-ARG VITE_OIDC_AUTOMATIC_SILENT_RENEW_ENABLED
-ARG VITE_OIDC_SESSION_POLLING_INTERVAL_MS
-ARG VITE_KUKKUU_API_OIDC_SCOPE
-ARG VITE_SENTRY_ENVIRONMENT
-ARG VITE_SENTRY_DSN
-ARG VITE_SENTRY_TRACES_SAMPLE_RATE
-ARG VITE_SENTRY_TRACE_PROPAGATION_TARGETS
-ARG VITE_SENTRY_REPLAYS_SESSION_SAMPLE_RATE
-ARG VITE_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE
+
+# VITE_CSP_REPORT_URI is substituted into index.html's CSP at *build* time by
+# Vite (it is not a runtime value). Default to empty so the placeholder is not
+# left unreplaced in the output.
 ARG VITE_CSP_REPORT_URI
-ARG VITE_IS_TEST_ENVIRONMENT
-ARG VITE_BUILDTIME
-ARG VITE_SENTRY_RELEASE
-ARG VITE_COMMITHASH
-ARG VITE_IDLE_TIMEOUT_IN_MS
-ARG NODE_OPTIONS
-
-# Fix FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - 
-# JavaScript heap out of memory: https://github.com/vitejs/vite/issues/2433.
-ENV NODE_OPTIONS=${NODE_OPTIONS}
 ENV VITE_CSP_REPORT_URI=${VITE_CSP_REPORT_URI:-""}
 
-# Use template and inject the environment variables into .prod/nginx.conf
-ENV VITE_BUILDTIME=${VITE_BUILDTIME:-""}
-ENV VITE_RELEASE=${VITE_SENTRY_RELEASE:-""}
-ENV VITE_COMMITHASH=${VITE_COMMITHASH:-""}
-COPY .prod/nginx.conf.template /tmp/.prod/nginx.conf.template
-RUN export APP_VERSION=$(yarn --silent app:version) && \
-    envsubst '${APP_VERSION},${VITE_BUILDTIME},${VITE_RELEASE},${VITE_COMMITHASH}' < \
-    "/tmp/.prod/nginx.conf.template" > \
-    "/tmp/.prod/nginx.conf"
-
-COPY . /app
-RUN yarn build
-
-# =============================
-FROM registry.access.redhat.com/ubi9/nginx-122 AS production
-# =============================
-# Add application sources to a directory that the assemble script expects them
-# and set permissions so that the container runs without root access
-USER root
-
-RUN chgrp -R 0 /usr/share/nginx/html && \
-    chmod -R g=u /usr/share/nginx/html
-
-# Copy static build
-COPY --from=staticbuilder /app/build /usr/share/nginx/html
-# Copy nginx config
-COPY --from=staticbuilder /tmp/.prod/nginx.conf  /etc/nginx/nginx.conf
+RUN pnpm build
+
+# Produce a sanitized runtime env template for the production image. The base
+# image's env.sh is a naive KEY=VALUE parser: it does NOT skip comments or blank
+# lines, so any "# comment"/blank line in .env makes it emit an empty-key entry
+# (`: ""`) or duplicate the previous key — corrupting env-config.js into invalid
+# JavaScript (SyntaxError at load → window._env_ undefined → app can't boot).
+# Keep only `KEY=VALUE` lines so env.sh always generates valid JS.
+RUN grep -E '^[A-Za-z_][A-Za-z0-9_]*=' .env.example > .env.runtime
 
-USER 1001
+# ============================================================
+# STAGE 4: Production runtime
+# ============================================================
+FROM helsinki.azurecr.io/ubi10/nginx-126-spa-standard AS production
 
-# Run script uses standard ways to run the application
-CMD ["/bin/bash", "-c", "nginx -g \"daemon off;\""]
+# 1. Copy the compiled assets.
+COPY --from=staticbuilder /app/build /usr/share/nginx/html
 
-EXPOSE 8080
+# 2. Runtime env injection inputs (env.sh from the base image reads these).
+# .env lists which keys to expose in env-config.js; the values are overwritten
+# at container start with the real runtime environment. Use the sanitized,
+# comment-free template (see staticbuilder) — the base image's env.sh cannot
+# parse comments/blank lines and would otherwise emit invalid JavaScript.
+WORKDIR /usr/share/nginx/html
+COPY --from=staticbuilder /app/.env.runtime ./.env
+
+# 3. package.json powers the base image's /readiness version endpoint.
+COPY package.json .
+
+# Inherited from the base image:
+#   - env.sh at /usr/share/nginx/html/env.sh
+#   - USER 1001
+#   - EXPOSE 8080
+#   - ENTRYPOINT/CMD