ci: build and push image to Gitlab registry

Author: rebecamurillo

.dockerignore

@@ -0,0 +1,24 @@
+# Node & build artifacts
+node_modules
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Output directories
+.dist
+/build
+dist
+
+# VCS & editor
+.git
+.gitignore
+.vscode
+.DS_Store
+
+# Prisma generated files can be regenerated
+prisma/*.db
+
+# Local env files (provide via secrets at runtime)
+.env
+.env.*

.github/workflows/build-push-docker.yml

@@ -0,0 +1,57 @@
+name: Build and Push Docker image to GitLab Registry
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+env:
+  REGISTRY: ${{ vars.GITLAB_REGISTRY || 'registry.gitlab.inria.fr' }}
+  PROJECT_PATH: ${{ vars.GITLAB_PROJECT_PATH || 'inocs-lab/inocs-sum-odp-frontend' }}
+
+jobs:
+  docker:
+    name: Build and Push
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitLab Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: gitlab-ci-token
+          password: ${{ secrets.GITLAB_REGISTRY_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.PROJECT_PATH }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=sha,format=short
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Show pushed tags
+        run: |
+          echo "Pushed:"
+          echo "${{ steps.meta.outputs.tags }}" | tr ' ' '\n'

Dockerfile

@@ -0,0 +1,67 @@
+# syntax=docker/dockerfile:1.7
+
+# --- Stage 1: Build Astro app -------------------------------------------------
+FROM node:20-bookworm-slim AS builder
+ENV NODE_ENV=production
+
+# Install minimal utilities (for Prisma + SSL + debugging)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates openssl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Copy dependency files first (better build cache)
+COPY package.json package-lock.json ./
+
+# Install full dependencies (including dev for build)
+RUN npm ci
+
+# Copy Prisma schema & generate client
+COPY prisma ./prisma
+RUN npx prisma generate
+
+# Copy source files and build the project
+COPY . .
+RUN npm run build
+
+# --- Stage 2: Production dependencies only ------------------------------------
+FROM node:20-bookworm-slim AS prod-deps
+ENV NODE_ENV=production
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+
+# Install only production dependencies (omit dev)
+RUN npm ci --omit=dev
+
+# Copy Prisma schema and regenerate client (ensures correct runtime client)
+COPY prisma ./prisma
+RUN npx prisma generate
+
+# --- Stage 3: Final runtime image ---------------------------------------------
+FROM node:20-bookworm-slim AS runner
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=4321
+
+WORKDIR /app
+
+# Copy built app & runtime dependencies
+COPY --from=builder /app/dist ./dist
+COPY --from=prod-deps /app/node_modules ./node_modules
+COPY --from=prod-deps /app/prisma ./prisma
+COPY package.json ./
+
+# Ensure ownership and drop privileges
+RUN chown -R node:node /app
+USER node
+
+# Expose Astro Node adapter default port
+EXPOSE 4321
+
+# Optional healthcheck for container orchestration
+# HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+#   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "./dist/server/entry.mjs"]