Node.js based image cleanup

src/alert-manager/build/alert-handler.common.dockerfile

@@ -1,25 +1,42 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
-FROM node:20
+# Build stage
+FROM node:20 AS builder
 
 RUN npm install -g npm@latest
 
-RUN apt update && apt upgrade -y
+WORKDIR /usr/src/app
+
+COPY ./src/alert-handler/package.json ./src/alert-handler/yarn.lock* ./src/alert-handler/.yarnrc.yml ./
 
-RUN apt purge -y subversion && apt autoremove -y
+RUN corepack enable && corepack install -g yarn@4.2.2
+RUN yarn workspaces focus --production
+
+COPY ./src/alert-handler .
+
+# Production stage - use slim image
+FROM node:20-slim
 
 WORKDIR /usr/src/app
 
 ENV NODE_ENV=production
 
+# Copy only production dependencies and application code
+COPY --from=builder /usr/src/app/node_modules ./node_modules
 COPY ./src/alert-handler .
 
-RUN corepack enable && corepack install -g yarn@4.2.2
-RUN yarn install
-
-# install python and dependencies
-RUN apt-get install -y python3-pip
-RUN pip3 install --no-cache-dir -r requirements.txt --break-system-packages
-
-ENTRYPOINT ["npm", "start"]
+# Remove npm and corepack to eliminate security warnings
+# Install python and dependencies
+RUN apt-get update &&  apt upgrade -y && \
+    apt purge -y subversion && \
+    apt-get install -y python3-pip && \
+    pip3 install --no-cache-dir -r requirements.txt --break-system-packages && \
+    apt-get remove -y python3-pip && \
+    apt-get autoremove -y && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /usr/local/lib/node_modules
+
+# Use node directly instead of npm
+ENTRYPOINT ["node", "index.js"]

src/alert-manager/build/job-status-change-notification.common.dockerfile

@@ -1,21 +1,45 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
-FROM node:20
+# Build stage
+FROM node:20 AS builder
 
 RUN npm install -g npm@latest
 
 WORKDIR /usr/src/app
 
-RUN apt update && apt upgrade -y
+# Copy all files first (needed for local file dependencies like openpaidbsdk)
+COPY ./src/job-status-change-notification .
+
+RUN corepack enable && corepack install -g yarn@4.2.2
+
+# Install all dependencies including devDependencies
+RUN yarn install
+
+# Manually remove devDependencies from node_modules
+RUN for dep in $(node -pe "Object.keys(require('./package.json').devDependencies || {}).join(' ')"); do \
+      rm -rf node_modules/$dep; \
+    done
 
-RUN apt purge -y subversion && apt autoremove -y
+# Production stage - use slim image
+FROM node:20-slim
+
+WORKDIR /usr/src/app
 
 ENV NODE_ENV=production
 
+# Copy only production dependencies and application code
+COPY --from=builder /usr/src/app/node_modules ./node_modules
 COPY ./src/job-status-change-notification .
 
-RUN corepack enable && corepack install -g yarn@4.2.2
-RUN yarn install
-
-ENTRYPOINT ["npm", "start"]
+# Remove npm and corepack to eliminate security warnings
+# Clean up apt cache
+RUN apt-get update && apt upgrade -y && \
+    apt purge -y subversion && \
+    apt-get autoremove -y && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /usr/local/lib/node_modules
+
+# Use node directly instead of npm
+ENTRYPOINT ["node", "index.js"]

src/alert-manager/src/alert-handler/package.json

@@ -64,8 +64,10 @@
     "nodemailer": "^7.0.11",
     "tar-fs": "^3.1.1",
     "@eslint/plugin-kit": "^0.3.3",
-    "qs": "^6.14.1",
+    "qs": "^6.14.2",
     "lodash": "^4.17.23",
+    "axios": "^1.13.5",
+    "minimatch": "^10.2.1",
     "form-data": "^4.0.4"
   },
   "scripts": {

src/alert-manager/src/alert-handler/yarn.lock

@@ -856,14 +856,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"axios@npm:^1.12.0":
-  version: 1.13.2
-  resolution: "axios@npm:1.13.2"
+"axios@npm:^1.13.5":
+  version: 1.13.5
+  resolution: "axios@npm:1.13.5"
   dependencies:
-    follow-redirects: "npm:^1.15.6"
-    form-data: "npm:^4.0.4"
+    follow-redirects: "npm:^1.15.11"
+    form-data: "npm:^4.0.5"
     proxy-from-env: "npm:^1.1.0"
-  checksum: 10c0/e8a42e37e5568ae9c7a28c348db0e8cf3e43d06fcbef73f0048669edfe4f71219664da7b6cc991b0c0f01c28a48f037c515263cb79be1f1ae8ff034cd813867b
+  checksum: 10c0/abf468c34f2d145f3dc7dbc0f1be67e520630624307bda69a41bbe8d386bd672d87b4405c4ee77f9ff54b235ab02f96a9968fb00e75b13ce64706e352a3068fd
   languageName: node
   linkType: hard
 
@@ -888,10 +888,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"balanced-match@npm:^1.0.0":
-  version: 1.0.2
-  resolution: "balanced-match@npm:1.0.2"
-  checksum: 10c0/9308baf0a7e4838a82bbfd11e01b1cb0f0cf2893bc1676c27c2a8c0e70cbae1c59120c3268517a8ae7fb6376b4639ef81ca22582611dbee4ed28df945134aaee
+"balanced-match@npm:^4.0.2":
+  version: 4.0.4
+  resolution: "balanced-match@npm:4.0.4"
+  checksum: 10c0/07e86102a3eb2ee2a6a1a89164f29d0dbaebd28f2ca3f5ca786f36b8b23d9e417eb3be45a4acf754f837be5ac0a2317de90d3fcb7f4f4dc95720a1f36b26a17b
   languageName: node
   linkType: hard
 
@@ -998,22 +998,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"brace-expansion@npm:^1.1.7":
-  version: 1.1.12
-  resolution: "brace-expansion@npm:1.1.12"
-  dependencies:
-    balanced-match: "npm:^1.0.0"
-    concat-map: "npm:0.0.1"
-  checksum: 10c0/975fecac2bb7758c062c20d0b3b6288c7cc895219ee25f0a64a9de662dbac981ff0b6e89909c3897c1f84fa353113a721923afdec5f8b2350255b097f12b1f73
-  languageName: node
-  linkType: hard
-
-"brace-expansion@npm:^2.0.1":
-  version: 2.0.2
-  resolution: "brace-expansion@npm:2.0.2"
+"brace-expansion@npm:^5.0.2":
+  version: 5.0.3
+  resolution: "brace-expansion@npm:5.0.3"
   dependencies:
-    balanced-match: "npm:^1.0.0"
-  checksum: 10c0/6d117a4c793488af86b83172deb6af143e94c17bc53b0b3cec259733923b4ca84679d506ac261f4ba3c7ed37c46018e2ff442f9ce453af8643ecd64f4a54e6cf
+    balanced-match: "npm:^4.0.2"
+  checksum: 10c0/e474d300e581ec56851b3863ff1cf18573170c6d06deb199ccbd03b2119c36975f6ce2abc7b770f5bebddc1ab022661a9fea9b4d56f33315d7bef54d8793869e
   languageName: node
   linkType: hard
 
@@ -1167,13 +1157,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"concat-map@npm:0.0.1":
-  version: 0.0.1
-  resolution: "concat-map@npm:0.0.1"
-  checksum: 10c0/c996b1cfdf95b6c90fee4dae37e332c8b6eb7d106430c17d538034c0ad9a1630cb194d2ab37293b1bdd4d779494beee7786d586a50bd9376fd6f7bcc2bd4c98f
-  languageName: node
-  linkType: hard
-
 "constantinople@npm:^4.0.1":
   version: 4.0.1
   resolution: "constantinople@npm:4.0.1"
@@ -2248,7 +2231,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"follow-redirects@npm:^1.15.6":
+"follow-redirects@npm:^1.15.11":
   version: 1.15.11
   resolution: "follow-redirects@npm:1.15.11"
   peerDependenciesMeta:
@@ -3273,21 +3256,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimatch@npm:^3.0.4, minimatch@npm:^3.1.2":
-  version: 3.1.2
-  resolution: "minimatch@npm:3.1.2"
-  dependencies:
-    brace-expansion: "npm:^1.1.7"
-  checksum: 10c0/0262810a8fc2e72cca45d6fd86bd349eee435eb95ac6aa45c9ea2180e7ee875ef44c32b55b5973ceabe95ea12682f6e3725cbb63d7a2d1da3ae1163c8b210311
-  languageName: node
-  linkType: hard
-
-"minimatch@npm:^5.0.1":
-  version: 5.1.6
-  resolution: "minimatch@npm:5.1.6"
+"minimatch@npm:^10.2.1":
+  version: 10.2.2
+  resolution: "minimatch@npm:10.2.2"
   dependencies:
-    brace-expansion: "npm:^2.0.1"
-  checksum: 10c0/3defdfd230914f22a8da203747c42ee3c405c39d4d37ffda284dac5e45b7e1f6c49aa8be606509002898e73091ff2a3bbfc59c2c6c71d4660609f63aa92f98e3
+    brace-expansion: "npm:^5.0.2"
+  checksum: 10c0/098831f2f542cb802e1f249c809008a016e1fef6b3a9eda9cf9ecb2b3d7979083951bd47c0c82fcf34330bd3b36638a493d4fa8e24cce58caf5b481de0f4e238
   languageName: node
   linkType: hard
 
@@ -3951,12 +3925,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"qs@npm:^6.14.1":
-  version: 6.14.1
-  resolution: "qs@npm:6.14.1"
+"qs@npm:^6.14.2":
+  version: 6.15.0
+  resolution: "qs@npm:6.15.0"
   dependencies:
     side-channel: "npm:^1.1.0"
-  checksum: 10c0/0e3b22dc451f48ce5940cbbc7c7d9068d895074f8c969c0801ac15c1313d1859c4d738e46dc4da2f498f41a9ffd8c201bd9fb12df67799b827db94cc373d2613
+  checksum: 10c0/ff341078a78a991d8a48b4524d52949211447b4b1ad907f489cac0770cbc346a28e47304455c0320e5fb000f8762d64b03331e3b71865f663bf351bcba8cdb4b
   languageName: node
   linkType: hard
 

src/alert-manager/src/job-status-change-notification/package.json

@@ -47,8 +47,11 @@
   },
   "resolutions": {
     "@eslint/plugin-kit": "^0.3.3",
-    "qs": "^6.14.1",
+    "qs": "^6.14.2",
     "lodash": "^4.17.23",
+    "axios": "^1.13.5",
+    "minimatch": "^10.2.1",
+    "ajv": "^8.18.0",
     "form-data": "^4.0.4"
   },
   "scripts": {