dofigen.yml

ignore:
  - node_modules
  - /apps/docs
  - /apps/screenshot-service
  - /apps/server
  - /apps/web
  - /apps/dashboard
  - /apps/status-page
  - /packages/analytics
  - /packages/api
  - /packages/error
  - /packages/tracker
builders:
  install:
    fromImage: node:24-slim
    workdir: /app/
    labels:
      org.opencontainers.image.stage: install
    # Railway's builder rejects --mount=type=bind (only type=cache is supported), so copy the
    # manifests into the layer instead of bind-mounting them. Per-file targets preserve the
    # workspace directory structure (multi-source COPY into a dir would flatten the paths).
    copy:
      - pnpm-workspace.yaml /app/pnpm-workspace.yaml
      - pnpm-lock.yaml /app/pnpm-lock.yaml
      - package.json /app/package.json
      - apps/workflows/package.json /app/apps/workflows/package.json
      - packages/assertions/package.json /app/packages/assertions/package.json
      - packages/db/package.json /app/packages/db/package.json
      - packages/emails/package.json /app/packages/emails/package.json
      - packages/notifications/base/package.json /app/packages/notifications/base/package.json
      - packages/notifications/discord/package.json /app/packages/notifications/discord/package.json
      - packages/notifications/email/package.json /app/packages/notifications/email/package.json
      - packages/notifications/grafana-oncall/package.json /app/packages/notifications/grafana-oncall/package.json
      - packages/notifications/google-chat/package.json /app/packages/notifications/google-chat/package.json
      - packages/notifications/ms-teams/package.json /app/packages/notifications/ms-teams/package.json
      - packages/notifications/ntfy/package.json /app/packages/notifications/ntfy/package.json
      - packages/notifications/opsgenie/package.json /app/packages/notifications/opsgenie/package.json
      - packages/notifications/pagerduty/package.json /app/packages/notifications/pagerduty/package.json
      - packages/notifications/slack/package.json /app/packages/notifications/slack/package.json
      - packages/notifications/telegram/package.json /app/packages/notifications/telegram/package.json
      - packages/notifications/bird-whatsapp/package.json /app/packages/notifications/bird-whatsapp/package.json
      - packages/notifications/twillio-sms/package.json /app/packages/notifications/twillio-sms/package.json
      - packages/notifications/webhook/package.json /app/packages/notifications/webhook/package.json
      - packages/importers/package.json /app/packages/importers/package.json
      - packages/regions/package.json /app/packages/regions/package.json
      - packages/services/package.json /app/packages/services/package.json
      - packages/subscriptions/package.json /app/packages/subscriptions/package.json
      - packages/utils/package.json /app/packages/utils/package.json
      - packages/tsconfig/package.json /app/packages/tsconfig/package.json
      - packages/tinybird/package.json /app/packages/tinybird/package.json
      - packages/upstash/package.json /app/packages/upstash/package.json
      - packages/theme-store/package.json /app/packages/theme-store/package.json
      - packages/locales/package.json /app/packages/locales/package.json
      - packages/status-fetcher/package.json /app/packages/status-fetcher/package.json

    # Install dependencies (scoped to the workflows subgraph so node_modules — and the binary that embeds it — stays small)
    run:
      - corepack enable pnpm
      - pnpm install --prod --frozen-lockfile --filter=@openstatus/workflows... --verbose
    cache:
      # Railway scopes cache mounts per service: the id must be literally
      # s/<service-id>-<target> (env vars aren't allowed in the id).
      - id: s/3a5c916e-f3f2-4f35-ba0e-3c8511b6f9a3-/root/.local/share/pnpm/store
        target: /root/.local/share/pnpm/store
        sharing: locked

  # Stage 4: Build application (compile to binary with Deno)
  build:
    fromImage: denoland/deno:2.9.0
    workdir: /app/apps/workflows
    labels:
      org.opencontainers.image.stage: build
    copy:
      - . /app/
      - fromBuilder: install
        source: /app/node_modules
        target: /app/node_modules
      - fromBuilder: install
        source: /app/apps/workflows/node_modules
        target: /app/apps/workflows/node_modules
      - fromBuilder: install
        source: /app/packages
        target: /app/packages
    env:
      NODE_ENV: production
    # Bundle the app to self-contained JS, EXTERNALISING the 3 packages that can't be inlined:
    # @libsql/client + libsql (native .node loader) and @google-cloud/tasks (google-proto-files reads
    # files via CJS __dirname). They ship as a minimal side-car node_modules (deno install, ~46MB,
    # platform-aware so Fly amd64 works) instead of embedding all node_modules. Binary ~146MB vs ~360MB.
    run:
      - mkdir -p /tmp/sc
      - deno eval 'const p="/app/node_modules/.pnpm";const v=(x)=>{for(const e of Deno.readDirSync(p))if(e.name.startsWith(x+"@"))return e.name.slice(x.length+1).split("_")[0]};Deno.writeTextFileSync("/tmp/sc/package.json",JSON.stringify({dependencies:{"@libsql/client":v("@libsql+client"),libsql:v("libsql"),"@google-cloud/tasks":v("@google-cloud+tasks")}}))'
      - cd /tmp/sc && deno install --node-modules-dir=auto --allow-scripts
      - cd /app/apps/workflows && deno bundle --platform=deno --minify --sloppy-imports --node-modules-dir=manual --external '@libsql/client' --external 'libsql' --external '@google-cloud/tasks' --output /tmp/sc/_serve.bundle.mjs src/serve.ts
      - cd /tmp/sc && deno compile --no-check -A --node-modules-dir=manual --output /app/apps/workflows/app /tmp/sc/_serve.bundle.mjs
      - mkdir -p /app/data

# Runtime: distroless glibc base that already ships curl + CA certs (Deno's HTTPS works on it; no apt needed).
# Pinned to the multi-arch index digest of hi/curl:latest — dofigen mis-resolves this registry's tag to an unpullable digest.
fromImage: registry.access.redhat.com/hi/curl@sha256:848b81ab5d5e55371d7193fd4f1ea7b605d14dbb039344ffad34a4c1f0d880f4
workdir: /app/

# Metadata labels
labels:
  org.opencontainers.image.title: OpenStatus Workflows
  org.opencontainers.image.description: Background job processing and probe scheduling for OpenStatus
  org.opencontainers.image.source: https://github.com/openstatusHQ/openstatus
  org.opencontainers.image.vendor: OpenStatus
  org.opencontainers.image.authors: OpenStatus Team

# Copy the self-contained compiled binary (native addon embedded by deno compile)
copy:
  - fromBuilder: build
    source: /app/apps/workflows/app
    target: /app/apps/workflows/
    chmod: "555"
  - fromBuilder: build
    source: /app/data
    target: /app/data

user: "1000:1000"
expose: "3000"

# Health check — exec form (JSON array) because the base has no shell for CMD-SHELL
healthcheck:
  interval: 1m
  timeout: 10s
  start: 30s
  retries: 3
  cmd: '["curl", "-f", "http://localhost:3000/ping"]'

entrypoint: /app/apps/workflows/app