Merge pull request #3 from paperclipinc/feat/docker-ci

feat: production-grade Docker builds on push to main

Author: stubbi

.dockerignore

@@ -1,10 +1,29 @@
 .git
 .github
+.claude
 .paperclip
+.paperclip-local
 .pnpm-store
+.vscode
+.idea
+
 node_modules
 **/node_modules
 coverage
 data
 tmp
+tmp-*
+dist
+
+desktop
+docs
+evals
+tests
+docker
+
 *.log
+*.md
+!packages/**/README.md
+.env
+.env.*
+.DS_Store

.github/workflows/docker.yml

@@ -0,0 +1,71 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value={{date 'YYYY.MMDD'}},enable={{is_default_branch}}
+
+      - name: Build and push
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

Dockerfile

@@ -1,11 +1,20 @@
-FROM node:lts-trixie-slim AS base
+# ── Stage 1: base ─────────────────────────────────────────────
+# Pinned Node 22 on Debian Trixie slim for reproducibility.
+FROM node:22-trixie-slim AS base
+
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends ca-certificates curl git \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates curl git tini \
   && rm -rf /var/lib/apt/lists/*
+
 RUN corepack enable
 
+# ── Stage 2: deps ─────────────────────────────────────────────
+# Install only production + build dependencies using lockfile.
 FROM base AS deps
 WORKDIR /app
+
+# Copy workspace manifests first (layer caching)
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc ./
 COPY cli/package.json cli/
 COPY server/package.json server/
@@ -20,23 +29,62 @@ COPY packages/adapters/gemini-local/package.json packages/adapters/gemini-local/
 COPY packages/adapters/openclaw-gateway/package.json packages/adapters/openclaw-gateway/
 COPY packages/adapters/opencode-local/package.json packages/adapters/opencode-local/
 COPY packages/adapters/pi-local/package.json packages/adapters/pi-local/
+COPY packages/plugins/sdk/package.json packages/plugins/sdk/
+COPY packages/plugins/create-paperclip-plugin/package.json packages/plugins/create-paperclip-plugin/
 
 RUN pnpm install --frozen-lockfile
 
+# ── Stage 3: build ────────────────────────────────────────────
+# Build UI and server from source.
 FROM base AS build
 WORKDIR /app
+
 COPY --from=deps /app /app
 COPY . .
-RUN pnpm --filter @paperclipai/ui build
-RUN pnpm --filter @paperclipai/server build
-RUN test -f server/dist/index.js || (echo "ERROR: server build output missing" && exit 1)
 
-FROM base AS production
+RUN pnpm --filter @paperclipai/ui build \
+  && pnpm --filter @paperclipai/server build \
+  && test -f server/dist/index.js || (echo "ERROR: server build output missing" && exit 1)
+
+# Prune dev dependencies after build
+RUN pnpm prune --prod --no-optional
+
+# ── Stage 4: production ───────────────────────────────────────
+# Minimal runtime image — no build tools, no source code bloat.
+FROM node:22-trixie-slim AS production
+
+# Labels for container registries
+LABEL org.opencontainers.image.source="https://github.com/paperclipinc/paperclip"
+LABEL org.opencontainers.image.description="Paperclip — AI company orchestration platform"
+LABEL org.opencontainers.image.vendor="Paperclip Inc."
+LABEL org.opencontainers.image.licenses="MIT"
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates curl git tini \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN corepack enable
+
+# Install agent runtimes globally
+RUN npm install --global --omit=dev \
+    @anthropic-ai/claude-code@latest \
+    @openai/codex@latest \
+    opencode-ai \
+  && npm cache clean --force
+
+# Create data directory
+RUN mkdir -p /paperclip && chown node:node /paperclip
+
 WORKDIR /app
-COPY --chown=node:node --from=build /app /app
-RUN npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest opencode-ai \
-  && mkdir -p /paperclip \
-  && chown node:node /paperclip
+
+# Copy only built artifacts and production dependencies
+COPY --chown=node:node --from=build /app/package.json /app/pnpm-workspace.yaml /app/.npmrc ./
+COPY --chown=node:node --from=build /app/node_modules ./node_modules
+COPY --chown=node:node --from=build /app/server ./server
+COPY --chown=node:node --from=build /app/ui/dist ./ui/dist
+COPY --chown=node:node --from=build /app/cli ./cli
+COPY --chown=node:node --from=build /app/packages ./packages
 
 ENV NODE_ENV=production \
   HOME=/paperclip \
@@ -52,5 +100,12 @@ ENV NODE_ENV=production \
 VOLUME ["/paperclip"]
 EXPOSE 3100
 
+# Run as non-root
 USER node
+
+# Use tini as PID 1 for proper signal handling
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -fsS http://localhost:3100/api/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
 CMD ["node", "--import", "./server/node_modules/tsx/dist/loader.mjs", "server/dist/index.js"]