feat: address security issues OD-972

.circleci/config.yml

@@ -13,7 +13,7 @@ references:
 jobs:
   build_package:
     docker:
-      - image: cimg/node:20.1.0
+      - image: cimg/node:22.23.4
     working_directory: ~/workdir
     steps:
       - attach_workspace:
@@ -47,7 +47,7 @@ jobs:
 
   publish_packages:
     docker:
-      - image: cimg/node:20.1.0
+      - image: cimg/node:22.23.4
     working_directory: ~/workdir
     steps:
       - attach_workspace:

.dockerignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+api-v3
+src/api/client
+.git
+.codacy

.gitignore

@@ -76,6 +76,8 @@ temp/
 # MacOS store files
 .DS_Store
 
-
 #Ignore vscode AI rules
 .github/instructions/codacy.instructions.md
+
+#JetBrains
+.idea

Dockerfile

@@ -1,23 +1,31 @@
-FROM node:22.12-alpine AS builder
+FROM node:22.23.4-trixie-slim AS builder
 
-# Must be entire project because `prepare` script is run during `npm install` and requires all files.
-COPY src/github /app
-COPY tsconfig.json /tsconfig.json
+# The API client under src/api/client is generated at build time (gitignored) and needs curl.
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-RUN --mount=type=cache,target=/root/.npm npm install
+COPY . .
 
-FROM node:22.12-alpine AS release
+RUN --mount=type=cache,target=/root/.npm npm install && npm run update-api && npm run build
 
-COPY --from=builder /app/dist /app/dist
-COPY --from=builder /app/package.json /app/package.json
-COPY --from=builder /app/package-lock.json /app/package-lock.json
+# Debian (glibc) rather than Alpine, because the Python and Java runtimes the runner
+# downloads for tools like Lizard and PMD are glibc builds.
+FROM node:22.23.4-trixie-slim AS release
 
 ENV NODE_ENV=production
 
+# Local analysis discovers the repository's files through git, and unpacks some tool archives with unzip.
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates git unzip && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 
-RUN npm ci --ignore-scripts --omit-dev
+COPY --from=builder /app/dist /app/dist
+COPY --from=builder /app/package.json /app/package.json
+COPY --from=builder /app/package-lock.json /app/package-lock.json
+
+RUN npm ci --ignore-scripts --omit=dev
+
+USER node
 
-ENTRYPOINT ["node", "dist/index.js"]
+ENTRYPOINT ["node", "dist/index.js"]