From e5afce9b552f30216915417a4f2c53102583e68e Mon Sep 17 00:00:00 2001
From: Joyjit Nath <96009+joyjit@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:12:18 -0700
Subject: [PATCH] Dockerfile: require a matching lockfile for the web build

The web build stage ran `npm ci || npm install`, so any `npm ci`
failure silently fell back to `npm install`. Those differ: `npm ci`
installs the exact versions pinned in web/package-lock.json, while
`npm install` resolves the version ranges in package.json against the
registry and takes the newest match. Once the lockfile drifted out of
sync the image would quietly stop being reproducible and start pulling
whatever had been published most recently, with the build still
reporting success.

Drop the fallback, and drop the `*` from the COPY so a missing
lockfile fails at the copy rather than as a confusing `npm ci` error.
Both CI workflows already run a bare `npm ci`; this makes the
container build agree with them.
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7d6236b..d69a1f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,8 +6,8 @@
 # --- web: build the dashboard into web/dist ---
 FROM node:20-alpine AS web
 WORKDIR /src/web
-COPY web/package.json web/package-lock.json* ./
-RUN npm ci || npm install
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
 COPY web/ ./
 RUN npm run build