From 2d516a725d7413d364ec4774a858bc7685080840 Mon Sep 17 00:00:00 2001
From: Celes Renata <celes@frameshift.net>
Date: Mon, 13 Jul 2026 05:55:41 +0000
Subject: [PATCH] fix: pre-stage npm ci outside BuildKit sandbox

BuildKit sandbox has no network access for DNS resolution. Instead of
fighting it, run npm ci in a normal Woodpecker step (which has full
network), then COPY the whole frontend dir (including node_modules)
into the Docker build context. The Dockerfile just runs npm run build.
---
 .woodpecker/build-3.yml | 18 ++++++++++++++++--
 frontend/Dockerfile     |  5 +----
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.woodpecker/build-3.yml b/.woodpecker/build-3.yml
index 5f6948c..4e6baf5 100644
--- a/.woodpecker/build-3.yml
+++ b/.woodpecker/build-3.yml
@@ -189,6 +189,20 @@ steps:
             memory: 2Gi
             cpu: 4000m
     depends_on: []
+  npm-install-dashboard:
+    image: registry.celestium.life/dockerhub-cache/library/node:24-alpine
+    commands:
+      - cd frontend && npm ci
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1000m
+          limits:
+            memory: 2Gi
+            cpu: 4000m
+    depends_on: []
   build-dashboard:
     image: woodpeckerci/plugin-docker-buildx
     privileged: true
@@ -198,7 +212,6 @@ steps:
       buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
-      network: host
       insecure: true
       buildkit_config: |
         [registry."registry.celestium.life"]
@@ -231,7 +244,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 4000m
-    depends_on: []
+    depends_on:
+      - npm-install-dashboard
   build-superset:
     image: woodpeckerci/plugin-docker-buildx
     privileged: true
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index cea5c55..2aeaf1c 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -1,9 +1,6 @@
-# Stage 1: Build
-# Base images: uses Harbor proxy cache in CI, falls back to Docker Hub externally
+# Stage 1: Build (node_modules pre-installed by CI step outside sandbox)
 FROM registry.celestium.life/dockerhub-cache/library/node:24-alpine AS build
 WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci
 COPY . .
 ARG VITE_QUERY_API_URL=""
 ARG VITE_SYMBOL_REGISTRY_URL=""