fix: yarn berry + fetch + docker opti + sec

.dockerignore

@@ -1,7 +1,13 @@
+**/.dockerignore
+**/Dockerfile
 .git
 .github
 .kontinuous
-*.md
+**/*.md
 **/node_modules
 **/.next/cache
 **/data/*
+shared/*/build
+targets/*/build
+shared/*/lib
+targets/*/lib

.github/workflows/quality.yml

@@ -24,7 +24,7 @@ jobs:
           cache: "yarn"
       - name: Install dependencies
         run: |
-          yarn install --prefer-offline --frozen-lockfile
+          yarn --immutable
       - name: Build code
         run: |
           yarn build

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
           node-version: 20.3.1
           cache: "yarn"
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: yarn --immutable
       - name: Set git
         run: |
           git config --global user.name "${NAME}"

.gitignore

@@ -5,3 +5,11 @@ docker-compose.override.yml
 .vscode
 *-error.log
 .swc
+
+# Yarn Berry
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions

.kontinuous/config.yaml

@@ -1,7 +1,6 @@
 projectName: cdtn
 dependencies:
   fabrique:
-    import: socialgouv/kontinuous/plugins/fabrique
     dependencies:
       contrib:
         preDeploy:

.kontinuous/templates/alert.job.tpl

@@ -4,6 +4,10 @@ spec:
   template:
     spec:
       restartPolicy: Never
+      securityContext:
+        fsGroup: 1000
+        runAsUser: 1000
+        runAsGroup: 1000
       containers:
         - name: update-alert
           image: "{{ or .Values.registry .Values.global.registry }}/{{ .Values.global.imageProject }}/{{ .Values.global.imageRepository }}/alert:{{ .Values.global.imageTag }}"

.kontinuous/templates/cleanup.job.tpl

@@ -2,6 +2,10 @@
 spec:
   template:
     spec:
+      securityContext:
+        fsGroup: 1000
+        runAsUser: 1000
+        runAsGroup: 1000
       containers:
         - name: db-cleaner
           image: ghcr.io/socialgouv/docker/psql:7.0.0

.kontinuous/templates/ingester.job.tpl

@@ -4,6 +4,10 @@ spec:
   template:
     spec:
       restartPolicy: Never
+      securityContext:
+        fsGroup: 1000
+        runAsUser: 1000
+        runAsGroup: 1000
       containers:
         - name: update-ingester
           image: "{{ or .Values.registry .Values.global.registry }}/{{ .Values.global.imageProject }}/{{ .Values.global.imageRepository }}/ingester:{{ .Values.global.imageTag }}"

.kontinuous/values.yaml

@@ -56,6 +56,10 @@ www:
       cpu: "50m"
       memory: "128Mi"
   replicas: 1
+  securityContext:
+    fsGroup: 1000
+    runAsUser: 1000
+    runAsGroup: 1000
 
 contributions:
   ~chart: app
@@ -76,6 +80,10 @@ contributions:
       cpu: "50m"
       memory: "128Mi"
   replicas: 1
+  securityContext:
+    fsGroup: 1000
+    runAsUser: 1000
+    runAsGroup: 1000
 
 export:
   ~chart: app
@@ -98,6 +106,10 @@ export:
       cpu: '50m'
       memory: 128Mi
   replicas: 1
+  securityContext:
+    fsGroup: 1000
+    runAsUser: 1000
+    runAsGroup: 1000
 
 hasura:
   ~chart: hasura
@@ -120,6 +132,10 @@ hasura:
     requests:
       cpu: '50m'
       memory: 650Mi
+  securityContext:
+    fsGroup: 1001
+    runAsUser: 1001
+    runAsGroup: 1001
 
 deactivate:
   jobs-deactivate:

.yarn/plugins/@yarnpkg/plugin-fetch.cjs

@@ -0,0 +1,19 @@
+/* eslint-disable */
+//prettier-ignore
+module.exports = {
+name: "@yarnpkg/plugin-fetch",
+factory: function (require) {
+var plugin=(()=>{var ie=Object.defineProperty;var le=(n,t,e)=>t in n?ie(n,t,{enumerable:!0,configurable:!0,writable:!0,value:e}):n[t]=e;var c=(n=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(n,{get:(t,e)=>(typeof require<"u"?require:t)[e]}):n)(function(n){if(typeof require<"u")return require.apply(this,arguments);throw new Error('Dynamic require of "'+n+'" is not supported')});var a=(n,t)=>()=>(t||n((t={exports:{}}).exports,t),t.exports);var u=(n,t,e)=>(le(n,typeof t!="symbol"?t+"":t,e),e);var $=a((_e,A)=>{"use strict";A.exports=function(t){return t.map(function(e){return e&&typeof e=="object"?e.op.replace(/(.)/g,"\\$1"):/["\s]/.test(e)&&!/'/.test(e)?"'"+e.replace(/(['\\])/g,"\\$1")+"'":/["'\s]/.test(e)?'"'+e.replace(/(["\\$`!])/g,"\\$1")+'"':String(e).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g,"$1\\$2")}).join(" ")}});var v=a((ze,Y)=>{var C=c("fs"),pe=c("path"),{parseSyml:ue}=c("@yarnpkg/parsers"),B=["npm","portal","link"];Y.exports=function(){let t=C.readFileSync("yarn.lock","utf8"),e=ue(t),r=Object.keys(e).filter(o=>o.includes("@workspace:")),s=r.map(o=>{let[,i]=e[o].resolution.trim().split("@workspace:");return i==="."?null:i}).filter(Boolean);r.forEach(o=>{let{dependencies:i,dependenciesMeta:p,peerDependencies:b,peerDependenciesMeta:P,resolution:D,bin:oe}=e[o],[ce,w]=D.trim().split("@workspace:"),ae=pe.join(w,"package.json"),y={name:ce,version:"0.0.0",description:"**DON'T COMMIT** Generated file for caching",private:!0,dependencies:i,peerDependencies:b,peerDependenciesMeta:P,bin:oe};if(p){let h={};Object.keys(p).forEach(m=>{h[m]=i[m],delete i[m]}),y.optionalDependencies=h}if(w==="."){s.length>0&&(y.workspaces={packages:s});let h=Object.keys(e),m=l=>{let k=l.trim().split("@");return l.startsWith("@")?k=k.slice(0,2):k=k.slice(0,1),k.join("@")};y.resolutions=h.filter(l=>{if(l.includes("@workspace:")||l.includes(", ")||!B.some(f=>l.includes(`@${f}:`)))return!1;let k=m(l);return h.every(f=>l===f?!0:f.split(",").map(g=>m(g)).every(g=>g!==k))}).reduce((l,k)=>(B.forEach(f=>{if(!k.includes(`@${f}:`))return;let[g,x]=k.trim().split(`@${f}:`);switch(f){case"npm":l[g]=x.includes("@")?`${f}:${x}`:x;break;case"portal":case"link":l[g]=`${f}:${x.split("::")[0]}`;break}}),l),{})}C.mkdirSync(w,{recursive:!0}),C.writeFileSync(ae,`${JSON.stringify(y,null,2)}
+`)})}});var j=a((Ge,H)=>{var ke=v();H.exports=n=>{n.context.stdout.write(`[YARN-FETCH] extracting package.json file(s) from yarn.lock
+`),ke()}});var M=a((Ze,L)=>{var d=c("fs"),fe=c("path"),{execSync:de}=c("child_process"),{parseSyml:me}=c("@yarnpkg/parsers"),{BaseCommand:ge}=c("@yarnpkg/cli"),{Command:he,Option:R}=c("clipanion"),ye=$(),xe=j(),q;L.exports=(q=class extends ge{protectPackageJson=R.Boolean("--protect-package-json");args=R.Proxy();async execute(){let{protectPackageJson:t=process.stdout.isTTY}=this,e=[];if(t){this.context.stdout.write(`[YARN-FETCH] backup possible package.json file(s)
+`);let s=d.readFileSync("yarn.lock","utf8"),o=me(s);e=Object.keys(o).filter(p=>p.includes("@workspace:")).map(p=>{let{resolution:b}=o[p],[,P]=b.trim().split("@workspace:");return fe.join(P,"package.json")}),e.forEach(p=>{d.existsSync(p)&&!d.existsSync(`${p}.yarn-plugin-fetch-bak`)&&d.copyFileSync(p,`${p}.yarn-plugin-fetch-bak`)})}xe(this);let r=`yarn ${ye(this.args)}`;this.context.stdout.write(`[YARN-FETCH] ${r}
+`);try{de(r,{stdio:"inherit"})}catch(s){throw s}finally{t&&(this.context.stdout.write(`[YARN-FETCH] restoring possible package.json file(s)
+`),e.forEach(s=>{d.existsSync(`${s}.yarn-plugin-fetch-bak`)?d.renameSync(`${s}.yarn-plugin-fetch-bak`,s):d.unlinkSync(s)}))}}},u(q,"paths",[["fetch"]]),u(q,"usage",he.Usage({description:"fetch dependencies from yarn.lock in Docker build",details:`
+      expand yarn.lock to package.json file(s) and install dependencies in Docker build.
+    `,examples:[["yarn fetch --immutable","yarn fetch workspace my-package focus"]]})),q)});var K=a((Xe,I)=>{var{BaseCommand:qe}=c("@yarnpkg/cli"),be=j(),S;I.exports=(S=class extends qe{async execute(){be(this)}},u(S,"paths",[["fetch-tools","expand-lock"]]),S)});var _=a((tt,W)=>{function Pe(n,t,e){let r=t.split("."),s=n;for(let o of r){if(s[o]===void 0)return e;s=s[o]}return s}function we(n,t,e){let r=t.split("."),s=n;for(let o=0;o<r.length-1;o++){let i=r[o];(!s[i]||typeof s[i]!="object")&&(s[i]={}),s=s[i]}return s[r[r.length-1]]=e,n}function $e(n,t){let e=t.split("."),r=n;for(let s=0;s<e.length-1;s++){let o=e[s];if(!r[o])return!1;r=r[o]}return delete r[e[e.length-1]],!0}W.exports={get:Pe,set:we,unset:$e}});var F=a((st,G)=>{var z=c("fs"),{get:Ce,set:je,unset:Se}=_();G.exports=function(t,e){let r=JSON.parse(z.readFileSync("package.json","utf-8")),s=Ce(r,t);s!==void 0&&(je(r,e,s),Se(r,t),z.writeFileSync("package.json",JSON.stringify(r,null,2)))}});var E=a((nt,U)=>{var Fe=F();U.exports=function(){Fe("scripts._postinstall","scripts.postinstall")}});var Q=a((ot,Z)=>{var{BaseCommand:Ee}=c("@yarnpkg/cli"),Je=E(),J;Z.exports=(J=class extends Ee{async execute(){Je()}},u(J,"paths",[["fetch-tools","disable-postinstall"]]),J)});var N=a((at,V)=>{var Ne=F();V.exports=function(){Ne("scripts.postinstall","scripts._postinstall")}});var ee=a((lt,X)=>{var{BaseCommand:Te}=c("@yarnpkg/cli"),Oe=N(),T;X.exports=(T=class extends Te{async execute(){Oe()}},u(T,"paths",[["fetch-tools","disable-postinstall"]]),T)});var ne=a((kt,se)=>{var{execSync:De}=c("child_process"),{BaseCommand:Ae}=c("@yarnpkg/cli"),{Option:te}=c("clipanion"),Be=$(),Ye=E(),ve=N(),O;se.exports=(O=class extends Ae{postinstall=te.Boolean("--postinstall");args=te.Proxy();async execute(){this.postinstall||(this.context.stdout.write(`[YARN-FETCH] disable postinstall command in package.json
+`),ve());let t=`yarn workspaces focus --production ${Be(this.args)}`;this.context.stdout.write(`[YARN-FETCH] ${t}
+`),De(t,{stdio:"inherit"}),this.postinstall||(this.context.stdout.write(`[YARN-FETCH] re-enable postinstall command in package.json
+`),Ye())}},u(O,"paths",[["fetch-tools","production"]]),O)});var Ke=a((dt,re)=>{var He=M(),Re=K(),Le=Q(),Me=ee(),Ie=ne();re.exports={commands:[He,Re,Me,Le,Ie]}});return Ke();})();
+return plugin;
+}
+};