fix(ci): lowercase GHCR owner tags and harden frontend runtime image

.github/workflows/backend-beta.yml

@@ -34,6 +34,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set lower case owner name
+        id: repo_owner
+        run: |
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
+        env:
+          OWNER: "${{ github.repository_owner }}"
+
       - name: Build and push beta Docker image with BuildKit cache
         uses: docker/build-push-action@v5
         with:
@@ -41,12 +50,12 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:beta
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:beta
           cache-from: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache
             type=local,src=/tmp/.buildx-cache
           cache-to: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
             type=local,dest=/tmp/.buildx-cache,mode=max
         env:
           DOCKER_BUILDKIT: 1

.github/workflows/backend-latest.yml

@@ -36,6 +36,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set lower case owner name
+        id: repo_owner
+        run: |
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
+        env:
+          OWNER: "${{ github.repository_owner }}"
+
       - name: Build and push latest Docker image with BuildKit cache
         uses: docker/build-push-action@v5
         with:
@@ -43,12 +52,12 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:latest
           cache-from: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache
             type=local,src=/tmp/.buildx-cache
           cache-to: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
             type=local,dest=/tmp/.buildx-cache,mode=max
         env:
           DOCKER_BUILDKIT: 1

.github/workflows/backend-release.yml

@@ -31,6 +31,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set lower case owner name
+        id: repo_owner
+        run: |
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
+        env:
+          OWNER: "${{ github.repository_owner }}"
+
       - name: Build and push release Docker image with BuildKit cache
         uses: docker/build-push-action@v5
         with:
@@ -38,12 +47,12 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
           cache-from: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache
             type=local,src=/tmp/.buildx-cache
           cache-to: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
             type=local,dest=/tmp/.buildx-cache,mode=max
         env:
           DOCKER_BUILDKIT: 1

.github/workflows/cdn-beta.yml

@@ -34,9 +34,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
+      - name: Set lower case owner name
+        id: repo_owner
         run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
         env:
           OWNER: "${{ github.repository_owner }}"
 

.github/workflows/cdn-latest.yml

@@ -34,9 +34,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
+      - name: Set lower case owner name
+        id: repo_owner
         run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
         env:
           OWNER: "${{ github.repository_owner }}"
 

.github/workflows/cdn-release.yml

@@ -31,9 +31,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: set lower case owner name
+      - name: Set lower case owner name
+        id: repo_owner
         run: |
-          echo "REPO_OWNER=${OWNER,,}" >>${GITHUB_ENV}
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
         env:
           OWNER: "${{ github.repository_owner }}"
 

.github/workflows/frontend-beta.yml

@@ -34,6 +34,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set lower case owner name
+        id: repo_owner
+        run: |
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
+        env:
+          OWNER: "${{ github.repository_owner }}"
+
       - name: Build and push beta Docker image with BuildKit cache
         uses: docker/build-push-action@v5
         with:
@@ -41,12 +50,12 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:beta
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:beta
           cache-from: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache
             type=local,src=/tmp/.buildx-cache
           cache-to: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
             type=local,dest=/tmp/.buildx-cache,mode=max
         env:
           DOCKER_BUILDKIT: 1

.github/workflows/frontend-latest.yml

@@ -36,6 +36,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set lower case owner name
+        id: repo_owner
+        run: |
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
+        env:
+          OWNER: "${{ github.repository_owner }}"
+
       - name: Build and push latest Docker image with BuildKit cache
         uses: docker/build-push-action@v5
         with:
@@ -43,12 +52,12 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:latest
           cache-from: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache
             type=local,src=/tmp/.buildx-cache
           cache-to: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
             type=local,dest=/tmp/.buildx-cache,mode=max
         env:
           DOCKER_BUILDKIT: 1

.github/workflows/frontend-release.yml

@@ -31,6 +31,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Set lower case owner name
+        id: repo_owner
+        run: |
+          LOWER_OWNER="${OWNER,,}"
+          echo "REPO_OWNER=${LOWER_OWNER}" >>"$GITHUB_ENV"
+          echo "repo_owner=${LOWER_OWNER}" >>"$GITHUB_OUTPUT"
+        env:
+          OWNER: "${{ github.repository_owner }}"
+
       - name: Build and push release Docker image with BuildKit cache
         uses: docker/build-push-action@v5
         with:
@@ -38,13 +47,13 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+            ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:latest
           cache-from: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache
             type=local,src=/tmp/.buildx-cache
           cache-to: |
-            type=registry,ref=ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+            type=registry,ref=ghcr.io/${{ steps.repo_owner.outputs.repo_owner }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
             type=local,dest=/tmp/.buildx-cache,mode=max
         env:
           DOCKER_BUILDKIT: 1

frontend/Dockerfile

@@ -1,5 +1,5 @@
 # Use this image as the platform to build the app
-FROM node:22-alpine AS external-website
+FROM node:22-alpine AS builder
 
 # Metadata labels for the AdventureLog image
 LABEL maintainer="Sean Morley" \
@@ -42,6 +42,28 @@ RUN pnpm run build
 # Make startup script executable
 RUN chmod +x ./startup.sh
 
+# Keep only production dependencies for runtime image
+RUN CI=true pnpm prune --prod
+
+# Runtime image contains only built app + runtime deps
+FROM node:22-alpine AS runtime
+
+WORKDIR /app
+
+# Upgrade zlib and remove npm toolchain from runtime image
+RUN apk upgrade --no-cache zlib \
+    && rm -f /usr/local/bin/npm /usr/local/bin/npx \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack
+
+# Copy build artifacts and production runtime dependencies
+COPY --from=builder /app/build ./build
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./package.json
+COPY --from=builder /app/startup.sh ./startup.sh
+
+# Ensure startup script is executable
+RUN chmod +x ./startup.sh
+
 # Change to non-root user for security
 USER node:node