CBIIT / crdc-ctdc-files / 26248033909 / 1

54%

main: 54%

push

github

refactor: multi-stage Dockerfile to eliminate npm-bundled CVEs

refactor: multi-stage Dockerfile to eliminate npm-bundled CVEs

- Convert to multi-stage build (builder + runtime)
- Remove npm/npx from runtime image to prevent bundled CVEs
  (brace-expansion, ip-address, picomatch)
- Replace deprecated --only=production with --omit=dev
- Remove unnecessary --openssl-legacy-provider (not needed for Node 24)
- Remove npm cache clean (builder stage is discarded)
- Consolidate ENV statements into single layer

65 of 135 branches covered (48.15%)

Branch coverage included in aggregate %.

170 of 280 relevant lines covered (60.71%)

1.89 hits per line