Dockerfile

# syntax=docker/dockerfile:1.7

# Base image is pinned by tag here; production deployments should re-pin to a
# digest (node:22-slim@sha256:…) and let Dependabot refresh.
ARG NODE_IMAGE="node:22-slim"

FROM ${NODE_IMAGE} AS base
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates curl jq git \
 && rm -rf /var/lib/apt/lists/*
RUN corepack enable && corepack prepare pnpm@10.33.4 --activate

# Agent CLI install. Selected per build-arg; default is pi.
ARG AGENT="pi"
ARG PI_INSTALL_URL=""
ENV PI_INSTALL_URL=${PI_INSTALL_URL}
COPY scripts/install-agent.sh /tmp/
RUN /tmp/install-agent.sh "$AGENT"

# ---- deps stage: install node_modules (cached on lockfile diff) ----
FROM base AS deps
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

# ---- integrations stage: install enabled CLI plugins ----
FROM deps AS integrations
ARG ENABLED_INTEGRATIONS="slack,axiom"
COPY integrations/ /app/integrations/
COPY scripts/install-integrations.sh /tmp/
# install-integrations.sh uses node + 'yaml' (already present in deps stage).
RUN /tmp/install-integrations.sh "$ENABLED_INTEGRATIONS" "/app/integrations"

# ---- build stage: compile TS ----
FROM integrations AS build
COPY tsconfig.json ./
COPY src/ ./src/
RUN pnpm build

# ---- runtime stage ----
FROM integrations AS runtime
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
COPY package.json ./
# runbooks/ and .sleuthly.yml are mounted at runtime so edits don't require a
# rebuild. See .github/workflows/investigate.yml for the bind mounts.
ENTRYPOINT ["node", "/app/dist/main.js"]