wip: feat: chainguard lock

.dockerignore

@@ -1,4 +1,5 @@
 **/*.pem
+**/.npmrc
 **/.aws
 **/.ssh
 **/.ebextensions

.github/actions/setup-cgr/action.yml

@@ -0,0 +1,21 @@
+name: Setup Chainguard registry
+description: Authenticate to CGR, write .npmrc, and swap in the CGR lockfile.
+inputs:
+  assumed-id:
+    description: Chainguard assumed identity (secrets.CGR_ASSUMED_ID)
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Install chainctl + assume identity
+      # setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 -> v0.5.1
+      uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28
+      with:
+        identity: ${{ inputs.assumed-id }}
+    - name: Configure .npmrc for CGR and swap lockfile
+      shell: bash
+      run: |
+        chainctl auth configure-npm --org-name open.gov.sg
+        ex -sc 'g/javascript\/:/t.|s/javascript/javascript-upstream/|x' .npmrc
+        echo 'use-node-version=22.22.2' >> .npmrc
+        cp pnpm-lock.cgr.yaml pnpm-lock.yaml

.github/dependabot.yml

@@ -1,12 +1,16 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
+registries:
+  chainguard-npm:
+    type: npm-registry
+    url: https://libraries.cgr.dev/javascript/
+    username: ${{secrets.CG_LIBRARIES_USER}}
+    password: ${{secrets.CG_LIBRARIES_PASS}}
+    replaces-base: true
 updates:
-  - package-ecosystem: 'npm' # See documentation for possible values
-    directory: '/' # Location of package manifests
+  - package-ecosystem: 'npm'
+    directory: '/'
+    registries:
+      - chainguard-npm
     schedule:
       interval: 'daily'
       time: '01:00'
@@ -15,8 +19,10 @@ updates:
       prefix: 'fix'
       prefix-development: 'chore'
       include: 'scope'
-  - package-ecosystem: 'npm' # See documentation for possible values
-    directory: '/shared' # Location of package manifests
+  - package-ecosystem: 'npm'
+    directory: '/shared'
+    registries:
+      - chainguard-npm
     schedule:
       interval: 'daily'
       time: '03:00'

.github/workflows/build-base-images.yml

@@ -26,6 +26,7 @@ on:
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 env:
   REGISTRY: ghcr.io
@@ -42,6 +43,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install chainctl + assume identity
+        # setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 -> v0.5.1
+        uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28
+        with:
+          identity: ${{ secrets.CGR_ASSUMED_ID }}
+      - name: Generate CGR .npmrc and swap lockfile
+        run: |
+          chainctl auth configure-npm --org-name open.gov.sg
+          ex -sc 'g/javascript\/:/t.|s/javascript/javascript-upstream/|x' .npmrc
+          cp pnpm-lock.cgr.yaml pnpm-lock.yaml
+
       - name: Compute dependency hash
         id: deps-hash
         run: |
@@ -106,6 +118,8 @@ jobs:
             ${{ env.IMAGE_NAME }}:build-latest
           cache-from: |
             type=registry,ref=${{ env.IMAGE_NAME }}:build-latest
+          secret-files: |
+            npmrc=.npmrc
 
       - name: Build and push runtime-base image
         if: steps.check-exists.outputs.skip != 'true'
@@ -120,6 +134,8 @@ jobs:
             ${{ env.IMAGE_NAME }}:runtime-latest
           cache-from: |
             type=registry,ref=${{ env.IMAGE_NAME }}:runtime-latest
+          secret-files: |
+            npmrc=.npmrc
 
       - name: Set outputs
         id: set-outputs

.github/workflows/ci.yml

@@ -4,6 +4,10 @@ env:
   NODE_VERSION: '22.22'
   PNPM_VERSION: '10.30.3'
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   push:
     branches-ignore:
@@ -69,6 +73,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -79,7 +87,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
   build:
     needs: install
@@ -88,6 +96,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -98,7 +110,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - run: pnpm build
         env:
           NODE_OPTIONS: '--max-old-space-size=4096'
@@ -136,6 +148,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -163,7 +179,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Configure Datadog Test Visibility
         uses: datadog/test-visibility-github-action@7f2b515b64333229315f4701adc590ee6586b270 # v1.0.5
         with:
@@ -185,6 +201,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -195,7 +215,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - run: pnpm lint:frontend
 
   backend_test:
@@ -206,6 +226,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -233,7 +257,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - run: pnpm install --prefix services/pdf-gen-sparticuz
       - run: pnpm install --prefix services/virus-scanner-guardduty
       - name: Configure Datadog Test Visibility
@@ -256,6 +280,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -266,7 +294,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - run: pnpm lint-ci:backend
 
   shared_lint:
@@ -277,6 +305,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -287,7 +319,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - run: pnpm lint-ci:shared
 
   shared_test:
@@ -298,6 +330,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -308,7 +344,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Configure Datadog Test Visibility
         uses: datadog/test-visibility-github-action@7f2b515b64333229315f4701adc590ee6586b270 # v1.0.5
         with:
@@ -331,6 +367,10 @@ jobs:
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
+      - name: Setup Chainguard registry
+        uses: ./.github/actions/setup-cgr
+        with:
+          assumed-id: ${{ secrets.CGR_ASSUMED_ID }}
       - name: Install pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
@@ -341,7 +381,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Configure Datadog Test Visibility
         uses: datadog/test-visibility-github-action@7f2b515b64333229315f4701adc590ee6586b270 # v1.0.5
         with:

Dockerfile.base

@@ -24,7 +24,8 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/sdk/package.json ./packages/sdk/
 COPY apps/frontend/package.json ./apps/frontend/
 
-RUN pnpm install --frozen-lockfile --filter "!services/*" --filter "!packages/react-email-preview/*"
+RUN --mount=type=secret,id=npmrc,target=/build/.npmrc \
+    pnpm install --frozen-lockfile --filter "!services/*" --filter "!packages/react-email-preview/*"
 
 # =============================================================================
 # runtime-base: Minimal runtime image with system deps and non-root user