nginx

Dockerfile

@@ -4,7 +4,19 @@ FROM node:22-alpine AS builder
 WORKDIR /app
 
 COPY package*.json ./
-RUN npm ci || npm install
+
+# `npm ci`, with no `|| npm install` fallback.
+#
+# That fallback was here and it is worse than the error it hides. `npm ci`
+# fails only when package-lock.json disagrees with package.json — exactly the
+# case where falling back to `npm install` resolves fresh versions the lock file
+# never pinned, so the deployed bundle is built from dependencies nobody chose
+# and nobody can reproduce.
+#
+# When this line fails, the fix is `npm install` locally and COMMIT the updated
+# package-lock.json. The build should not paper over a lock file that is out of
+# date; it should say so.
+RUN npm ci --no-audit --no-fund
 
 COPY . .
 RUN npm run build