Make Docker pnpm install resilient to sharp ignored-builds; drop

unreachable gha cache

.gitea/workflows/docker-publish.yml

@@ -69,6 +69,8 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
+          # NOTE: type=gha cache is intentionally omitted. Gitea's act_runner cache
-          cache-to: type=gha,mode=max
+          # service is not reachable from the buildx container on this instance, so
+          # cache import timed out (~30s) on every run. The Dockerfile's BuildKit
+          # cache mounts still speed up dependency installs within a build.
           platforms: linux/amd64

CLAUDE.md

@@ -112,6 +112,24 @@ npx shadcn@latest add [component-name]
 
 Components are installed to `components/ui/`. Do not manually edit these files; they can be regenerated.
 
+## pnpm / sharp build (CI gotcha)
+
+pnpm 11 hard-fails `pnpm install --frozen-lockfile` with
+`[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: [email protected]` (exit 1) unless
+sharp's native build script is explicitly accounted for. sharp ships prebuilt
+binaries, so its build script is unnecessary and should stay skipped.
+
+- `pnpm-workspace.yaml` records the decision as `allowBuilds:\n  sharp: false`.
+  This **must be a real boolean** (`false`/`true`). A non-boolean value (e.g. the
+  placeholder string `set this to true or false`) does NOT count as a decision and
+  breaks CI. `onlyBuiltDependencies` / `ignoredBuiltDependencies` are NOT honored
+  for this in pnpm 11 — only `allowBuilds`. Verify before pushing:
+  `git show HEAD:pnpm-workspace.yaml`.
+- Because that value is easy to corrupt, the Docker build is made resilient: the
+  `pnpm install` step in the `Dockerfile` passes `--config.strictDepBuilds=false`,
+  which downgrades the ignored-builds error to a warning regardless of the
+  workspace file. Keep that flag in place.
+
 ## Important Notes
 
 - Contact email: contact@cloudrite.co.nz

Dockerfile

@@ -24,7 +24,12 @@ RUN --mount=type=cache,target=/root/.npm \
   elif [ -f yarn.lock ]; then \
     corepack enable yarn && yarn install --frozen-lockfile --production=false; \
   elif [ -f pnpm-lock.yaml ]; then \
-    corepack enable pnpm && pnpm install --frozen-lockfile; \
+    # --config.strictDepBuilds=false: pnpm 11 hard-fails (ERR_PNPM_IGNORED_BUILDS)
+    # when a dependency with a build script (e.g. sharp) isn't explicitly approved.
+    # sharp ships prebuilt binaries so its build script is unnecessary; this flag
+    # downgrades the gate to a warning and keeps the build resilient regardless of
+    # pnpm-workspace.yaml's allowBuilds value. See CLAUDE.md "pnpm / sharp build".
+    corepack enable pnpm && pnpm install --frozen-lockfile --config.strictDepBuilds=false; \
   else \
     echo "No lockfile found." && exit 1; \
   fi