mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
b6b693717c
The runner moves from Wolfi to node:22-trixie-slim, the same image and digest as the dependency and build stages. Wolfi's free repository keeps only its newest Node stream current, so nodejs-22 stayed at 22.23.2 and missed two releases with HIGH fixes; the official image carries 22.23.4. The runner removes npm, npx, corepack and yarn before anything else and fails the build if one is left. The Prisma CLI install moves to its own prisma-cli stage on the same base and is copied over, so npm never runs in the runner. pg_dump and pg_restore 18.6 come from a pgclient stage on postgres:18.6-trixie, pinned by digest, with the libpq they link; the Kerberos, LDAP and SASL libraries come from apt. The PGDG package would bring Perl and the wrapper scripts, and its repository drops a pinned minor once the next one is out. The native ABI and glibc check between builder and runner stays as a guard. runtime-package-pins now holds every stage to a digest, the runner to the builder's image, the runner free of package managers, and the pgclient minor to the bundled database's. Dependabot ignores a PostgreSQL major in the Dockerfile as it does in the compose file.
scripts/
One-shot operator and build scripts. These are not part of the running application — they are run by hand during a deploy, a backfill, or a release, or wired into CI. Recurring work belongs on pg-boss (src/lib/jobs/), not here.
How to run them
From a source checkout:
pnpm dlx tsx scripts/<file>.ts
The production image intentionally removes npm, pnpm, and Corepack. Only
container-safe scripts named by an operator runbook use its pinned
healthlog-tsx launcher; scripts that import the full application dependency
graph must run from a source checkout. scripts/ is excluded from the project
typecheck.
What lives here
generate-openapi.ts— emitsdocs/api/openapi.yamlfrom the registered Zod schemas (pnpm openapi:generate).check-openapi.ts— compares a freshly generated spec against the committed YAML; CI fails on drift (pnpm openapi:check).check-env.ts— pre-deploy env-var sanity check againstenv-manifest.json(pnpm check-env); wired into CI.assert-deploy.ts— post-deploy/api/versionassertion.rotate-encryption-key.ts— AES-256-GCM key rotation; seedocs/ops/encryption-key-rotation.md.restore-backup.ts— restore an off-host AES-GCM backup from an S3-compatible bucket.repair-apple-health-distance.ts— repair walking-distance rows theexport.zipimport stored 1000x too small; dry-run by default, seedocs/ops/apple-health-distance-repair.md.repair-intake-anomalies.ts— repair historic medication-ledger defects (duplicate dose-slot rows, implausibletaken_at); dry-run by default, seedocs/ops/intake-repair.md.backfill-rollups.ts,drain-per-sample-cumulative.ts,backfill-mood-note-column.ts— historical data backfills (note: the boot-timerollup-full-backfillqueue handles new accounts automatically; the CLI is the manual fallback).seed-demo.ts+seed-demo-v15.sql— populate a demo tenant.bench/—seed-large-account.ts(a synthetic ten-year account of about 1.26 million measurement rows) andrun.ts(latency and SQL statements per request against it); seedocs/contributing/benchmarks.md. Results land inbench/results/.test-notifications.ts— exercise the notification dispatcher + reminder check.fetch-geolite2.sh— download the MaxMind GeoLite2 MMDBs (needs a licence key) beforedocker build.build-pdf-fonts.py— rebuild the fonts the doctor-report PDF embeds (src/lib/doctor-report-pdf/fonts/) from the upstream Noto sources; needsfonttools. The source URLs are in its header.install-hooks.sh— install the local git hooks.generate-sw-version.mjs,print-bundle-report.mjs— service-worker version stamp and bundle-size report.i18n/— locale tooling;__tests__/— tests for the scripts above.
Conventions
See ../CLAUDE.md "Tests and commands" + "Self-hosting gotchas". Operator runbooks that drive these scripts live in ../docs/ops/.