a226cbddbd
`docker compose build` without NEXUS_TOKEN produced a Nexus 401 forty seconds in, worded as a credentials problem when it was really an unset variable. The mount's `required=true` asserts the secret was *declared*, not that it holds anything, so an empty one sailed past it and npm sent an empty `_authToken`. The install moves to tools/docker-install-deps.sh, which checks the secret before touching the network and fails in under a second with the three ways to supply it. It is a file rather than inline shell because BuildKit echoes an inline command twice on failure and buries the message. Also ignore .env. It carries NEXUS_TOKEN, compose reads it at build time, and it was not gitignored — .env.example stays tracked. Nothing had been committed: the only prior commit predates all of this. Verified: empty token fails in 0.2s with the message; .env and the environment variable both build; the image carries no trace of the token and serves the full page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
59 lines
953 B
Plaintext
59 lines
953 B
Plaintext
# See https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files for more about ignoring files.
|
|
|
|
# compiled output
|
|
dist
|
|
tmp
|
|
out-tsc
|
|
|
|
# dependencies
|
|
node_modules
|
|
|
|
# IDEs and editors
|
|
/.idea
|
|
.project
|
|
.classpath
|
|
.c9/
|
|
*.launch
|
|
.settings/
|
|
*.sublime-workspace
|
|
|
|
# IDE - VSCode
|
|
.vscode/*
|
|
!.vscode/settings.json
|
|
!.vscode/tasks.json
|
|
!.vscode/launch.json
|
|
!.vscode/extensions.json
|
|
|
|
# misc
|
|
/.sass-cache
|
|
/connect.lock
|
|
/coverage
|
|
/libpeerconnection.log
|
|
npm-debug.log
|
|
yarn-error.log
|
|
testem.log
|
|
/typings
|
|
|
|
# System Files
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
.nx/cache
|
|
.nx/workspace-data
|
|
.nx/migrate-runs
|
|
.claude/worktrees
|
|
.claude/settings.local.json
|
|
|
|
.nx/polygraph
|
|
.angular
|
|
|
|
# Secrets. `.env` holds NEXUS_TOKEN, which compose reads at build time, so it
|
|
# must never be committed — `.env.example` is the one that is.
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# A per-machine npmrc would carry a Nexus token; the committed one at the repo
|
|
# root deliberately holds none.
|
|
.npmrc.local
|