The Dockerfile is the documented self-host path (and pins node:24.13.1-alpine / nginx:1.29.8-alpine), but CI never builds it. A change to .npmrc, the registry auth for @lotusguild/*, build.config.ts, or the static-copy targets can break the image without any signal. The image also ships docker-nginx.conf, which sets no security headers (see #44), so a CI job is also the natural place to assert the headers once they are added.
Suggested fix
Add a docker job (on pull requests and pushes, no push to a registry needed) that runs docker build -t cinny-ci ., starts the container, and curl -fsI http://localhost/ to check a 200 and, after #44, the Content-Security-Policy / frame-ancestors headers. If the act_runner cannot run Docker-in-Docker, use buildah/kaniko or at least a hadolint lint step.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** `Dockerfile`, `docker-nginx.conf`, `.gitea/workflows/ci.yml`
### Problem
The Dockerfile is the documented self-host path (and pins `node:24.13.1-alpine` / `nginx:1.29.8-alpine`), but CI never builds it. A change to `.npmrc`, the registry auth for `@lotusguild/*`, `build.config.ts`, or the static-copy targets can break the image without any signal. The image also ships `docker-nginx.conf`, which sets no security headers (see #44), so a CI job is also the natural place to assert the headers once they are added.
### Suggested fix
Add a `docker` job (on pull requests and pushes, no push to a registry needed) that runs `docker build -t cinny-ci .`, starts the container, and `curl -fsI http://localhost/` to check a 200 and, after #44, the `Content-Security-Policy` / `frame-ancestors` headers. If the act_runner cannot run Docker-in-Docker, use `buildah`/`kaniko` or at least a `hadolint` lint step.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:43 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
Dockerfile,docker-nginx.conf,.gitea/workflows/ci.ymlProblem
The Dockerfile is the documented self-host path (and pins
node:24.13.1-alpine/nginx:1.29.8-alpine), but CI never builds it. A change to.npmrc, the registry auth for@lotusguild/*,build.config.ts, or the static-copy targets can break the image without any signal. The image also shipsdocker-nginx.conf, which sets no security headers (see #44), so a CI job is also the natural place to assert the headers once they are added.Suggested fix
Add a
dockerjob (on pull requests and pushes, no push to a registry needed) that runsdocker build -t cinny-ci ., starts the container, andcurl -fsI http://localhost/to check a 200 and, after #44, theContent-Security-Policy/frame-ancestorsheaders. If the act_runner cannot run Docker-in-Docker, usebuildah/kanikoor at least ahadolintlint step.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).