fix(ci): stabilize Medusa dependency installation

workloads/commerce-backend/.npmrc

@@ -1,3 +1,20 @@
-fund=false
-audit=false
+registry=https://registry.npmjs.org/
+replace-registry-host=always
+
+package-lock=true
+dry-run=false
+global=false
+
 legacy-peer-deps=true
+
+audit=false
+fund=false
+update-notifier=false
+
+fetch-retries=2
+fetch-retry-mintimeout=5000
+fetch-retry-maxtimeout=30000
+fetch-timeout=120000
+
+maxsockets=8
+loglevel=info

workloads/commerce-backend/Dockerfile

@@ -4,13 +4,18 @@ FROM node:22.18.0-bookworm-slim AS builder
 
 WORKDIR /app
 
-ENV CI=true
-ENV NODE_ENV=development
-ENV NPM_CONFIG_UPDATE_NOTIFIER=false
+ENV CI=true \
+    NODE_ENV=development \
+    NPM_CONFIG_UPDATE_NOTIFIER=false
 
-COPY package.json .npmrc ./
-RUN --mount=type=cache,target=/root/.npm,sharing=locked \
-    npm install --no-audit --no-fund
+COPY package.json package-lock.json .npmrc ./
+
+RUN --mount=type=cache,id=medusa-builder-npm,target=/root/.npm,sharing=private \
+    npm ci \
+      --legacy-peer-deps \
+      --prefer-offline \
+      --no-audit \
+      --no-fund
 
 COPY tsconfig.json medusa-config.ts ./
 COPY src ./src
@@ -21,17 +26,25 @@ FROM node:22.18.0-bookworm-slim AS runtime
 
 WORKDIR /app
 
-ENV NODE_ENV=production
-ENV PORT=9000
-ENV NPM_CONFIG_UPDATE_NOTIFIER=false
+ENV NODE_ENV=production \
+    PORT=9000 \
+    NPM_CONFIG_UPDATE_NOTIFIER=false
 
 COPY --from=builder /app/.medusa/server/package.json ./
-RUN --mount=type=cache,target=/root/.npm,sharing=locked \
-    npm install --omit=dev --no-audit --no-fund
+COPY .npmrc ./
+
+RUN --mount=type=cache,id=medusa-runtime-npm,target=/root/.npm,sharing=private \
+    npm install \
+      --omit=dev \
+      --legacy-peer-deps \
+      --prefer-offline \
+      --no-audit \
+      --no-fund
 
 COPY --from=builder /app/.medusa/server ./
 
 RUN chown -R node:node /app
+
 USER node
 
 EXPOSE 9000