From 9d68903abd2418ebc13a2d2db6ca699dc60cd5c1 Mon Sep 17 00:00:00 2001
From: devops <cristiancruz0529@gmail.com>
Date: Fri, 24 Jul 2026 04:53:45 +0000
Subject: [PATCH] Update workloads/ecommerce/Dockerfile

---
 workloads/ecommerce/Dockerfile | 50 ++++++++++++++++++++++++++++------
 1 file changed, 41 insertions(+), 9 deletions(-)

diff --git a/workloads/ecommerce/Dockerfile b/workloads/ecommerce/Dockerfile
index ed1666d..3821978 100644
--- a/workloads/ecommerce/Dockerfile
+++ b/workloads/ecommerce/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.7 
+# syntax=docker/dockerfile:1.7
 
 ARG NODE_IMAGE=node:24.18.0-bookworm-slim
 
@@ -10,27 +10,59 @@ FROM ${NODE_IMAGE} AS deps
 WORKDIR /app
 
 ENV NEXT_TELEMETRY_DISABLED=1 \
+    NPM_CONFIG_REGISTRY=https://registry.npmjs.org/ \
+    NPM_CONFIG_REPLACE_REGISTRY_HOST=always \
     NPM_CONFIG_AUDIT=false \
     NPM_CONFIG_FUND=false \
-    NPM_CONFIG_FETCH_RETRIES=3 \
-    NPM_CONFIG_FETCH_RETRY_MINTIMEOUT=10000 \
-    NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT=60000 \
+    NPM_CONFIG_FETCH_RETRIES=2 \
+    NPM_CONFIG_FETCH_RETRY_MINTIMEOUT=5000 \
+    NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT=30000 \
     NPM_CONFIG_FETCH_TIMEOUT=120000 \
     NPM_CONFIG_MAXSOCKETS=8 \
     NPM_CONFIG_LOGLEVEL=info
 
-COPY package.json package-lock.json ./
+COPY package.json package-lock.json .npmrc ./
+
+# Evita que un package-lock generado en otro entorno apunte a un
+# registry privado o inaccesible para el runner de Gitea.
+RUN node <<'NODE'
+const fs = require("node:fs");
+
+const file = "package-lock.json";
+const text = fs.readFileSync(file, "utf8");
+
+const forbiddenHosts = [
+  "internal.api.openai.org",
+  "packages.applied-caas-gateway1",
+];
+
+const detected = forbiddenHosts.filter((host) => text.includes(host));
+
+if (detected.length > 0) {
+  console.error(
+    `ERROR: package-lock.json contiene registry no permitido: ${detected.join(", ")}`
+  );
+  process.exit(1);
+}
+
+const lock = JSON.parse(text);
+console.log(
+  `Lockfile válido: ${lock.name} · lockfileVersion=${lock.lockfileVersion}`
+);
+NODE
 
 RUN node --version \
     && npm --version \
-    && npm config set registry https://registry.npmjs.org/ \
     && npm config get registry \
+    && npm config get replace-registry-host \
     && npm ping
 
-# El caché es privado para evitar esperas por locks de otros builds.
-# El timeout evita una ejecución bloqueada indefinidamente.
+# --kill-after garantiza que un npm colgado termine después de SIGTERM.
 RUN --mount=type=cache,target=/root/.npm,sharing=private \
-    timeout --signal=TERM 900s \
+    timeout \
+      --signal=TERM \
+      --kill-after=30s \
+      900s \
     npm ci \
       --no-audit \
       --no-fund \