wip: contenido inicial + test de reusable workflow / composite action

dockerfiles/nextjs.Dockerfile

@@ -0,0 +1,111 @@
+# Basado en el Dockerfile real de ecommerce-frontend (Next.js, output
+# "standalone"). Tu next.config.* necesita "output: 'standalone'" para
+# que este Dockerfile funcione -- sin eso, .next/standalone no existe
+# y el build de la imagen falla en el "test -f" del stage builder.
+#
+# ARGs a completar por tu app:
+#   NODE_IMAGE -- versión exacta de Node, fijá una concreta.
+#   APP_PORT   -- puerto de escucha (Next.js con HOSTNAME/PORT del
+#                 runtime standalone). Default 3000; el frontend real
+#                 del lab lo corre en 80 vía este mismo ARG.
+
+# syntax=docker/dockerfile:1.7
+
+ARG NODE_IMAGE=node:24.18.0-bookworm-slim
+ARG APP_PORT=3000
+
+# ============================================================
+# 1. Dependencias
+# ============================================================
+FROM ${NODE_IMAGE} AS deps
+
+WORKDIR /app
+
+ENV NODE_ENV=development \
+    NEXT_TELEMETRY_DISABLED=1 \
+    NPM_CONFIG_AUDIT=false \
+    NPM_CONFIG_FUND=false
+
+COPY package.json package-lock.json ./
+
+RUN --mount=type=cache,target=/root/.npm,sharing=private \
+    npm ci \
+      --include=prod \
+      --include=dev \
+      --no-audit \
+      --no-fund \
+      --foreground-scripts
+
+# ============================================================
+# 2. Compilación Next.js
+# ============================================================
+FROM ${NODE_IMAGE} AS builder
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    NODE_OPTIONS=--max-old-space-size=2048
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY package.json package-lock.json ./
+COPY . .
+
+RUN --mount=type=cache,target=/app/.next/cache,sharing=private \
+    npm run build
+
+# Falla temprano y con un mensaje claro si next.config.* no tiene
+# "output: 'standalone'" -- mejor que un COPY silencioso más abajo
+# fallando con "no existe el archivo".
+RUN test -f /app/.next/standalone/server.js \
+    && test -d /app/.next/static \
+    || { echo "ERROR: falta 'output: standalone' en next.config.*"; exit 1; }
+
+# ============================================================
+# 3. Runtime de producción
+# ============================================================
+FROM ${NODE_IMAGE} AS runner
+
+ARG APP_PORT
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    HOSTNAME=0.0.0.0 \
+    PORT=${APP_PORT}
+
+# setcap: solo hace falta si APP_PORT < 1024 (un puerto "privilegiado"
+# que normalmente requiere root para bindear). Si tu APP_PORT es 3000
+# o cualquier valor >= 1024, podés borrar el setcap y libcap2-bin.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates libcap2-bin \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --gid 1001 nodejs \
+    && useradd --uid 1001 --gid 1001 --create-home --shell /usr/sbin/nologin nextjs \
+    && setcap 'cap_net_bind_service=+ep' /usr/local/bin/node
+
+# El runtime solo ejecuta "node server.js" -- nunca npm/npx/corepack.
+# Sacarlos reduce lo que Trivy escanea al set real de producción.
+RUN rm -rf \
+      /usr/local/lib/node_modules/npm \
+      /usr/local/lib/node_modules/corepack \
+      /usr/local/bin/npm \
+      /usr/local/bin/npx \
+      /usr/local/bin/corepack
+
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE ${APP_PORT}
+
+# CAMBIAR: /api/health tiene que existir en tu app (una route handler
+# de Next.js que devuelva 200). Si no la tenés todavía, es la primera
+# ruta a agregar -- este healthcheck y el readinessProbe/livenessProbe
+# de k8s-manifests/base/deployment.yaml asumen que existe.
+HEALTHCHECK --interval=30s --timeout=8s --start-period=30s --retries=3 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:' + (process.env.PORT || 3000) + '/api/health').then((r) => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
+
+CMD ["node", "server.js"]