Upgrade to node 24 and optimize build time for dockerpublish workflow

.dockerignore

@@ -1,2 +1,18 @@
-# Ignore local virtualenv (if present)
+# Keep Dockerfile COPY layers stable by excluding local files.
 .venv/
+.git/
+.gitignore
+**/*/node_modules
+node_modules
+.lint/
+__pycache__/
+**/__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.tox/
+*.egg-info/
+.DS_Store

.github/workflows/dockerpublish.yml

@@ -28,10 +28,13 @@ jobs:
   push:
     name: Publish images
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Extract GIT metadata for Docker
         id: meta
@@ -63,5 +66,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ github.repository }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

Dockerfile

@@ -35,23 +35,23 @@ RUN dnf config-manager --set-enabled crb
 RUN dnf install -y krb5-workstation krb5-libs krb5-devel
 COPY ./krb5.conf /etc/krb5.conf
 
-# Node.js 22 + pnpm (base image ships Node 16 from NodeSource, too old for pnpm 10)
+# Node.js 24 + pnpm 11
 RUN dnf remove -y nodejs npm && \
     dnf module reset -y nodejs && \
-    dnf module enable -y nodejs:22 && \
+    dnf module enable -y nodejs:24 && \
     dnf install -y nodejs npm
-RUN npm install -g pnpm@10.33.2
-ENV PNPM_STORE_DIR=/opt/.cache/pnpm-store
 
-# Sits above project-source COPYs so the layer only invalidates when the lockfile
-# changes. --shamefully-hoist must match the flag pynpm.PNPMPackage forces during the
-# later `invenio webpack install`, otherwise that step would purge node_modules and
-# reinstall from scratch.
+RUN npm install -g pnpm@11.9.0
+
+# JS deps only — this layer is reused unless package.json / lockfile change.
+# --shamefully-hoist matches what the webpack build expects (flat node_modules).
+# --store-dir must match the cache mount or pnpm ignores it.
 RUN mkdir -p ${INVENIO_INSTANCE_PATH}/assets
-COPY package.json pnpm-lock.yaml ${INVENIO_INSTANCE_PATH}/assets/
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ${INVENIO_INSTANCE_PATH}/assets/
 RUN --mount=type=cache,target=/opt/.cache/pnpm-store \
     cd ${INVENIO_INSTANCE_PATH}/assets && \
-    pnpm install --frozen-lockfile --shamefully-hoist
+    pnpm install --frozen-lockfile --shamefully-hoist \
+        --store-dir /opt/.cache/pnpm-store
 
 # Python and uv configuration
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -82,13 +82,6 @@ RUN --mount=type=cache,target=/opt/.cache/uv \
 
 COPY site ./site
 
-COPY ./docker/uwsgi/ ${INVENIO_INSTANCE_PATH}
-COPY ./invenio.cfg ${INVENIO_INSTANCE_PATH}
-COPY ./templates/ ${INVENIO_INSTANCE_PATH}/templates/
-COPY ./app_data/ ${INVENIO_INSTANCE_PATH}/app_data/
-COPY ./translations/ ${INVENIO_INSTANCE_PATH}/translations/
-COPY ./ .
-
 # Make sure workspace packages are installed (cds-rdm)
 RUN --mount=type=cache,target=/opt/.cache/uv \
     uv sync --frozen --no-dev $BUILD_EXTRAS \
@@ -99,18 +92,25 @@ RUN --mount=type=cache,target=/opt/.cache/uv \
 # don't want to use the cache (for image filesystem permission reasons)
 ENV UV_NO_CACHE=1
 
-# CI=true in `invenio webpack install` makes pnpm apply --frozen-lockfile (pynpm doesn't
-# pass it) and skip the interactive prompt that would otherwise abort the build under
-# no-TTY.
-RUN --mount=type=cache,target=/opt/.cache/pnpm-store \
-    invenio collect --verbose && \
-    invenio webpack create && \
-    CI=true invenio webpack install
+# Needed for collect / webpack create; after uv sync so cfg-only edits skip it.
+COPY ./invenio.cfg ${INVENIO_INSTANCE_PATH}
+
+# create overwrites assets/package.json from Python bundles; node_modules stays.
+RUN invenio collect --verbose && \
+    invenio webpack create
 
+# Overlay app assets, then put back the committed manifest (matches the lockfile
+# used in the cached install above). Only builds.
 COPY ./assets/ ${INVENIO_INSTANCE_PATH}/assets/
-COPY ./static/ ${INVENIO_INSTANCE_PATH}/static/
+COPY package.json ${INVENIO_INSTANCE_PATH}/assets/
 RUN cd ${INVENIO_INSTANCE_PATH}/assets && pnpm run build
 
+# Runtime files: changes here do not rebuild JS/Python deps or the webpack bundle.
+COPY ./static/ ${INVENIO_INSTANCE_PATH}/static/
+COPY ./docker/uwsgi/ ${INVENIO_INSTANCE_PATH}
+COPY ./templates/ ${INVENIO_INSTANCE_PATH}/templates/
+COPY ./app_data/ ${INVENIO_INSTANCE_PATH}/app_data/
+COPY ./translations/ ${INVENIO_INSTANCE_PATH}/translations/
 COPY ./ .
 
 ENTRYPOINT [ "bash", "-c"]

package.json

@@ -1,13 +1,13 @@
 {
   "author": "CERN <info@inveniosoftware.org>",
   "dependencies": {
-    "@artsy/fresnel": "^6.1.0",
-    "@babel/runtime": "^7.9.0",
+    "@artsy/fresnel": "^6.2.1",
+    "@babel/runtime": "^7.29.7",
     "@ckeditor/ckeditor5-build-classic": "^16.0.0",
     "@ckeditor/ckeditor5-react": "^2.1.0",
-    "@microlink/react-json-view": "^1.21.3",
-    "@semantic-ui-react/css-patch": "^1.0.0",
-    "@tinymce/tinymce-react": "^4.3.0",
+    "@microlink/react-json-view": "^1.31.28",
+    "@semantic-ui-react/css-patch": "^1.1.3",
+    "@tinymce/tinymce-react": "^4.3.2",
     "@uppy/aws-s3-multipart": "^3.12.0",
     "@uppy/core": "^3.13.1",
     "@uppy/dashboard": "^3.9.1",
@@ -22,84 +22,84 @@
     "@visx/scale": "^3.12.0",
     "@visx/shape": "^3.12.0",
     "@visx/text": "^3.12.0",
-    "admin-lte": "~2.4.8",
-    "ajv": "^8.0.0",
-    "axios": "^1.7.7",
-    "flightjs": "~1.5.1",
+    "admin-lte": "~2.4.18",
+    "ajv": "^8.20.0",
+    "axios": "^1.19.0",
+    "eslint": "^8.57.1",
+    "flightjs": "~1.5.2",
     "font-awesome": "~4.5.0",
-    "formik": "^2.2.9",
+    "formik": "^2.4.9",
     "hash-wasm": "^4.12.0",
-    "i18next": "^20.3.0",
-    "i18next-browser-languagedetector": "^6.1.0",
-    "jquery": "^3.3.1",
-    "json-diff-kit": "^1.0.30",
+    "i18next": "^20.6.1",
+    "i18next-browser-languagedetector": "^6.1.8",
+    "jquery": "^3.7.1",
+    "json-diff-kit": "^1.0.35",
     "leaflet": "^1.9.4",
-    "lodash": "^4.17.15",
-    "luxon": "^1.23.0",
-    "papaparse": "^5.4.1",
+    "lodash": "^4.18.1",
+    "luxon": "^1.28.1",
+    "papaparse": "^5.5.4",
     "path": "^0.12.7",
-    "pdfjs-dist": "^5.0",
-    "prismjs": "^1.15.0",
-    "prop-types": "^15.7.2",
-    "qs": "^6.9.1",
-    "query-string": "^7.0.0",
-    "react": "^16.13.0",
-    "react-copy-to-clipboard": "^5.0.0",
-    "react-dnd": "^11.1.0",
-    "react-dnd-html5-backend": "^11.1.0",
-    "react-dom": "^16.13.0",
-    "react-dropzone": "^11.0.0",
-    "react-i18next": "^11.11.0",
-    "react-invenio-forms": "^4.11.0",
+    "pdfjs-dist": "^5.7.284",
+    "prismjs": "^1.30.0",
+    "prop-types": "^15.8.1",
+    "qs": "^6.15.3",
+    "query-string": "^7.1.3",
+    "react": "^16.14.0",
+    "react-copy-to-clipboard": "^5.1.1",
+    "react-dnd": "^11.1.3",
+    "react-dnd-html5-backend": "^11.1.3",
+    "react-dom": "^16.14.0",
+    "react-dropzone": "^11.7.1",
+    "react-i18next": "^11.18.6",
+    "react-invenio-forms": "^4.17.6",
     "react-json-view": "^1.21.3",
     "react-overridable": "^1.0.0",
-    "react-redux": "^7.2.0",
-    "react-router-dom": "^6.3.0",
-    "react-searchkit": "^3.0.0",
-    "redux": "^4.0.5",
-    "redux-devtools-extension": "^2.13.8",
-    "redux-thunk": "^2.3.0",
-    "replaywebpage": "^2.3.16",
-    "select2": "~4.0.2",
-    "semantic-ui-css": "^2.4.1",
-    "semantic-ui-less": "^2.4.1",
-    "semantic-ui-react": "^2.1.1",
+    "react-redux": "^7.2.9",
+    "react-router-dom": "^6.30.4",
+    "react-searchkit": "^3.2.0",
+    "redux": "^4.2.1",
+    "redux-devtools-extension": "^2.13.9",
+    "redux-thunk": "^2.4.2",
+    "replaywebpage": "^2.5.0",
+    "select2": "~4.0.13",
+    "semantic-ui-css": "^2.5.0",
+    "semantic-ui-less": "^2.5.0",
+    "semantic-ui-react": "^2.1.5",
     "three": "^0.182.0",
     "three-addons": "^1.2.0",
-    "tinymce": "^6.7.2",
-    "video.js": "^8.6.1",
-    "yup": "^0.32.11",
-    "eslint": "^8"
+    "tinymce": "^6.8.6",
+    "video.js": "^8.24.0",
+    "yup": "^0.32.11"
   },
   "description": "Invenio assets",
   "devDependencies": {
-    "@inveniosoftware/eslint-config-invenio": "^2.0.0",
-    "@rspack/cli": ">1.0.0",
-    "@rspack/core": "<1.7.0",
-    "@rspack/dev-server": ">1.0.0",
-    "@swc/core": "^1.6.13",
-    "@swc/helpers": "^0.5.11",
-    "autoprefixer": "^10.4.0",
-    "babel-loader": "^9.0.0",
-    "css-loader": "^6.0.0",
-    "eventsource-polyfill": "^0.9.0",
-    "expose-loader": "^4.0.0",
-    "file-loader": "^6.0.0",
-    "less": "^4.0.0",
-    "less-loader": "^11.0.0",
-    "ora": "^6.0.0",
-    "patch-package": "^6.5.0",
-    "postcss-flexbugs-fixes": "^5.0.0",
-    "postcss-loader": "^7.0.0",
-    "postcss-preset-env": "^8.0.0",
+    "@inveniosoftware/eslint-config-invenio": "^2.1.0",
+    "@rspack/cli": "^2.1.9",
+    "@rspack/core": "^1.6.8",
+    "@rspack/dev-server": "^2.2.0",
+    "@swc/core": "^1.15.47",
+    "@swc/helpers": "^0.5.23",
+    "autoprefixer": "^10.5.4",
+    "babel-loader": "^9.2.1",
+    "css-loader": "^6.11.0",
+    "eventsource-polyfill": "^0.9.6",
+    "expose-loader": "^4.1.0",
+    "file-loader": "^6.2.0",
+    "less": "^4.8.1",
+    "less-loader": "^11.1.4",
+    "ora": "^6.3.1",
+    "patch-package": "^6.5.1",
+    "postcss-flexbugs-fixes": "^5.0.2",
+    "postcss-loader": "^7.3.4",
+    "postcss-preset-env": "^8.5.1",
     "postcss-safe-parser": "^6.0.0",
-    "sass": "^1.50.0",
-    "sass-loader": "^16.0.0",
-    "style-loader": "^3.0.0",
-    "swc-loader": "^0.2.6",
-    "url-loader": "^4.1.0",
-    "webpack-bundle-analyzer": "^4.0.0",
-    "webpack-bundle-tracker": "^1.0.0"
+    "sass": "^1.102.0",
+    "sass-loader": "^16.0.8",
+    "style-loader": "^3.3.4",
+    "swc-loader": "^0.2.7",
+    "url-loader": "^4.1.1",
+    "webpack-bundle-analyzer": "^4.10.2",
+    "webpack-bundle-tracker": "^1.8.1"
   },
   "engines": {
     "node": ">=18",