From 7f7a9450bfd16650e5b9752fc3620041d5603e55 Mon Sep 17 00:00:00 2001
From: myrmidex <myrmidex@myrmidex.net>
Date: Wed, 19 Aug 2026 19:32:08 +0200
Subject: [PATCH] 61 - Bake node modules and Chromium into the CI image

---
 .forgejo/workflows/ci.yml  |  9 +++------
 docker/build/Dockerfile.ci | 12 ++++++++++++
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 7a5e14c..428c6c9 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Compute image tag from lockfile
         id: meta
         run: |
-          HASH="$(sha256sum composer.lock | cut -c1-12)"
+          HASH="$(cat composer.lock package-lock.json | sha256sum | cut -c1-12)"
           echo "tag=php8.3-${HASH}" >> "$GITHUB_OUTPUT"
 
       - name: Check whether image already exists
@@ -87,11 +87,8 @@ jobs:
       - name: Tests
         run: vendor/bin/pest
 
-      - name: Install frontend dependencies
-        run: npm ci
-
-      - name: Install Playwright browser
-        run: npx playwright install --with-deps chromium
+      - name: Restore frontend dependencies
+        run: cp -a /opt/deps-node/node_modules ./node_modules
 
       - name: Build frontend assets
         run: npm run build
diff --git a/docker/build/Dockerfile.ci b/docker/build/Dockerfile.ci
index 0e3b35e..857384a 100644
--- a/docker/build/Dockerfile.ci
+++ b/docker/build/Dockerfile.ci
@@ -55,3 +55,15 @@ RUN --mount=type=secret,id=gh_pat \
     STATUS=$?; \
     composer config --global --unset github-oauth.github.com >/dev/null 2>&1 || true; \
     exit $STATUS
+
+# Bake the Node dependencies and the Chromium build alongside the PHP ones, so a
+# run installs neither. Both are keyed to package-lock.json via the image tag.
+WORKDIR /opt/deps-node
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund \
+    && PLAYWRIGHT_BROWSERS_PATH=/opt/playwright ./node_modules/.bin/playwright install --with-deps chromium
+
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
+
+# Cosmetic only — the runner overrides this with its own --workdir.
+WORKDIR /workspace