61 - Bake node modules and Chromium into the CI image

.forgejo/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Compute image tag from lockfile
         id: meta
         run: |
-          HASH="$(sha256sum composer.lock | cut -c1-12)"
+          HASH="$(cat composer.lock package-lock.json | sha256sum | cut -c1-12)"
           echo "tag=php8.3-${HASH}" >> "$GITHUB_OUTPUT"
 
       - name: Check whether image already exists
@@ -87,11 +87,8 @@ jobs:
       - name: Tests
         run: vendor/bin/pest
 
-      - name: Install frontend dependencies
+      - name: Restore frontend dependencies
-        run: npm ci
+        run: cp -a /opt/deps-node/node_modules ./node_modules
-
-      - name: Install Playwright browser
-        run: npx playwright install --with-deps chromium
 
       - name: Build frontend assets
         run: npm run build

docker/build/Dockerfile.ci

@@ -55,3 +55,15 @@ RUN --mount=type=secret,id=gh_pat \
     STATUS=$?; \
     composer config --global --unset github-oauth.github.com >/dev/null 2>&1 || true; \
     exit $STATUS
+
+# Bake the Node dependencies and the Chromium build alongside the PHP ones, so a
+# run installs neither. Both are keyed to package-lock.json via the image tag.
+WORKDIR /opt/deps-node
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund \
+    && PLAYWRIGHT_BROWSERS_PATH=/opt/playwright ./node_modules/.bin/playwright install --with-deps chromium
+
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
+
+# Cosmetic only — the runner overrides this with its own --workdir.
+WORKDIR /workspace