ci: deploy the verified local image

Build and test the Next.js application once with persistent BuildKit caches, smoke-test the immutable runtime image, and activate that same image through the shared production Docker daemon with serialized rollback-safe deployment.

Dockerfile

@@ -1,37 +1,48 @@
-FROM node:22-alpine AS builder
+# syntax=docker/dockerfile:1.7
+
+FROM node:22-alpine AS dependencies
 
 WORKDIR /app
 
 ARG NPM_REGISTRY=https://package-mirror.liara.ir/repository/npm/
+ENV NEXT_TELEMETRY_DISABLED=1
 
 COPY package.json package-lock.json ./
-RUN npm ci \
-  --registry="${NPM_REGISTRY}" \
-  --replace-registry-host=registry.npmjs.org \
-  --include=optional
+RUN --mount=type=cache,id=portfolio-npm-node22,target=/root/.npm,sharing=locked \
+  npm ci \
+    --registry="${NPM_REGISTRY}" \
+    --replace-registry-host=registry.npmjs.org \
+    --include=optional
+
+FROM dependencies AS verification
 
 COPY . .
-RUN npm run build
+RUN npm run lint
+RUN npm run typecheck
+RUN --mount=type=cache,id=portfolio-next-node22,target=/app/.next/cache,sharing=locked \
+  npm run build
+RUN npm test
 
 FROM node:22-alpine AS runtime
 
 WORKDIR /app
 ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
     HOSTNAME=0.0.0.0 \
     PORT=3000
 
 RUN addgroup --system --gid 1001 nodejs \
   && adduser --system --uid 1001 nextjs
 
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+COPY --from=verification --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=verification --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=verification --chown=nextjs:nodejs /app/public ./public
 RUN mkdir -p .next/cache && chown -R nextjs:nodejs .next/cache
 
 USER nextjs
 EXPOSE 3000
 
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/ || exit 1
+HEALTHCHECK --interval=2s --timeout=2s --start-period=3s --retries=30 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
 
 CMD ["node", "server.js"]