Merge pull request #11 from luxfi/fix/pnpm-docker-build

fix(ui): pin pnpm 10.16.1 + onlyBuiltDependencies allowlist

Dockerfile

@@ -1,9 +1,15 @@
 # Stage 1: Build embedded admin UI
 FROM node:22-alpine AS ui
-RUN corepack enable && corepack prepare pnpm@latest --activate
+# Pin pnpm to a known-good version so corepack doesn't pull a tagged-but-unsigned
+# release. v10.x supports `onlyBuiltDependencies` in package.json and does not
+# fail the install step on ignored build scripts (newer v11 returns non-zero
+# unless explicitly approved, even in non-interactive Docker builds).
+RUN corepack enable && corepack prepare [email protected] --activate
 WORKDIR /ui
 COPY ui/package.json ui/pnpm-lock.yaml* ./
-RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install
+# `--frozen-lockfile` first so verifiable builds win; fall back to a
+# lockfile-updating install if the lock is missing.
+RUN pnpm install --frozen-lockfile || pnpm install --no-frozen-lockfile
 COPY ui/ .
 RUN pnpm build
 

ui/package.json

@@ -19,5 +19,10 @@
     "@vitejs/plugin-react": "^4.3.4",
     "typescript": "^5.7.0",
     "vite": "^6.0.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }