fix: Move prisma to prod dependency instead of dev and add build.sh/Dockerfile for blog-with-auth #721
Conversation
…allow for use in migrations - Add Dockerfile to blog-with-auth
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 0360457 The changes in this PR will be included in the next version bump. This PR includes changesets to release 18 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
📝 WalkthroughWalkthroughMoves the Prisma package from devDependencies to dependencies across example backends and the Prisma generator; adds a changeset documenting the change; and adds a multi-stage Dockerfile, build script, and updated manifest for the blog-with-auth example. Changes
Sequence Diagram(s)(omitted — changes are dependency and infra adjustments without new multi-component control-flow requiring sequence visualization) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
examples/blog-with-auth/build.sh (1)
14-19: Consider verifying package existence before build.The script proceeds directly to installation and build without checking if the specified package exists in the workspace. This could lead to confusing error messages.
🔎 Optional improvement
# Install dependencies for the specified package and root workspace echo "Installing dependencies for $PACKAGE_NAME..." -pnpm install --filter "$PACKAGE_NAME"... --filter "$ROOT_PACKAGE_NAME" +if ! pnpm list --filter "${PACKAGE_NAME}" --depth=-1 >/dev/null 2>&1; then + echo "Error: Package '${PACKAGE_NAME}' not found in workspace" + exit 1 +fi + +pnpm install --filter "${PACKAGE_NAME}"... --filter "${ROOT_PACKAGE_NAME}" # Run build command for the package using turbo echo "Building $PACKAGE_NAME..." -pnpm turbo run build --filter="$PACKAGE_NAME" +pnpm turbo run build --filter="${PACKAGE_NAME}"examples/blog-with-auth/Dockerfile (1)
46-47: Consider parameterizing the healthcheck port.The healthcheck hardcodes port 3000. If the application port is configurable via environment variables, consider using a build arg to make the healthcheck flexible.
🔎 Optional improvement
+ARG PORT=3000 + # Set health check HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \ - CMD wget --no-verbose --tries=1 --spider http://localhost:3000/healthz || exit 1 + CMD wget --no-verbose --tries=1 --spider http://localhost:${PORT}/healthz || exit 1Note: Build args in HEALTHCHECK require Docker BuildKit and might not work in all scenarios.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (4)
examples/blog-with-auth/apps/backend/baseplate/generated/package.jsonis excluded by!**/generated/**,!**/generated/**examples/blog-with-auth/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlexamples/todo-with-auth0/apps/backend/baseplate/generated/package.jsonis excluded by!**/generated/**,!**/generated/**examples/todo-with-auth0/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (7)
.changeset/some-flowers-double.mdexamples/blog-with-auth/.baseplate-snapshot/manifest.jsonexamples/blog-with-auth/Dockerfileexamples/blog-with-auth/apps/backend/package.jsonexamples/blog-with-auth/build.shexamples/todo-with-auth0/apps/backend/package.jsonpackages/fastify-generators/src/generators/prisma/prisma/prisma.generator.ts
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/code-style.mdc)
**/*.{ts,tsx}: Use TypeScript with strict type checking enabled
Always include return types on top-level functions including React components (React.ReactElement)
Include absolute paths in import statements via tsconfig paths (@src/is the alias forsrc/)
If a particular interface or type is not exported, change the file so it is exported
If caught on a typing loop where forcing theanytype is necessary, do not iterate too much - leave the typing as broken and let the user fix itIf target code is not easily testable, refactor it to be more testable (e.g., export types or functions)
**/*.{ts,tsx}: Import components from '@baseplate-dev/ui-components' package for UI development (e.g., Button, Input, Card, Dialog, etc.)
Use form components with React Hook Form controller variants (InputField, TextareaField, SelectField, CheckboxField, SwitchField, ComboboxField, MultiComboboxField, ColorPickerField, DatePickerField, DateTimePickerField)
Use SidebarLayout, Card, Breadcrumb, NavigationMenu, and NavigationTabs components for consistent layout structure from @baseplate-dev/ui-components
Use Dialog, ConfirmDialog, and useConfirmDialog from @baseplate-dev/ui-components for modal dialogs and confirmation interactions
Always usecompareStringsfrom@baseplate-dev/utilsinstead ofString.prototype.localeCompare()for code generation, file sorting, and internal data structures
If a particular interface or type is not exported, modify the file to export it
Use TsCodeFragment for composable code pieces and TsCodeUtils for manipulating fragments when generating TypeScript code
Create generators usingcreateGeneratorwith configuration via descriptor schema (Zod), organizing into one or more tasks created withcreateGeneratorTask
Tasks should haverun(initialization) andbuild(code generation) phases, export and consume providers, and may be organized into phases for ordered execution
Use provider scopes to control visibility and prevent collisions be...
Files:
packages/fastify-generators/src/generators/prisma/prisma/prisma.generator.ts
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/code-style.mdc)
**/*.{ts,tsx,js}: Node 16 module resolution - include file extensions in imports (.js)
Sort imports by group: external libs first, then local imports
Use camelCase for variables/functions, PascalCase for types/classes
Order functions such that functions are placed below the variables/functions they use
Prefer using nullish coalescing operator (??) instead of logical or (||), enforced via ESLint rule
Prefer barrel exports e.g.export * from './foo.js'instead of individual named exports
Use console.info/warn/error instead of console.log
Files:
packages/fastify-generators/src/generators/prisma/prisma/prisma.generator.ts
examples/blog-with-auth/**/package.json
📄 CodeRabbit inference engine (examples/blog-with-auth/CLAUDE.md)
examples/blog-with-auth/**/package.json: Enforce pnpm 10+ as the package manager
Use ESM only with"type": "module"in package.json
Files:
examples/blog-with-auth/apps/backend/package.json
.changeset/*.md
📄 CodeRabbit inference engine (AGENTS.md)
Add a new Changeset in the
.changeset/directory for new features or changes, with format'package-name': patchand description of the feature or change
Files:
.changeset/some-flowers-double.md
🧠 Learnings (9)
📓 Common learnings
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Enforce pnpm 10+ as the package manager
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Use ESM only with `"type": "module"` in package.json
📚 Learning: 2025-11-24T19:44:46.506Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/todo-with-auth0/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:46.506Z
Learning: Use pnpm 10+ as the package manager (enforced)
Applied to files:
examples/todo-with-auth0/apps/backend/package.jsonpackages/fastify-generators/src/generators/prisma/prisma/prisma.generator.tsexamples/blog-with-auth/apps/backend/package.json
📚 Learning: 2025-11-24T19:45:08.523Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: .cursor/rules/dev-commands.mdc:0-0
Timestamp: 2025-11-24T19:45:08.523Z
Learning: Build the project using `pnpm build` from repository root or package
Applied to files:
packages/fastify-generators/src/generators/prisma/prisma/prisma.generator.tsexamples/blog-with-auth/Dockerfileexamples/blog-with-auth/build.sh
📚 Learning: 2025-11-24T19:44:33.994Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Enforce pnpm 10+ as the package manager
Applied to files:
examples/blog-with-auth/apps/backend/package.jsonexamples/blog-with-auth/build.sh
📚 Learning: 2025-11-24T19:44:33.994Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Use ESM only with `"type": "module"` in package.json
Applied to files:
examples/blog-with-auth/apps/backend/package.jsonexamples/blog-with-auth/build.sh
📚 Learning: 2025-05-08T12:56:11.723Z
Learnt from: kingston
Repo: halfdomelabs/baseplate PR: 539
File: scripts/check-changesets.ts:70-79
Timestamp: 2025-05-08T12:56:11.723Z
Learning: In the check-changesets.ts script for monorepo validation, `npm pack ${pkg.name}latest` is intentionally used to pack the most recently published version (not local changes) for comparison purposes to determine if changes require new changesets.
Applied to files:
examples/blog-with-auth/build.sh
📚 Learning: 2025-08-17T01:32:58.983Z
Learnt from: kingston
Repo: halfdomelabs/baseplate PR: 633
File: packages/project-builder-web/src/routes/admin-sections.$appKey/-components/columns/column-configs.ts:1-2
Timestamp: 2025-08-17T01:32:58.983Z
Learning: The project-builder-web package doesn't use ESM (ECMAScript modules), so .js extensions are not required in import statements, unlike other packages in the codebase that do use Node 16 ESM resolution.
Applied to files:
examples/blog-with-auth/build.sh
📚 Learning: 2025-11-25T22:46:20.505Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-11-25T22:46:20.505Z
Learning: Applies to .changeset/*.md : Add a new Changeset in the `.changeset/` directory for new features or changes, with format `'package-name': patch` and description of the feature or change
Applied to files:
.changeset/some-flowers-double.md
📚 Learning: 2025-11-25T22:46:20.505Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-11-25T22:46:20.505Z
Learning: Baseplate development follows a code-first approach: make changes directly in working codebases, extract those changes into reusable templates, update generators to use the new templates, then validate and sync the generated code
Applied to files:
.changeset/some-flowers-double.md
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Lint Examples (blog-with-auth)
- GitHub Check: Verify Sync (todo-with-auth0)
- GitHub Check: Verify Sync (blog-with-auth)
- GitHub Check: Test E2E
- GitHub Check: Lint
- GitHub Check: test
🔇 Additional comments (9)
examples/blog-with-auth/.baseplate-snapshot/manifest.json (1)
2-6: LGTM! Manifest correctly updated.The manifest properly tracks the new files (Dockerfile and build.sh) added in this PR alongside the existing CLAUDE.md entry.
examples/blog-with-auth/apps/backend/package.json (1)
63-63: LGTM! Prisma correctly moved to production dependencies.This change aligns with the PR objective to enable runtime Prisma usage for migrations and schema operations. The configuration follows project guidelines (pnpm 10+, ESM).
packages/fastify-generators/src/generators/prisma/prisma/prisma.generator.ts (1)
106-111: LGTM! Generator correctly updated for runtime Prisma.The generator now includes Prisma in production dependencies, ensuring generated projects have Prisma available at runtime. This aligns with the package.json updates across the codebase.
.changeset/some-flowers-double.md (1)
1-5: LGTM! Changeset properly documents the dependency change.The changeset correctly captures the Prisma dependency relocation with appropriate patch-level versioning and clear rationale.
examples/blog-with-auth/Dockerfile (4)
1-5: LGTM! Proper base image configuration.The base stage correctly uses a specific Node.js version, Alpine for minimal size, and tini for proper signal handling and process reaping in containers.
18-24: LGTM! Optimized dependency installation.The Dockerfile correctly copies only the files needed for dependency resolution before running
pnpm install, which optimizes Docker layer caching. Using--frozen-lockfileensures reproducible builds.
43-50: LGTM! Proper production stage security.The production stage correctly:
- Switches to non-root
nodeuser for security- Includes a healthcheck for container orchestration
- Uses a minimal runtime setup
30-30: The turbo command syntaxpnpm turbo run blog-with-auth-backend#buildis valid. Thepackage#taskformat is a supported shorthand in turbo for running a specific package's task. While the codebase uses--filterpattern elsewhere (e.g.,pnpm turbo run build --filter="$PACKAGE_NAME"), both syntaxes are correct and serve similar purposes.Likely an incorrect or invalid review comment.
examples/todo-with-auth0/apps/backend/package.json (1)
73-73: Moving Prisma to production dependencies is correct.Runtime usage (migrations, schema operations) requires Prisma in dependencies. Version 7.2.0 is the latest stable release (December 17, 2025) with no known security vulnerabilities.
| exit 1 | ||
| fi | ||
|
|
||
| PACKAGE_NAME=$1 |
There was a problem hiding this comment.
Validate and quote the package name parameter.
The package name from $1 is used directly without validation or proper quoting, which could lead to shell injection if an attacker controls the input. While this is a build script (not user-facing), it's still a security best practice.
🔎 Recommended security fix
PACKAGE_NAME=$1
+
+# Validate package name format (alphanumeric, hyphens, underscores, @, /)
+if [[ ! "$PACKAGE_NAME" =~ ^[@a-zA-Z0-9/_-]+$ ]]; then
+ echo "Error: Invalid package name format"
+ exit 1
+fi
+
ROOT_PACKAGE_NAME=blog-with-auth-rootAdditionally, ensure variables are properly quoted in commands:
# Install dependencies for the specified package and root workspace
echo "Installing dependencies for $PACKAGE_NAME..."
-pnpm install --filter "$PACKAGE_NAME"... --filter "$ROOT_PACKAGE_NAME"
+pnpm install --filter "${PACKAGE_NAME}"... --filter "${ROOT_PACKAGE_NAME}"
# Run build command for the package using turbo
echo "Building $PACKAGE_NAME..."
-pnpm turbo run build --filter="$PACKAGE_NAME"
+pnpm turbo run build --filter="${PACKAGE_NAME}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| PACKAGE_NAME=$1 | |
| PACKAGE_NAME=$1 | |
| # Validate package name format (alphanumeric, hyphens, underscores, @, /) | |
| if [[ ! "$PACKAGE_NAME" =~ ^[@a-zA-Z0-9/_-]+$ ]]; then | |
| echo "Error: Invalid package name format" | |
| exit 1 | |
| fi | |
| ROOT_PACKAGE_NAME=blog-with-auth-root |
🤖 Prompt for AI Agents
In examples/blog-with-auth/build.sh around line 10, the script assigns
PACKAGE_NAME=$1 without validation or quoting which risks shell injection;
validate that $1 is non-empty and matches a safe pattern (e.g., only
alphanumeric, dashes, underscores and dots), exit with an error if it fails, and
always use quoted variable expansions wherever PACKAGE_NAME is used in
subsequent commands to prevent word-splitting and injection.
| RUN pnpm turbo run blog-with-auth-backend#build | ||
|
|
||
| # Deploy production-ready app | ||
| RUN pnpm --filter=blog-with-auth-backend deploy --prod /prod/backend --legacy |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
pnpm deploy --legacy flag documentation what does it do
💡 Result:
The --legacy flag for pnpm deploy forces the legacy deploy implementation. It disables pnpm's default behavior of creating a dedicated lockfile from a shared lockfile for deployment and also lets you run deploy without requiring inject-workspace-packages=true. [1][2]
Sources:
- pnpm deploy documentation (options, --legacy). [1]
- pnpm (next) deploy docs (same --legacy description). [2]
🌐 Web query:
pnpm deploy --legacy when is it necessary monorepo inject-workspace-packages
💡 Result:
Use --legacy when your workspace isn't configured to "inject" workspace packages or when you want the old deploy behavior (no dedicated lockfile creation from a shared workspace lockfile).
- By default pnpm deploy requires the setting inject-workspace-packages = true. If that setting is not enabled, run pnpm deploy --legacy (or set force-legacy-deploy = true).
- --legacy also disables pnpm's default attempt to create a dedicated lockfile from the shared workspace lockfile for the deployment. (pnpm.io)
If you can, prefer enabling inject-workspace-packages = true (in .npmrc or pnpm config) so you can use the newer deploy flow; use --legacy only for compatibility. (pnpm.io)
Citations:
- 1: https://pnpm.io/it/cli/deploy?utm_source=openai
- 2: https://pnpm.io/it/cli/deploy?utm_source=openai
Verify if inject-workspace-packages is configured, and consider removing the --legacy flag.
The --legacy flag is used when the workspace isn't configured with inject-workspace-packages = true. If your .npmrc or pnpm configuration doesn't have this setting enabled, the flag is necessary. However, if you can enable inject-workspace-packages = true, you can remove --legacy and use the newer deploy behavior, which creates a dedicated lockfile from the shared workspace lockfile rather than relying on legacy deployment mode.
🤖 Prompt for AI Agents
In examples/blog-with-auth/Dockerfile around line 33, the RUN uses pnpm deploy
with the --legacy flag which is only required when the workspace lacks
inject-workspace-packages = true; verify your project .npmrc or pnpm config and
if you can enable inject-workspace-packages = true in the workspace config,
remove the --legacy flag from the deploy command to use the newer deployment
behavior that creates a dedicated lockfile from the shared workspace lockfile.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (3)
tests/simple/apps/backend/baseplate/generated/package.jsonis excluded by!**/generated/**,!tests/**,!**/generated/**tests/simple/apps/backend/package.jsonis excluded by!tests/**tests/simple/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!tests/**
📒 Files selected for processing (1)
examples/todo-with-auth0/apps/backend/.baseplate-snapshot/diffs/package.json.diff
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Enforce pnpm 10+ as the package manager
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Use ESM only with `"type": "module"` in package.json
📚 Learning: 2025-11-24T19:44:33.994Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/blog-with-auth/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:33.994Z
Learning: Applies to examples/blog-with-auth/**/package.json : Enforce pnpm 10+ as the package manager
Applied to files:
examples/todo-with-auth0/apps/backend/.baseplate-snapshot/diffs/package.json.diff
📚 Learning: 2025-11-24T19:44:46.506Z
Learnt from: CR
Repo: halfdomelabs/baseplate PR: 0
File: examples/todo-with-auth0/CLAUDE.md:0-0
Timestamp: 2025-11-24T19:44:46.506Z
Learning: Use pnpm 10+ as the package manager (enforced)
Applied to files:
examples/todo-with-auth0/apps/backend/.baseplate-snapshot/diffs/package.json.diff
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Test E2E
🔇 Additional comments (1)
examples/todo-with-auth0/apps/backend/.baseplate-snapshot/diffs/package.json.diff (1)
5-14: Prisma is correctly positioned in the dependencies section (version 7.2.0) and has been removed from devDependencies as expected per the PR objectives.
| "prettier": "3.6.2", | ||
| "prettier-plugin-packagejson": "2.5.19", | ||
| "prisma": "7.2.0", | ||
| + "sentry-testkit": "^6.2.2", |
There was a problem hiding this comment.
Clarify the addition of sentry-testkit.
The addition of sentry-testkit appears unrelated to the stated PR objectives (moving Prisma to production dependencies and adding deployment files). Please confirm whether this is an intentional change or if it should be part of a separate PR.
🤖 Prompt for AI Agents
In
examples/todo-with-auth0/apps/backend/.baseplate-snapshot/diffs/package.json.diff
around line 10, a dependency entry for "sentry-testkit": "^6.2.2" was added but
the PR description doesn't mention this change; confirm whether this addition is
intentional. If it was accidental, remove the line from the diff (and from
package.json) and regenerate the snapshot; if it was intentional but used only
for tests, move it to devDependencies and update the PR description to explain
why this test helper is needed; otherwise keep it in dependencies and add a
brief justification in the PR so reviewers know it belongs in this change.
kingston
deleted the
kingston/eng-959-add-deployable-dockerfile-for-backend
branch
Summary by CodeRabbit
New Features
Chores
✏️ Tip: You can customize this high-level summary in your review settings.