codeant-ai-for-open-source[bot] commented on code in PR #45606:
URL: https://github.com/apache/superset/pull/45606#discussion_r4344355432
##########
Dockerfile:
##########
@@ -26,6 +26,20 @@ ARG BUILDPLATFORM=${BUILDPLATFORM:-amd64}
# Include translations in the final build
ARG BUILD_TRANSLATIONS="false"
+######################################################################
+# superset-node-manifests holds only the npm manifests of the frontend
+# tree (the root package.json + lockfile and every workspace package.json),
+# so the `npm ci` layer in superset-node-ci can see the workspaces and is
+# cached on dependency declarations alone, not on every source change.
+# Docker cannot COPY a glob while keeping the directory structure, hence
+# the copy-then-prune stage.
+######################################################################
+FROM --platform=${BUILDPLATFORM} node:24-trixie-slim AS superset-node-manifests
+WORKDIR /app/superset-frontend
+COPY superset-frontend /app/superset-frontend
+RUN find . -type f ! -name package.json ! -name package-lock.json -delete \
+ && find . -depth -type d -empty -delete
Review Comment:
**Suggestion:** The prune drops `.npmrc`, so `npm ci` installs workspace
dependencies without the configured three-day release-age check and can admit
newly published packages.
**Assessment:** ๐ `Major` ยท ๐ `Occurrence: Often` ยท ๐ท๏ธ `Security`
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=a0cf79331db5428eac3fb52282481ca1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=a0cf79331db5428eac3fb52282481ca1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** Dockerfile
**Line:** 40:41
**Comment:**
*Security: The prune drops `.npmrc`, so `npm ci` installs workspace
dependencies without the configured three-day release-age check and can admit
newly published packages.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45606&comment_hash=b382ae1b24404aa024ac4bfde534b25f966975169c8c68329d73f8eca669f551&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45606&comment_hash=b382ae1b24404aa024ac4bfde534b25f966975169c8c68329d73f8eca669f551&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
