[kkroo]

What changed

• Copy scripts/postinstall.mjs into the Docker build context before npm ci, so the declared postinstall hook works in the clean image build.
• Let pull requests authenticate with the existing pull-only Harbor cache credentials and reuse designer/designer-runtime:buildcache.
• Keep cache export and image publication restricted to pushes on main; pull requests remain build-only.

Validation

• yq e '"'"'.'"'"' .github/workflows/docker-pod.yml
• git diff --check
• npm ci --no-audit --no-fund
• npm run check
• npm run build

The shared cache namespace may initially miss until its Harbor project/credential setup is complete; the build still succeeds from a cold cache.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex (applied directly; nested CLI not launched in the k8s run pod).
Reviewed head: 5c6393b

Looks good. Small, correctly-scoped change: PRs get read-only cache access, cache export and publication stay gated to push on main.

Critical Issues (0)

Important Issues (0)

Suggestions (2)

• [pr-review-toolkit/code] .github/workflows/docker-pod.yml:13-31 — Dockerfile.pod now COPYs scripts/postinstall.mjs into the npm ci layer, but that path is not in either paths: filter. A PR that only edits postinstall.mjs (or deletes/renames it) won't run this image build, so a broken COPY would first show up on an unrelated later change. Consider adding "scripts/postinstall.mjs" to both lists.
• [gstack/review] .github/workflows/docker-pod.yml:44-46 — the pull-only cache credentials are exported as job-level env, so every step in the job (including third-party actions) can read them, not only the login step. The secret is pull-only and fork PRs never receive it, so the exposure is small; scoping it to the step would be tighter, e.g. keep the if: on secrets.HARBOR_CACHE_PULL_PASSWORD != '' via a step-level env and reference secrets.* directly in with:.

Strengths

• The env.CACHE_PULL_PASSWORD != '' guard makes fork PRs (no secrets) and the not-yet-provisioned credential case degrade to a cold-cache build instead of failing the login step.
• cache-to remains restricted to push + refs/heads/main, so PR builds cannot poison the shared :buildcache.
• Copying only scripts/postinstall.mjs before npm ci keeps the dependency layer's cache key narrow, instead of COPY scripts/.

Recommended Action

1. No blocking changes requested.
2. Merge once the remaining required CI checks finish green.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex (applied directly; nested CLI not launched in the k8s run pod).
Reviewed head: e074f96

Looks good. The new commit since the previous review (5c6393b → e074f96, Dockerfile.pod only) fixes the skill copy path: node:24-bookworm-slim uses the npm prefix /usr/local, so npm i -g ./pro-vi-designer-*.tgz installs to /usr/local/lib/node_modules, and the old /usr/lib/node_modules/... source would have failed the cp. Neither scripts/entrypoint-pod.sh nor scripts/designer-chrome-pod.sh references the old path.

Critical Issues (0)

Important Issues (0)

Suggestions (3)

• [pr-review-toolkit/comments] Dockerfile.pod:18 — the header usage example still says COPY --from=designer-runtime /usr/lib/node_modules/@blockcast/designer .... The package actually installs as @pro-vi/designer under /usr/local/lib/node_modules, so anyone copying that example gets a missing-path build error. Worth updating alongside this fix.
• [pr-review-toolkit/code] .github/workflows/docker-pod.yml paths: filters — still carried from the previous head: scripts/postinstall.mjs is now COPYed before npm ci but is not in the trigger paths, so a PR touching only that file won't exercise the image build.
• [gstack/review] .github/workflows/docker-pod.yml:44-46 — still carried: the pull-only cache credentials are job-level env, visible to every step. Pull-only and absent on fork PRs, so low exposure; step-level scoping would be tighter.

Strengths

• Root-cause fix (correct global prefix for the official node image) rather than a symlink or npm config set prefix workaround.
• cache-to stays restricted to push on main; PR builds only read the shared cache, and the empty-secret guard keeps fork PRs on a cold-cache build.

Recommended Action

1. No blocking changes requested.
2. Merge once the remaining required CI checks finish green.