ci: build the Docker image on pull requests, and assert what it ships (#384)

[dcccrypto]

Closes #384.

The gap

docker:
  needs: build-and-test
  if: github.ref == 'refs/heads/main'

The image was only built after merge, so image-build breakage passed PR review invisibly and landed on a red main.

Not theoretical — as the issue documents, the job failed on every push to main from 2026-06-22 to 2026-07-18 (~4 weeks) with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. The PR that introduced it could not have caught it: build-and-test passes in that scenario because actions/checkout supplies the whole repo while the docker build context is narrower. The two jobs disagree on exactly the thing that broke, and only the invisible one ran.

On the suggested fix

The issue proposes push: ${{ github.ref == 'refs/heads/main' }} to keep the registry push main-only. There is no push step — the job only runs docker build. So ungating it is sufficient and nothing needs push-gating.

Also: assert what the image actually ships

The Dockerfile's K-NEW-1 comment claims the runtime image excludes vitest, tsx, @types/* and their CVEs:

# K-NEW-1: install production deps only — excludes vitest, vite, tsx, @types/*
# and their associated CVEs from the final image.
RUN pnpm install --frozen-lockfile --prod

Nothing verified that. A regression to a full install would still build green — the same "green job proves nothing" trap that let the 4-week breakage hide. So the job now asserts the outcome:

• vitest / tsx / typescript / fast-check absent from /app/node_modules
• @solana/web3.js / @upstash/redis / p-queue / lru-cache present

The second is the mirror check: an install that dropped real dependencies would satisfy the first on its own.

Verification

Same fix and assertion pattern as percolator-indexer#185, where it is already green and I confirmed from the job log that the assertion steps actually executed rather than being skipped.

This PR is self-verifying the same way: for a same-repo pull_request GitHub uses the workflow from the PR branch, so if a docker check appears below and passes, the change works — and the assertions tell you the image contents are right, not merely that it built.

Note for reviewers: this touches only .github/workflows/ci.yml, so it doesn't collide with any of the open PRs on liquidation.ts / oracle.ts / crank.ts.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@dcccrypto, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 4 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9a2d8dfd-df4e-4856-8a45-868de12b3192

📥 Commits

Reviewing files that changed from the base of the PR and between 1d2cb11 and cde8361.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/docker-build-on-prs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}