Update Dockerfile

Dockerfile

@@ -2,68 +2,35 @@
 # =============================================================================
 # Rochester-restricted Bluesky PDS + full Bluesky web app - single Dockerfile.
 #
-# Stage 1 builds this repo's web client (the bsky.app React Native Web SPA).
-# Stage 2 is the official PDS image, patched at boot to (a) restrict
-# registration to @rochesterschools.org and (b) serve the web app at / with an
-# SPA fallback. One container serves both the app UI and the AT Protocol API.
+# The web client (bsky.app React Native Web SPA) is prebuilt by GitHub Actions
+# (workflow: .github/workflows/prebuild-web.yml) and force-pushed to the
+# `prebuilt-web` branch. This image simply copies that static bundle into the
+# official PDS image and patches it at boot to (a) restrict registration to
+# @rochesterschools.org and (b) serve the web app at / with an SPA fallback.
+#
+# No Node build happens here - so this builds fast and fits in low-memory
+# builders like HF Spaces free tier.
 #
 # Listens on port 7860 (HF forwards the public Space URL to it automatically).
 # =============================================================================
 
-# ---------------------------------------------------------------- build stage
 FROM node:24-bookworm-slim AS webapp
 
-# Pin pnpm explicitly: package.json's packageManager field is not the classic
-# "pnpm@x.y.z" string, so corepack would otherwise pick the latest pnpm,
-# which cannot read this repo's lockfile. 11.21.0 is the version declared in
-# devEngines and verified against pnpm-lock.yaml.
-RUN corepack enable && corepack prepare pnpm@11.21.0 --activate
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /build
+WORKDIR /bundle
 
-# The Space's build context may contain only this Dockerfile (HF uploads can
-# exclude the repo), so clone the source from GitHub instead of COPY . .
-# Pin to a commit SHA for reproducible builds. When you push new commits and
-# want them live, update SOURCE_REF (or override it as a Space build arg).
+# The prebuilt bundle lives on the `prebuilt-web` branch (pushed by
+# prebuild-web.yml). Update SOURCE_REF to the commit of that branch whenever
+# the web app changes and the workflow has run.
 ARG SOURCE_REPO=https://github.com/CloudCompile/social-app.git
-ARG SOURCE_REF=a89f05821ad42b3b88ccba1290d8ce7632b5a42a
-# Fetch by SHA (clone --branch only accepts refs). GitHub allows fetching
-# reachable commit SHAs directly.
+ARG SOURCE_REF=prebuilt-web
 RUN git init . \
  && git remote add origin ${SOURCE_REPO} \
  && git fetch --depth 1 origin ${SOURCE_REF} \
  && git checkout FETCH_HEAD
 
-# Install deps. package.json's postinstall runs lexicons:generate and
-# intl:compile, which the webpack build needs. If the clone lost the lockfile
-# (unlikely), fall back to a plain install.
-RUN if [ -f pnpm-lock.yaml ]; then \
-      pnpm install --frozen-lockfile || pnpm install --no-frozen-lockfile; \
-    else \
-      echo "[build] pnpm-lock.yaml missing - regenerating" && \
-      pnpm install --no-frozen-lockfile; \
-    fi
-
-# postinstall generated lexicons + i18n catalogs; verify they exist (the
-# intl:compile-if-needed guard is skipped outside CI, so compile explicitly
-# if the catalog is missing)
-RUN test -d src/lexicons && echo "[build] lexicons OK" \
- && (test -f src/locale/locales/en/messages.ts || pnpm intl:compile) \
- && echo "[build] i18n OK"
-
-# Build the static web app with this PDS baked in as the default service,
-# so sign-in/sign-up default to this server (users can still pick another).
-# On HF Spaces, set a Space variable PDS_HOSTNAME and rebuild so this matches.
-ARG PDS_HOSTNAME=hf.space
-ENV EXPO_PUBLIC_DEFAULT_SERVICE=https://${PDS_HOSTNAME}
-ENV EXPO_PUBLIC_BUNDLE_IDENTIFIER=rochester-pds
-ENV NODE_ENV=production
-RUN pnpm run build-web || (npx expo export:web && node ./scripts/post-web-build.js)
-
-# post-web-build copies assets into bskyweb/static; for static hosting we serve
-# web-build directly, so just make sure it exists
-RUN test -d web-build
+RUN test -f index.html || { echo "prebuilt-web branch has no index.html - run the prebuild-web workflow first"; exit 1; }
 
 # --------------------------------------------------------------- server stage
 FROM ghcr.io/bluesky-social/pds:0.4
@@ -71,7 +38,7 @@ FROM ghcr.io/bluesky-social/pds:0.4
 USER root
 
 # Web app bundle
-COPY --from=webapp /build/web-build /app/web
+COPY --from=webapp /bundle /app/web
 
 # Write the email-allowlist patcher into the image.
 RUN <<'PATCH'