fix(cli): harden the image dependency-layer split

Create node_modules after post-install commands so a command that
prunes it can't fail the final-stage copy, keep the original install
instruction so existing layer caches still hit, and make the code
stage's node_modules removal work as a non-root user when a directory
is read-only.

Author: myftija

.changeset/split-image-dependency-layers.md

@@ -2,4 +2,4 @@
 "trigger.dev": patch
 ---
 
-Deployed images now ship dependencies and bundled task code as separate layers. Repeat deploys with unchanged dependencies push and pull far less data, making deploys and worker image pulls faster.
+Deployed images now ship dependencies and bundled task code as separate layers. Repeat deploys with unchanged dependencies typically push and pull far less data, making deploys and worker image pulls faster.

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -40,17 +40,40 @@ describe("generateContainerfile", () => {
       const user = runtime === "bun" ? "bun:bun" : "node:node";
 
       expect(containerfile).toContain("FROM build AS code");
-      expect(containerfile).toContain("RUN rm -rf node_modules");
       expect(containerfile).toContain(
         `COPY --from=build --chown=${user} /app/node_modules ./node_modules`
       );
       expect(containerfile).toContain(`COPY --from=code --chown=${user} /app ./`);
       // The final stage must not copy all of /app from the build stage anymore,
       // or node_modules would be duplicated across two layers
       expect(containerfile).not.toContain(`COPY --from=build --chown=${user} /app ./`);
+    }
+  );
+
+  it.each(["node", "bun"] as BuildRuntime[])(
+    "orders post-install commands, the node_modules guard, and the code stage for %s",
+    async (runtime) => {
+      const containerfile = await generateContainerfile({
+        runtime,
+        build: { commands: ["echo post-install"] },
+        image: undefined,
+        indexScript: "index.js",
+        entrypoint: "entrypoint.js",
+      });
+
+      const postInstall = containerfile.indexOf("RUN echo post-install");
+      // The guard must run after post-install commands so a command that prunes
+      // node_modules can't break the final-stage COPY of /app/node_modules
+      const mkdirGuard = containerfile.indexOf("RUN mkdir -p node_modules");
+      const codeStage = containerfile.indexOf("FROM build AS code");
+      const rmNodeModules = containerfile.indexOf(
+        "RUN chmod -R u+w node_modules && rm -rf node_modules"
+      );
 
-      // node_modules must exist even for projects with zero external dependencies
-      expect(containerfile).toContain("mkdir -p node_modules");
+      expect(postInstall).toBeGreaterThan(-1);
+      expect(mkdirGuard).toBeGreaterThan(postInstall);
+      expect(codeStage).toBeGreaterThan(mkdirGuard);
+      expect(rmNodeModules).toBeGreaterThan(codeStage);
     }
   );
 });

packages/cli-v3/src/deploy/buildImage.ts

@@ -772,19 +772,22 @@ ${buildArgs}
 ${buildEnvVars}
 
 COPY --chown=bun:bun package.json ./
-# mkdir guards against bun not creating node_modules when there are no dependencies
-RUN bun install --production --no-save && mkdir -p node_modules
+RUN bun install --production --no-save
 
 # Now copy all the files
 # IMPORTANT: Do this after running npm install because npm i will wipe out the node_modules directory
 COPY --chown=bun:bun . .
 
 ${postInstallCommands}
 
+# node_modules may not exist when there are no dependencies to install
+RUN mkdir -p node_modules
+
 # App files without node_modules, so the final stage can layer them separately
 FROM build AS code
 
-RUN rm -rf node_modules
+# u+w first: rm as a non-root user fails on read-only directories
+RUN chmod -R u+w node_modules && rm -rf node_modules
 
 FROM build AS indexer
 
@@ -887,8 +890,7 @@ ENV NODE_ENV=production
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 
 COPY --chown=node:node package.json ./
-# mkdir guards against npm not creating node_modules when there are no dependencies
-RUN npm i --no-audit --no-fund --no-save --no-package-lock && mkdir -p node_modules
+RUN npm i --no-audit --no-fund --no-save --no-package-lock
 
 # Now copy all the files
 # IMPORTANT: Do this after running npm install because npm i will wipe out the node_modules directory
@@ -899,10 +901,14 @@ ${postInstallCommands}
 # IMPORTANT: Doing this again to fix an issue with prisma generate removing the files in node_modules/trigger.dev for some reason...
 COPY --chown=node:node . .
 
+# node_modules may not exist when there are no dependencies to install
+RUN mkdir -p node_modules
+
 # App files without node_modules, so the final stage can layer them separately
 FROM build AS code
 
-RUN rm -rf node_modules
+# u+w first: rm as a non-root user fails on read-only directories
+RUN chmod -R u+w node_modules && rm -rf node_modules
 
 FROM build AS indexer