Backport of InvoiceShelf/InvoiceShelf#703 to 2.x.
FixesInvoiceShelf/docker#64.
Two bugs compounded so that no supported value had any effect. config/app.php
had no timezone key, so Laravel's own fallback won — and that fallback is a
literal 'UTC' string, not an env() lookup, leaving APP_TIMEZONE inert despite
shipping in .env.example. inject.sh then wrote a bare TIMEZONE key that nothing
reads, so the documented container variable did nothing either.
inject.sh now writes APP_TIMEZONE and accepts either spelling, so existing
compose files keep working unchanged.
Backport of InvoiceShelf/InvoiceShelf#702 to 2.x. The chown half of it is
a 2.x-only fix — 3.x had already dropped that line.
storage/framework/{cache,sessions,views}, storage/logs and storage/app
hold no tracked content, only .gitignore stubs, so nothing guarantees they
exist inside a mounted volume. Docker seeds a named volume from the image
once, when it is empty, and never again — a volume created by an older
image keeps whatever it had through every upgrade. Without those
directories Laravel cannot boot and the sqlite branch cannot place its
database.
The unguarded `chown -R www-data:www-data storage` was worse than
ineffective. The image runs as www-data (uid 82), so chown of any file it
does not own returns EPERM, and under `set -e` that aborts the entrypoint.
A single uploaded file owned by the host user is enough to stop the
container from starting — on exactly the mounted-volume setups the chown
was meant to help. Verified against a built image: entrypoint exits 1
before this change, 0 after.
A mount the container genuinely cannot write to is not something the
entrypoint can repair, so it now says what is wrong and names the remedy
instead of failing later with `cp: can't create ...`.
Multi-arch builds run composer (incl. the merge-plugin's update) twice and exhausted GitHub's unauthenticated API rate limit, failing with 'Could not authenticate against github.com'. Pass the Actions token as a build secret and feed it to composer via COMPOSER_AUTH (build-time only, never in the image).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove scheduled nightly/alpha builds; gate :latest on LATEST_MAJOR; keep a transitional :nightly alias on stable releases. Fix the production Dockerfile so a stale host public/build cannot clobber the freshly built frontend.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* build: migrate frontend tooling from yarn to pnpm
The Dockerfiles ran `yarn && yarn build`, which broke on node:24 (yarn no
longer on PATH; the corepack yarn shim made `npm i -g yarn` fail EEXIST),
while CI + Makefile used npm and only a yarn.lock was committed — an
inconsistent yarn/npm split. Standardize on pnpm, pinned via the
packageManager field + corepack.
- package.json: packageManager pnpm@11.6.0.
- pnpm-workspace.yaml: nodeLinker: hoisted (flat node_modules, npm/yarn-like, so
directly-imported transitive deps like flatpickr resolve) + allow vue-demi's
postinstall (it selects the Vue 3 entry). pnpm 11 reads these here, not .npmrc.
- Generate pnpm-lock.yaml (imported from yarn.lock); delete yarn.lock.
- Dockerfiles (dev/nginx/production): node:24 + `corepack enable && pnpm install --frozen-lockfile && pnpm build`.
- CI (check.yaml, docker.yaml): pnpm/action-setup + setup-node cache:pnpm; pnpm install --frozen-lockfile / pnpm build.
- Makefile, composer.json dev script, CLAUDE.md: npm/yarn -> pnpm.
pnpm build verified on a clean install (1425 modules, hoisted node_modules).
* fix(build): pin vite to 8.0.3 to fix rolldown chunk regression
vite 8.0.16 (pulled in by #653) bundles rolldown 1.0.3, which emits a
lazy chunk referencing an undefined Vue runtime-init function
(init_runtime_dom_esm_bundler), breaking the SPA at runtime. The build
succeeds so CI never caught it. Pin vite to 8.0.3 (the version 2.3.3
shipped, rolldown 1.0.0) which produces a correct bundle.
Update Node.js from 20 to 24 across CI workflows, Dockerfiles,
package.json engines field, and add .node-version file for consistent
local development.
Darko Gjorgjijoski