fix(cli): keep the prebuilt toolchain for package-only projects, tighten repairs

Package-only projects have no instructions to run twice, so they keep
the prebuilt toolchain image and repeat only the small package install
instead of fetching the toolchain from the live archive per build. The
repair steps use --no-install-recommends like every other apt call, the
regression test asserts the composed repair-then-install RUN (the index
comparison was vacuously true when the repair was missing), and the
package-list sync test resolves paths from the test file and also pins
the toolchain list.

Author: myftija

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -1,8 +1,9 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { BuildRuntime } from "@trigger.dev/core/v3/schemas";
 import { describe, expect, it } from "vitest";
-import { DEFAULT_PACKAGES, generateContainerfile } from "./buildImage.js";
+import { DEFAULT_PACKAGES, TOOLCHAIN_PACKAGES, generateContainerfile } from "./buildImage.js";
 
 const images: Array<[BuildRuntime, string, string]> = [
   [
@@ -52,15 +53,19 @@ describe("generateContainerfile", () => {
     }
   );
 
-  it("matches the published base image package list", () => {
+  it("matches the published base image package lists", () => {
     const imagesJson = JSON.parse(
-      readFileSync(join(process.cwd(), "../../base-images/images.json"), "utf-8")
+      readFileSync(
+        join(fileURLToPath(import.meta.url), "../../../../../base-images/images.json"),
+        "utf-8"
+      )
     );
 
     expect(imagesJson.packages.split(" ").sort()).toEqual([...DEFAULT_PACKAGES].sort());
+    expect(imagesJson.buildPackages).toBe(TOOLCHAIN_PACKAGES);
   });
 
-  it("applies customization once and builds FROM base when customized", async () => {
+  it("applies instructions once and builds FROM base when they are present", async () => {
     const containerfile = await generateContainerfile({
       runtime: "node-22",
       build: {},
@@ -72,18 +77,37 @@ describe("generateContainerfile", () => {
       entrypoint: "entrypoint.js",
     });
 
-    // sorted, defaults filtered out, downgrades allowed for pinned defaults
-    const installLine = "apt-get install -y --no-install-recommends --allow-downgrades curl jq";
-    expect(containerfile.indexOf(installLine)).toBeGreaterThan(
-      containerfile.indexOf("RUN echo custom > /etc/marker")
-    );
-    expect(containerfile.indexOf(installLine, containerfile.indexOf(installLine) + 1)).toBe(-1);
-    // apt-get install refuses to run on dpkg state broken by an instruction
-    expect(containerfile.indexOf("apt-get --fix-broken install -y")).toBeLessThan(
-      containerfile.indexOf(installLine)
-    );
+    // sorted, defaults filtered out, downgrades allowed for pinned defaults,
+    // and repaired first: apt-get install refuses to run on dpkg state broken
+    // by an instruction
+    const installRun = `apt-get --fix-broken install -y --no-install-recommends && \\
+  apt-get install -y --no-install-recommends --allow-downgrades curl jq`;
+    const first = containerfile.indexOf(installRun);
+
+    expect(first).toBeGreaterThan(containerfile.indexOf("RUN echo custom > /etc/marker"));
+    expect(containerfile.indexOf(installRun, first + 1)).toBe(-1);
     expect(containerfile).toContain("FROM base AS build");
-    expect(containerfile).toContain("python3 make g++");
+    expect(containerfile).toContain(TOOLCHAIN_PACKAGES);
+  });
+
+  it("keeps the prebuilt toolchain image for package-only projects", async () => {
+    const containerfile = await generateContainerfile({
+      runtime: "node-22",
+      build: {},
+      image: { pkgs: ["jq"] },
+      indexScript: "index.js",
+      entrypoint: "entrypoint.js",
+    });
+
+    const installLine = "apt-get install -y --no-install-recommends --allow-downgrades jq";
+    const first = containerfile.indexOf(installLine);
+
+    // installed in both stages, since base and build are separate images
+    expect(first).toBeGreaterThan(-1);
+    expect(containerfile.indexOf(installLine, first + 1)).toBeGreaterThan(first);
+    expect(containerfile).not.toContain("FROM base AS build");
+    // a pristine base has nothing to repair
+    expect(containerfile).not.toContain("--fix-broken");
   });
 
   it("repairs dpkg state after instructions when there are no user packages", async () => {

packages/cli-v3/src/deploy/buildImage.ts

@@ -735,7 +735,7 @@ export async function generateContainerfile(options: GenerateContainerfileOption
 // package (e.g. openssl=<older>) is a downgrade by the time this runs.
 function aptInstall(packages: string[], { repair }: { repair: boolean }): string {
   const repairStep = repair
-    ? `apt-get --fix-broken install -y && \\
+    ? `apt-get --fix-broken install -y --no-install-recommends && \\
   `
     : "";
 
@@ -747,11 +747,14 @@ function aptInstall(packages: string[], { repair }: { repair: boolean }): string
 
 function aptRepair(): string {
   return `RUN apt-get update && \\
-  apt-get --fix-broken install -y && \\
+  apt-get --fix-broken install -y --no-install-recommends && \\
   apt-get clean && \\
   rm -rf /var/lib/apt/lists/*`;
 }
 
+// Must match base-images/images.json buildPackages, which the -build images preinstall
+export const TOOLCHAIN_PACKAGES = "python3 make g++";
+
 const parseGenerateOptions = (options: GenerateContainerfileOptions) => {
   const buildArgs = Object.entries(options.build.env || {})
     .flatMap(([key]) => `ARG ${key}`)
@@ -779,19 +782,21 @@ const parseGenerateOptions = (options: GenerateContainerfileOptions) => {
     .filter(Boolean)
     .join("\n\n");
 
-  // Customized projects build FROM base so instructions and packages apply
-  // exactly once; uncustomized projects use the prebuilt toolchain image and
-  // run no apt at all
-  const buildStage = customization
+  // Projects with instructions build FROM base so instructions run exactly
+  // once (their downloads are unbounded); package-only projects keep the
+  // prebuilt toolchain image and repeat the small package install
+  const buildStage = baseInstructions
     ? `FROM base AS build
 
 RUN apt-get update && \\
-  apt-get install -y --no-install-recommends python3 make g++ && \\
+  apt-get install -y --no-install-recommends ${TOOLCHAIN_PACKAGES} && \\
   apt-get clean && \\
   rm -rf /var/lib/apt/lists/*`
     : `FROM ${BUILD_IMAGE[options.runtime]} AS build
 
-ENV DEBIAN_FRONTEND=noninteractive`;
+ENV DEBIAN_FRONTEND=noninteractive${
+        userPackages.length > 0 ? `\n\n${aptInstall(userPackages, { repair: false })}` : ""
+      }`;
 
   return {
     baseImage: BASE_IMAGE[options.runtime],