set up CI

.github/actions/image-build-push/action.yaml

@@ -16,7 +16,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v4
     - uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446
       with:
         registry: ghcr.io

.github/workflows/ship.yml

@@ -16,8 +16,70 @@ on:
 jobs:
   image-build-push:
     runs-on: ubuntu-latest
+    environment: production
     steps:
       - uses: actions/checkout@v4
+
+      - name: Generate .env.production file
+        run: |
+          cat << EOF > .env.production
+          # Environment
+          NEXT_PUBLIC_ENVIRONMENT=${{ vars.NEXT_PUBLIC_ENVIRONMENT }}
+
+          # Sentry
+          NEXT_PUBLIC_SENTRY_DSN=${{ secrets.NEXT_PUBLIC_SENTRY_DSN }}
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+
+          # GTM
+          NEXT_PUBLIC_GTM_ID=${{ secrets.NEXT_PUBLIC_GTM_ID }}
+
+          # Braze
+          BRAZE_INSTANCE_URL=${{ secrets.BRAZE_INSTANCE_URL }}
+          BRAZE_API_KEY=${{ secrets.BRAZE_API_KEY }}
+          BRAZE_GENERAL_WAITLIST_GROUP_ID=${{ secrets.BRAZE_GENERAL_WAITLIST_GROUP_ID }}
+          BRAZE_DEVELOPERS_WAITLIST_GROUP_ID=${{ secrets.BRAZE_DEVELOPERS_WAITLIST_GROUP_ID }}
+
+          # OneTrust
+          NEXT_PUBLIC_ONE_TRUST_ID=${{ secrets.NEXT_PUBLIC_ONE_TRUST_ID }}
+
+          # Dune
+          NEXT_PUBLIC_DUNE_API_KEY=${{ secrets.NEXT_PUBLIC_DUNE_API_KEY }}
+
+          # WalletConnect
+          NEXT_PUBLIC_WC_PROJECT_ID=${{ secrets.NEXT_PUBLIC_WC_PROJECT_ID }}
+
+          # hCaptcha
+          HCAPTCHA_SECRET=${{ secrets.HCAPTCHA_SECRET }}
+          NEXT_PUBLIC_HCAPTCHA_SITEKEY=${{ secrets.NEXT_PUBLIC_HCAPTCHA_SITEKEY }}
+
+          # Segment
+          NEXT_PUBLIC_SEGMENT_WRITE_KEY=${{ secrets.NEXT_PUBLIC_SEGMENT_WRITE_KEY }}
+
+          # Kraken Connect
+          NEXT_PUBLIC_KRAKEN_CLIENT_ID=${{ secrets.NEXT_PUBLIC_KRAKEN_CLIENT_ID }}
+          KRAKEN_CLIENT_SECRET=${{ secrets.KRAKEN_CLIENT_SECRET }}
+
+          # App Submission Bot
+          INK_APP_SUBMISSION_BOT_GITHUB_APP_ID=${{ secrets.INK_APP_SUBMISSION_BOT_GITHUB_APP_ID }}
+          INK_APP_SUBMISSION_BOT_GITHUB_PRIVATE_KEY=${{ secrets.INK_APP_SUBMISSION_BOT_GITHUB_PRIVATE_KEY }}
+          INK_APP_SUBMISSION_BOT_GITHUB_INSTALLATION_ID=${{ secrets.INK_APP_SUBMISSION_BOT_GITHUB_INSTALLATION_ID }}
+          INK_APP_SUBMISSION_TARGET_ORG=${{ secrets.INK_APP_SUBMISSION_TARGET_ORG }}
+          INK_APP_SUBMISSION_TARGET_REPO=${{ secrets.INK_APP_SUBMISSION_TARGET_REPO }}
+          INK_APP_SUBMISSION_TARGET_BRANCH=${{ secrets.INK_APP_SUBMISSION_TARGET_BRANCH }}
+          INK_APP_SUBMISSION_SLACK_NOTIFICATION_CHANNEL=${{ secrets.INK_APP_SUBMISSION_SLACK_NOTIFICATION_CHANNEL }}
+          INK_APP_SUBMISSION_SLACK_BOT_TOKEN=${{ secrets.INK_APP_SUBMISSION_SLACK_BOT_TOKEN }}
+
+          # Smart Account Experiment
+          NEXT_PUBLIC_BUNDLER_URL=${{ secrets.NEXT_PUBLIC_BUNDLER_URL }}
+          NEXT_PUBLIC_PASSKEY_SERVER_URL=${{ secrets.NEXT_PUBLIC_PASSKEY_SERVER_URL }}
+          NEXT_PUBLIC_PAYMASTER_URL=${{ secrets.NEXT_PUBLIC_PAYMASTER_URL }}
+          NEXT_PUBLIC_GELATO_BRIDGE_URL=${{ secrets.NEXT_PUBLIC_GELATO_BRIDGE_URL }}
+          NEXT_PUBLIC_FAUCET_API_URL=${{ secrets.NEXT_PUBLIC_FAUCET_API_URL }}
+
+          # Testnet Faucet Experiment
+          MULTIPLIER_JWT_SECRET=${{ secrets.MULTIPLIER_JWT_SECRET }}
+          EOF
+
       - uses: ./.github/actions/image-build-push
         with:
           repository-name: ink-web-app

Dockerfile

@@ -20,9 +20,14 @@ WORKDIR /app
 
 RUN npm i -g pnpm
 
-COPY --from=base /app/node_modules ./node_modules
-COPY --from=base /app/package.json ./package.json
-COPY --from=base /app/.next ./.next
-COPY --from=base /app/.env.production ./.env.production
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+COPY --from=base --chown=nextjs:nodejs /app/node_modules ./node_modules
+COPY --from=base --chown=nextjs:nodejs /app/package.json ./package.json
+COPY --from=base --chown=nextjs:nodejs /app/.next ./.next
+COPY --from=base --chown=nextjs:nodejs /app/public ./public
+
+USER nextjs
 
 CMD ["pnpm", "start"]

README.md

@@ -63,3 +63,5 @@ Check out our [Next.js deployment documentation](https://nextjs.org/docs/deploym
 # Setup
 
 - Define the env variable `INK_DIRECTORY` in your .bashrc or .zshrc file to the directory where Ink specific .gitconfig is stored
+
+# Deployment

package.json

@@ -40,9 +40,9 @@
     "@zerodev/sdk": "5.4.0-beta.0",
     "class-variance-authority": "0.7.1",
     "cookies-next": "4.2.1",
-    "dompurify": "3.2.3",
     "ethers": "6.13.1",
     "framer-motion": "12.0.0-alpha.1",
+    "isomorphic-dompurify": "2.21.0",
     "jose": "5.9.6",
     "leva": "0.9.35",
     "lottie-react": "2.4.0",