deploy: npm ci --ignore-scripts (kills postinstall vector + esbuild ETXTBSY race); persistent npm cache; deployment log

deploy/build.sh

@@ -19,7 +19,7 @@ BUILD_IMAGE="${BUILD_IMAGE:-localhost/ctao-portal-build:1}"
 BUILD_NETNS="${BUILD_NETNS:-container:ctao-demo-gitea}"
 REPO_INTERNAL="${REPO_INTERNAL:-http://localhost:3000/$REPO.git}"
 KEEP="${KEEP:-3}"                                 # released builds to retain
-mkdir -p "$BASE/repo" "$BASE/releases" "$BASE/state"
+mkdir -p "$BASE/repo" "$BASE/releases" "$BASE/state" "$BASE/npm-cache"
 
 # --- 1. Cheap poll: branch head via the local Gitea API (host curl + jq) ---
 sha=$(curl -fsS --max-time 5 "$GITEA_URL/api/v1/repos/$REPO/branches/$BRANCH" \
@@ -46,6 +46,7 @@ podman run --rm --network="$BUILD_NETNS" --memory=1g \
   -e SHA="$sha" -e REPO_URL="$REPO_INTERNAL" -e BRANCH="$BRANCH" \
   -v "$BASE/repo:/work/repo:z" \
   -v "$BASE/releases:/work/releases:z" \
+  -v "$BASE/npm-cache:/root/.npm:z" \
   -w /work "$BUILD_IMAGE" sh -ec '
     git config --global safe.directory "*"
     [ -d repo/.git ] || git clone --branch "$BRANCH" "$REPO_URL" repo
@@ -55,7 +56,11 @@ podman run --rm --network="$BUILD_NETNS" --memory=1g \
     cd repo
     lock=$(sha256sum package-lock.json | cut -d" " -f1)
     if [ ! -d node_modules ] || [ "$lock" != "$(cat .deps-hash 2>/dev/null)" ]; then
-      npm ci --no-audit --no-fund
+      # --ignore-scripts: (1) kills the malicious-postinstall vector from npm
+      # deps entirely, (2) avoids the esbuild ETXTBSY postinstall race in
+      # rootless containers. esbuild ships its binary as an optional dep, so
+      # nothing needed here actually requires lifecycle scripts.
+      npm ci --ignore-scripts --no-audit --no-fund
       echo "$lock" > .deps-hash
     fi
     npm run build