fix(ensrainbow): decouple Docker build from dev-only skills tooling

[shrugs]

The ENSRainbow image copied skills-npm.config.ts, .agents/, and scripts/ solely so the root prepare lifecycle (dev-only skill symlinking via skills-npm + scripts/link-local-skills.mjs) would not fail during pnpm install. That coupling is exactly what broke the build in #2302 — every change to the skills tooling risks silently breaking the ENSRainbow image.

This skips the irrelevant prepare with --ignore-scripts and drops those three copies. The lockfile pins no built dependencies (pnpm.onlyBuiltDependencies is empty), so nothing else depends on install scripts here.

Validation

• Builds clean and boots: /health returns {"status":"ok"}, the entrypoint binds the HTTP server and starts the database download.
• Image size unchanged: 921MB (vs 922MB on main).
• No changeset, matching the precedent set by Address security audit report and fix docker build #2302 (Dockerfile-only build change).

Scope

Intentionally narrow — this de-fragilizes the existing selective-copy build. It does not switch ENSRainbow to the other apps' COPY . . pattern (that nearly doubles the image to ~1.79GB) nor to a pnpm deploy --prod bundle (blocked by the apps running TypeScript from source and importing workspace packages' source at runtime; tracked separately as a larger "run built JS in production images" initiative).

[changeset-bot]

⚠️ No Changeset found

Latest commit: b97031f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
enskit-react-example.ensnode.io	Ready	Preview, Comment	Jun 19, 2026 5:18pm

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
admin.ensnode.io	Skipped		Jun 19, 2026 5:18pm
ensnode.io	Skipped		Jun 19, 2026 5:18pm
ensrainbow.io	Skipped		Jun 19, 2026 5:18pm

[coderabbitai]

Warning

Review limit reached

@shrugs, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 43 minutes and 57 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a6cf2bac-534c-4fd2-96c3-e81cc9be1bf9

📥 Commits

Reviewing files that changed from the base of the PR and between fb3f45f and b97031f.

📒 Files selected for processing (1)

• apps/ensrainbow/Dockerfile

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ensrainbow-dockerfile-simplify

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

Removes three dev-only file copies (skills-npm.config.ts, .agents/, scripts/) from the ENSRainbow Dockerfile and replaces the plain pnpm install --frozen-lockfile with pnpm install --frozen-lockfile --ignore-scripts to skip the root prepare lifecycle script, which only does dev skill symlinking and is irrelevant to a runtime image.

• The key safety invariant — confirmed by scanning the lockfile for requiresBuild entries, which are absent — is that no installed dependency relies on a postinstall/install script. Even classic-level, which uses node-gyp-build, ships prebuilt binaries inside its package tarball and resolves them at require() time rather than via a postinstall hook, so --ignore-scripts does not affect it.
• The change is narrow in scope: it only modifies the Dockerfile and does not alter any source, configuration, or other app images.

Confidence Score: 5/5

Safe to merge — the change removes unused file copies and adds --ignore-scripts, which is verified safe by the lockfile containing no requiresBuild entries for any dependency.

The only thing that could make --ignore-scripts unsafe here is a dependency with a postinstall or install lifecycle script (e.g. a native addon that downloads prebuilt binaries). A scan of pnpm-lock.yaml shows zero requiresBuild entries across the entire dependency tree, including classic-level, which ships its prebuilt LevelDB binaries inside the package tarball and resolves them at require() time via node-gyp-build rather than via a postinstall hook. The three removed COPY directives were exclusively serving the now-skipped root prepare script, so their removal is correct.

No files require special attention.

Important Files Changed

Filename	Overview
apps/ensrainbow/Dockerfile	Removes three dev-only COPY directives and adds --ignore-scripts to pnpm install; lockfile has no requiresBuild entries, making the flag safe for all dependencies including native-addon packages.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Docker Build Context] --> B["COPY package.json\npnpm-lock.yaml\npnpm-workspace.yaml"]
    A --> C["COPY packages/"]
    A --> D["COPY patches/"]
    A --> E["COPY apps/ensrainbow/package.json"]

    B & C & D & E --> F["pnpm install --frozen-lockfile\n--ignore-scripts"]

    F --> G{Skips root prepare?}
    G -->|"Yes — skills-npm +\nlink-local-skills.mjs"| H["No longer needs\nskills-npm.config.ts\n.agents/\nscripts/"]
    G -->|"Any dep postinstall?"| I["No — lockfile has\nzero requiresBuild entries"]

    F --> J["COPY apps/ensrainbow/src/\nCOPY apps/ensrainbow/scripts/\nCOPY apps/ensrainbow/tsconfig.json"]

    J --> K["chmod +x download-prebuilt-database.sh"]
    K --> L["ENTRYPOINT: pnpm run entrypoint"]

    style H fill:#d4edda,stroke:#28a745
    style I fill:#d4edda,stroke:#28a745

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Docker Build Context] --> B["COPY package.json\npnpm-lock.yaml\npnpm-workspace.yaml"]
    A --> C["COPY packages/"]
    A --> D["COPY patches/"]
    A --> E["COPY apps/ensrainbow/package.json"]

    B & C & D & E --> F["pnpm install --frozen-lockfile\n--ignore-scripts"]

    F --> G{Skips root prepare?}
    G -->|"Yes — skills-npm +\nlink-local-skills.mjs"| H["No longer needs\nskills-npm.config.ts\n.agents/\nscripts/"]
    G -->|"Any dep postinstall?"| I["No — lockfile has\nzero requiresBuild entries"]

    F --> J["COPY apps/ensrainbow/src/\nCOPY apps/ensrainbow/scripts/\nCOPY apps/ensrainbow/tsconfig.json"]

    J --> K["chmod +x download-prebuilt-database.sh"]
    K --> L["ENTRYPOINT: pnpm run entrypoint"]

    style H fill:#d4edda,stroke:#28a745
    style I fill:#d4edda,stroke:#28a745

Loading

_{Reviews (1): Last reviewed commit: "fix(ensrainbow): decouple Docker build f..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR de-fragilizes the ENSRainbow Docker image build by removing its dependency on the monorepo’s dev-only skills tooling, which previously had to be copied into the image solely to satisfy the root prepare lifecycle during pnpm install.

Changes:

• Remove copying skills-npm.config.ts, .agents/, and scripts/ into the ENSRainbow image build context.
• Run pnpm install with --ignore-scripts to avoid triggering the root prepare lifecycle during image builds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.