fix(docker): ship packages/shared's nested node_modules to runtime

[LucasSantana-Dev]

Symptom

lucky-staging-backend is crash-looping on the host:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'axios'
  imported from /app/packages/shared/dist/services/LyricsService.js

Production is unaffected only because it predates the cause. It runs 597f2cf (v2.36.1, 2026-07-16); the next production deploy from main would break identically.

Root cause

npm nests a dependency under packages/shared/node_modules instead of hoisting it when another workspace pins a conflicting range. packages/frontend also depends on axios, so the lockfile now resolves:

packages/frontend/node_modules/axios  1.18.1
packages/shared/node_modules/axios    1.18.1

with no node_modules/axios at the root. That changed in 10b4a8cb (#1869, npm audit remediation), which rewrote package-lock.json.

deps-production already copies that directory (Dockerfile L122) and prunes devDeps from it, but production-bot and production-backend never forwarded it. They copy root node_modules, packages/<app>/node_modules and packages/shared/dist, so shared/dist imported packages the image did not contain.

Evidence

image	node_modules/axios	packages/shared/node_modules	state
lucky-backend:597f2cf (prod)	present, 1.16.1	absent	healthy 4d
lucky-backend:staging-8011a29	absent	absent	crash loop

Fix

Forward packages/shared/node_modules into both runtime stages, mirroring the existing packages/<app>/node_modules copies.

Copies the whole directory rather than naming axios, because zod is nested there too and is also a runtime dependency of shared, so it was the next crash waiting. Nested entries under packages/shared:

prod deps:  axios, zod          <- both needed at runtime
devDeps:    @swc/cli, typescript, glob, lru-cache,
            path-scurry, balanced-match, brace-expansion

The devDeps are already stripped by the npm prune --omit=dev in deps-production, so this adds no image bloat.

Why not force hoisting instead

Adding axios to the root manifest or running npm dedupe would treat the symptom and stay fragile: any future range conflict in any workspace re-nests a dependency and breaks runtime again, silently, at container start. Copying the directory is deterministic and symmetric with what the bot and backend packages already get.

Verification

Pending CI: once the image builds, confirm /app/node_modules/axios or /app/packages/shared/node_modules/axios resolves in production-backend, then that staging comes up healthy rather than restarting.

---

Summary by cubic

Ship packages/shared/node_modules into both bot and backend runtime images to fix staging crashes from missing nested deps (axios, zod) imported by packages/shared/dist.

• Bug Fixes
  • Copy packages/shared/node_modules from deps-production into production-bot and production-backend stages.
  • Handles npm’s nested deps when workspace ranges conflict, preventing ERR_MODULE_NOT_FOUND.
  • Directory is already dev-pruned; no image bloat.

^{Written for commit b5712ab. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@LucasSantana-Dev, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 70d6dadd-6b23-43ae-b0b0-2c336e0a9f75

📥 Commits

Reviewing files that changed from the base of the PR and between 199d91d and b5712ab.

📒 Files selected for processing (1)

• Dockerfile

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ship-shared-nested-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR

[cubic-dev-ai]

No issues found across 1 file

<sub>Auto-approved: Fixes crash-loop by copying nested shared/node_modules into runtime images, mirroring existing app node_modules copies. Bounded, deterministic fix for a missing directory causing ERR_MODULE_NOT_FOUND.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud