Feature/reproducible builds console by developerzohaib786 · Pull Request #151 · apache/polaris-tools

developerzohaib786 · 2026-01-30T12:30:18Z

fixes #95

Add devbox.json with pinned Node.js 22.12.0 for reproducible environment
Update vite.config.ts with deterministic build options
Update Makefile with reproducible build and verification targets
Update Dockerfile to use npm ci for deterministic installs
Pin exact dependency versions in package.json (remove ^ prefix)
Update README.md with reproducible build documentation

I have tested and everything is working fine and here is the proof

Verifying devbox.json

the nodejs 22.12.0 is available in json content

Verifying package.json has pinned versions

As there is no ^ prefix in any dependency version so there is no output

Verifying that the npm ci has clean install

Clean build # 1

Build # 1 Sha256 hash

Clean build # 2

Build # 2 Sha256 hash

developerzohaib786 · 2026-01-30T12:40:54Z

@jbonofre @binarycat0 @dimas-b I have also update the readme to match the actual project structure (uses react-router-dom not TanStack Router):

dimas-b

+1 to reproducible builds. Thanks, @developerzohaib786 !

Changes LGTM, but I'm not a UI expert 😅

@binarycat0 @jbonofre WDYT?

binarycat0

Thank you for the contribution and for your interest in the apache/polaris-tools project.

In its current form, this PR is difficult to review and merge. It contains a large number of changes that are not directly related to the stated goal, which makes the diff unnecessarily complex and increases the risk of unintended side effects. In this project, PRs expected to be focused on a single, well-defined problem.

I recommend reducing this PR to only the changes strictly required for the intended feature or fix, and moving unrelated refactoring or experimental work to separate PRs or discussions.

Additionally, I noticed that parts of this contribution may have been generated with the help of AI tools. While the use of AI-assisted development is not prohibited, such code often requires extra validation, refinement, and alignment with the project’s conventions and architecture before it can be considered for merging.

Please also make sure to follow the contribution guidelines before submitting code:
https://polaris.apache.org/community/contributing-guidelines/#before-you-begin-contributing-code

developerzohaib786 · 2026-01-30T15:39:12Z

Thank you for the contribution and for your interest in the apache/polaris-tools project.

In its current form, this PR is difficult to review and merge. It contains a large number of changes that are not directly related to the stated goal, which makes the diff unnecessarily complex and increases the risk of unintended side effects. In this project, PRs expected to be focused on a single, well-defined problem.

I recommend reducing this PR to only the changes strictly required for the intended feature or fix, and moving unrelated refactoring or experimental work to separate PRs or discussions.

Additionally, I noticed that parts of this contribution may have been generated with the help of AI tools. While the use of AI-assisted development is not prohibited, such code often requires extra validation, refinement, and alignment with the project’s conventions and architecture before it can be considered for merging.

Please also make sure to follow the contribution guidelines before submitting code: https://polaris.apache.org/community/contributing-guidelines/#before-you-begin-contributing-code

YES i can make it possible by only focusing on only one thing (reproduceable builds) i think for this purpose pakage-lock.json and docker file would not be changed. we will open an another issue to discuss and work on other features later
and i think there will be only one change in docker file which is changing of npm install command to npm ci command. and i can make this pr more short and more focused that will be easy to merge

apparently, I approved too early

developerzohaib786 · 2026-01-31T03:46:10Z

Self Testing

Minimal Changes

there are only two changes in docker file adding npm ci to install dependencies and package-lock.json fille to copy

npm ci command testing successful

First build

Second build

as i properly know that the procedure of building : source code -> dist folder -> sha256 hasesh. and hashes of both builds are matching i tested by my own self. here is the screenshots

build 1 sha256 hashes

build 2 sha256 hashes

both hashes are matching

developerzohaib786 · 2026-01-31T03:54:49Z

@binarycat0 i will open new issue to discuss other build and install problem

jbonofre · 2026-02-01T08:02:23Z

@developerzohaib786 can you please rebase and clean the PR ? It looks like a large part of the PR is generated by AI. While it's OK, it would be better if you can focus on your own change addressing the issue (reproducible build).

jbonofre · 2026-02-01T08:02:40Z

@developerzohaib786 also, please rebase and resolve conflict.

developerzohaib786 · 2026-02-01T08:17:48Z

@jbonofre yes some part is ai generated but with due respect not full pull request as you know AI can't take the context of such a large codebase.

if you would prefer, i can remove the devbox.json and readme changes and submit them as a separate pull request. please let me know which approach you prefer ??

Thank U

jbonofre · 2026-02-01T08:19:27Z

@developerzohaib786 if you can focus on the actual required changes, it will simplify the review. Also please rebase and fix conflict. Thanks.

developerzohaib786 · 2026-02-01T10:45:05Z

Self testing results

installing dependencies via npm ci and first build via npm build

second build

developerzohaib786 · 2026-02-01T10:48:00Z

How to test this pull request ?

Step 1:

install dependencies via npm ci
Install

npm ci

Step 2:

do first build via npm build

npm run build

Step 3:

clean and rebuild

Remove-Item -Recurse -Force dist
npm run build

…ache#151. changes: - add devbox.json to pin node.js version for consistent environment fixes apache#163

developerzohaib786 · 2026-02-04T11:52:36Z

@binarycat0 @dimas-b @jbonofre please review updates on this pull request. so i can take another issue and work on it. also if changes needed in this pull request i will do. kindly review.
thank u

binarycat0

Thanks for your contribution. I left a couple comments, please review.

Also, I checked the initial Issue and I'm not sure if it's really an issue or not. Could you validate with @snazy if this is necessary?

Thanks again.

binarycat0 · 2026-02-04T14:25:47Z

console/vite.config.ts

+      },
+    },
+  },
+  server: {


This part was removed in purpose by commit 6400f26#diff-89e288dad28206c4dba769912bafe2033718daf741530aebeac099ed16d740eaL35

binarycat0 · 2026-02-04T14:26:38Z

console/docker/Dockerfile


 # Install dependencies
-RUN npm install
+RUN npm ci


Is it necessary to use install-clean instead of install?

developerzohaib786 · 2026-02-08T10:44:52Z

@binarycat0 any updates on this pull request?

jbonofre · 2026-02-08T12:32:41Z

I will take a look tomorrow.

binarycat0 · 2026-02-08T16:04:54Z

@developerzohaib786 Hello. I see that CI job is broken because of the changes RUN npm ci. Please check the CI job logs.

@snazy Hello, could you validate the build changes if it meets the requirements?

jbonofre · 2026-02-08T16:06:53Z

console/docker/Dockerfile


 # Install dependencies
-RUN npm install
+RUN npm ci


I think install is required before ci.

jbonofre · 2026-02-08T16:07:16Z

console/Makefile

 .PHONY: install
 install:
-	npm install
+	npm ci


I think install is required before ci.

jbonofre · 2026-02-08T16:07:44Z

console/vite.config.ts

+        assetFileNames: "assets/[name]-[hash][extname]",
+        manualChunks: (id) => {
+          if (id.includes("node_modules")) {
+            return "vendor"


Do we really need that ?

jbonofre · 2026-02-08T16:08:03Z

@binarycat0 I will take a look as well (see my previous comment). I'm not sure the PR is good yet (a few comments to verify).

…ting and sourcemaps for determinism

developerzohaib786 · 2026-02-09T14:03:49Z

@developerzohaib786 Hello. I see that CI job is broken because of the changes RUN npm ci. Please check the CI job logs.

@snazy Hello, could you validate the build changes if it meets the requirements?

CI was failing because npm ci requires package_lock.json to be present. I havve updated the Dockerfile to copy both package.json and packagelock.json.

As i am beginner and I have not much experience of CI/CD pipelines, read some documentation and get some explanation from AI and issue is fixed now and i am getting familiar with real world things and practices.

developerzohaib786 · 2026-02-09T14:36:52Z

@binarycat0 @jbonofre i have tested locally the current code and reproduceable builds are working. please test the current code as soon as possible and if any changes still required I will be available to solve
thank you for your guidance to get the chance to solve real world problems 🙌

developerzohaib786 · 2026-02-12T10:45:56Z

@jbonofre @binarycat0 please take this up

dimas-b requested a review from jbonofre January 30, 2026 12:52

dimas-b previously approved these changes Jan 30, 2026

View reviewed changes

binarycat0 suggested changes Jan 30, 2026

View reviewed changes

developerzohaib786 force-pushed the feature/reproducible-builds-console branch from 827b3a2 to aba2308 Compare January 31, 2026 03:28

developerzohaib786 requested review from binarycat0 and dimas-b January 31, 2026 04:02

developerzohaib786 force-pushed the feature/reproducible-builds-console branch from 581d483 to 54686f6 Compare February 1, 2026 10:42

developerzohaib786 mentioned this pull request Feb 1, 2026

discussion: add devbox.json for pinning the nodejs version for consistent nodejs environment #163

Open

binarycat0 suggested changes Feb 4, 2026

View reviewed changes

developerzohaib786 force-pushed the feature/reproducible-builds-console branch from 49bf4dc to 10b481a Compare February 4, 2026 16:19

jbonofre reviewed Feb 8, 2026

View reviewed changes

copying package-lock.json in docker file and disabling css code split…

6e80749

…ting and sourcemaps for determinism

developerzohaib786 force-pushed the feature/reproducible-builds-console branch from 10b481a to 6e80749 Compare February 9, 2026 13:58

Conversation

developerzohaib786 commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I have tested and everything is working fine and here is the proof

Verifying devbox.json

Verifying package.json has pinned versions

Verifying that the npm ci has clean install

Clean build # 1

Build # 1 Sha256 hash

Clean build # 2

Build # 2 Sha256 hash

Uh oh!

developerzohaib786 commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dimas-b left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

binarycat0 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

developerzohaib786 commented Jan 30, 2026

Uh oh!

developerzohaib786 commented Jan 31, 2026

Self Testing

Minimal Changes

npm ci command testing successful

First build

Second build

build 1 sha256 hashes

build 2 sha256 hashes

Uh oh!

developerzohaib786 commented Jan 31, 2026

Uh oh!

jbonofre commented Feb 1, 2026

Uh oh!

jbonofre commented Feb 1, 2026

Uh oh!

developerzohaib786 commented Feb 1, 2026

Uh oh!

jbonofre commented Feb 1, 2026

Uh oh!

developerzohaib786 commented Feb 1, 2026

Self testing results

installing dependencies via npm ci and first build via npm build

second build

Uh oh!

developerzohaib786 commented Feb 1, 2026

How to test this pull request ?

Step 1:

Step 2:

Step 3:

Uh oh!

developerzohaib786 commented Feb 4, 2026

Uh oh!

binarycat0 left a comment

Choose a reason for hiding this comment

Uh oh!

binarycat0 Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

binarycat0 Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

developerzohaib786 commented Feb 8, 2026

Uh oh!

jbonofre commented Feb 8, 2026

Uh oh!

binarycat0 commented Feb 8, 2026

Uh oh!

jbonofre Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

jbonofre Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

jbonofre Feb 8, 2026

Choose a reason for hiding this comment

developerzohaib786 commented Jan 30, 2026 •

edited

Loading

developerzohaib786 commented Jan 30, 2026 •

edited

Loading

dimas-b left a comment •

edited

Loading

binarycat0 left a comment •

edited

Loading