deploy: cache pnpm fetch layer in service Dockerfiles

Reorder the dep-install steps so the `pnpm fetch` layer only invalidates
when the lockfile changes, not on every source edit. Previously the
lockfile COPY was followed immediately by `ADD . ./`, which meant any
file change blew away the fetch and forced ~2-3 min of re-downloading
into the pnpm store. With `cache-from/cache-to: type=gha,mode=max`
already wired through docker-ecr, this should cut several minutes off
each Docker build on the common no-dep-change path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: backspace

packages/postgres/Dockerfile

@@ -6,8 +6,17 @@ ARG PNPM_VERSION
 RUN apt-get update && apt-get install -y postgresql
 RUN npm install -g pnpm@${PNPM_VERSION}
 WORKDIR /boxel
+
+# Cache-friendly dependency fetch: this layer only re-runs when the lockfile
+# (or patches it references) changes, not on every source edit. `pnpm fetch`
+# populates the global pnpm store in $HOME from the lockfile alone, so the
+# subsequent `pnpm install --offline` doesn't need the registry.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY patches/ ./patches
+RUN CI=1 pnpm fetch
+
 COPY . .
-RUN pnpm install --frozen-lockfile
+RUN CI=1 pnpm install -r --offline
 
 WORKDIR /boxel/packages/postgres
 

packages/realm-server/prerender-manager.Dockerfile

@@ -9,14 +9,15 @@ WORKDIR /realm-server
 RUN apt-get update && apt-get install -y ca-certificates curl unzip jq
 RUN npm install -g pnpm@11.0.9
 
-COPY pnpm-lock.yaml ./
-
+# Cache-friendly dependency fetch: this layer only re-runs when the lockfile
+# (or patches it references) changes, not on every source edit. `pnpm fetch`
+# populates the global pnpm store in $HOME from the lockfile alone, so the
+# subsequent `pnpm install --offline` doesn't need the registry.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY patches/ ./patches
-COPY vendor/ ./vendor
-
-ADD . ./
-
 RUN CI=1 pnpm fetch
+
+COPY . ./
 RUN CI=1 pnpm install -r --offline
 
 EXPOSE 4222

packages/realm-server/prerender.Dockerfile

@@ -60,14 +60,15 @@ ENV PUPPETEER_CHROME_ARGS="--disable-dev-shm-usage"
 
 RUN mkdir -p /home/pptruser/Downloads "${PUPPETEER_CACHE_DIR}"
 
-COPY pnpm-lock.yaml ./
-
+# Cache-friendly dependency fetch: this layer only re-runs when the lockfile
+# (or patches it references) changes, not on every source edit. `pnpm fetch`
+# populates the global pnpm store in $HOME from the lockfile alone, so the
+# subsequent `pnpm install --offline` doesn't need the registry.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY patches/ ./patches
-COPY vendor/ ./vendor
-
-ADD . ./
-
 RUN CI=1 pnpm fetch
+
+COPY . ./
 RUN CI=1 pnpm install -r --offline
 RUN chown -R pptruser:pptruser /home/pptruser /realm-server
 

packages/realm-server/realm-server.Dockerfile

@@ -9,14 +9,15 @@ WORKDIR /realm-server
 RUN apt-get update && apt-get install -y ca-certificates curl unzip postgresql jq rsync git
 RUN npm install -g pnpm@11.0.9
 
-COPY pnpm-lock.yaml ./
-
+# Cache-friendly dependency fetch: this layer only re-runs when the lockfile
+# (or patches it references) changes, not on every source edit. `pnpm fetch`
+# populates the global pnpm store in $HOME from the lockfile alone, so the
+# subsequent `pnpm install --offline` doesn't need the registry.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY patches/ ./patches
-COPY vendor/ ./vendor
-
-ADD . ./
-
 RUN CI=1 pnpm fetch
+
+COPY . ./
 RUN CI=1 pnpm install -r --offline
 
 EXPOSE 3000

packages/realm-server/worker.Dockerfile

@@ -9,14 +9,15 @@ WORKDIR /realm-server
 RUN apt-get update && apt-get install -y ca-certificates curl unzip postgresql jq
 RUN npm install -g pnpm@11.0.9
 
-COPY pnpm-lock.yaml ./
-
+# Cache-friendly dependency fetch: this layer only re-runs when the lockfile
+# (or patches it references) changes, not on every source edit. `pnpm fetch`
+# populates the global pnpm store in $HOME from the lockfile alone, so the
+# subsequent `pnpm install --offline` doesn't need the registry.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY patches/ ./patches
-COPY vendor/ ./vendor
-
-ADD . ./
-
 RUN CI=1 pnpm fetch
+
+COPY . ./
 RUN CI=1 pnpm install -r --offline
 
 EXPOSE 3000