From ea8a5b40e7f5bd39e51e8aa5d337204e8e587525 Mon Sep 17 00:00:00 2001
From: maashkinoozhe <waste@teletomtom.de>
Date: Tue, 27 Oct 2026 13:47:26 +0100
Subject: [PATCH] .dockerignore: let moments.js into the image; guard test
 checks the allowlist too

f38f218 failed to build: .dockerignore is an allowlist and kept
moments.js out of the build context. Verified by building the image and
starting the reader from it (health ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .dockerignore           | 1 +
 test/dockerfile.test.js | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.dockerignore b/.dockerignore
index 6775392..09c8786 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -10,6 +10,7 @@
 !backup.js
 !reading-analytics.js
 !reading-access.js
+!moments.js
 !public/
 !public/**
 !greatest/
diff --git a/test/dockerfile.test.js b/test/dockerfile.test.js
index 4327071..dbc41e3 100644
--- a/test/dockerfile.test.js
+++ b/test/dockerfile.test.js
@@ -18,5 +18,10 @@ test('every top-level module the reader requires is copied into the image', () =
       else pending.push(name + '.js');
     }
   }
-  for (const file of seen) assert.ok(copied.has(file), `${file} is required but not copied by the Dockerfile`);
+  // .dockerignore is an allowlist too: a file not let through never reaches COPY.
+  const allowed = new Set(fs.readFileSync(path.join(root, '.dockerignore'), 'utf8').split(/\r?\n/).filter(line => line.startsWith('!')).map(line => line.slice(1)));
+  for (const file of seen) {
+    assert.ok(copied.has(file), `${file} is required but not copied by the Dockerfile`);
+    assert.ok(allowed.has(file), `${file} is required but not allowed through .dockerignore`);
+  }
 });