UID2-7874: separate React build and runtime dependencies

[swibi-ttd]

Summary

• Keep application runtime libraries (react, react-dom, and express) in dependencies.
• Move build and local-development tooling, including react-scripts and dotenv, to devDependencies in both React examples.
• Use multi-stage Docker builds so runtime images install only production dependencies and run as the non-root node user.
• Keep .trivyignore unchanged; removing the existing CVE suppressions is intentionally deferred to a follow-up.

Dependency classification

Packages imported by deployed application source remain production dependencies. Development dependencies are limited to tooling used to build, test, or develop the application and are not required by the deployed server or browser application. dotenv is only used to load the repository .env file locally; deployed environments inject variables directly, and the guarded import allows the server to run without it.

Lockfile/toolchain notes

• Regenerated and verified lockfiles with Node 20.11.0 and its bundled npm 10.2.4, matching the Docker build environment.
• The regenerated lockfiles add the missing nested yaml@2.9.1 entry required for clean npm ci with npm 10.2.4. No other package versions, resolved URLs, or integrity hashes changed.

Testing

• Clean npm ci and CI=true npm run build pass for both React examples using Node 20.11.0 / npm 10.2.4.
• Both Docker images build successfully and pass health endpoint, static asset, and runtime environment-injection smoke tests.
• Final images include react and react-dom but exclude dotenv and the build-only react-scripts, bfj, and jsonpath packages.
• Trivy filesystem scans report no jsonpath finding by default; --include-dev-deps still reports it as expected.

Out of scope

The pinned Alpine 3.18 base image and bundled npm CLI may still report unrelated vulnerability findings. Updating those components and removing obsolete .trivyignore entries should be handled separately.

Jira: UID2-7874

[Copilot]

🟢 Approval recommended

Dependency metadata and container stages consistently preserve required runtime packages while excluding development tooling.

Pull request overview

Separates build-time and runtime dependencies for both React examples and produces smaller, non-root runtime containers.

Changes:

• Reclassifies build tooling under devDependencies.
• Introduces multi-stage Docker builds with production-only installs.
• Adds consistent Docker build-context exclusions.

File summaries

File	Description
web-integrations/javascript-sdk/react-client-side/package.json	Separates runtime and build dependencies.
web-integrations/javascript-sdk/react-client-side/package-lock.json	Records updated dependency classifications.
web-integrations/javascript-sdk/react-client-side/Dockerfile	Adds builder/runtime stages and non-root execution.
web-integrations/javascript-sdk/react-client-side/.dockerignore	Excludes local and generated files.
web-integrations/google-secure-signals/react-client-side/package.json	Separates runtime and build dependencies.
web-integrations/google-secure-signals/react-client-side/package-lock.json	Records updated dependency classifications.
web-integrations/google-secure-signals/react-client-side/Dockerfile	Adds builder/runtime stages and non-root execution.
web-integrations/google-secure-signals/react-client-side/.dockerignore	Expands Docker exclusions.

Review details

• Files reviewed: 6/8 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.