feat : 6 astra improve it

Dockerfile

@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1.7
 
-ARG BUN_VERSION=1.3.14
+ARG BUN_IMAGE=oven/bun:1.3.14-alpine@sha256:5acc90a93e91ff07bf72aa90a7c9f0fa189765aec90b47bdbf2152d2196383c0
 
-FROM oven/bun:${BUN_VERSION} AS dependencies
+FROM ${BUN_IMAGE} AS dependencies
 WORKDIR /app
 COPY package.json bun.lock ./
 RUN bun install --frozen-lockfile
@@ -17,9 +17,10 @@ RUN bun build scripts/outbox-worker.ts \
     bun build backend/discord.ts \
     --target=bun \
     --minify \
-    --outfile=dist/discord.js
+    --outfile=dist/discord.js && \
+    bun build scripts/migrate.ts --target=bun --minify --outfile=dist/migrate.js
 
-FROM node:22-bookworm-slim AS next-builder
+FROM node:22-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9 AS next-builder
 WORKDIR /app
 ARG NEXT_DEPLOYMENT_ID=container-build
 ARG BASE_URL
@@ -34,20 +35,20 @@ COPY . .
 # still runs on Bun; Node is used only for the deterministic compiler process.
 RUN node node_modules/next/dist/bin/next build
 
-FROM dependencies AS migration
+FROM ${BUN_IMAGE} AS migration
+RUN apk upgrade --no-cache
 WORKDIR /app
 ARG VCS_REF=unknown
 LABEL org.opencontainers.image.title="Buzz Sheet migrations" \
       org.opencontainers.image.revision=${VCS_REF}
 ENV NODE_ENV=production
-COPY --chown=bun:bun db ./db
+COPY --from=worker-builder --chown=bun:bun /app/dist/migrate.js ./migrate.js
 COPY --chown=bun:bun drizzle ./drizzle
-COPY --chown=bun:bun scripts/migrate.ts ./scripts/migrate.ts
-COPY --chown=bun:bun tsconfig.json ./tsconfig.json
 USER 1000:1000
-ENTRYPOINT ["bun", "scripts/migrate.ts"]
+ENTRYPOINT ["bun", "migrate.js"]
 
-FROM oven/bun:${BUN_VERSION} AS app
+FROM ${BUN_IMAGE} AS app
+RUN apk upgrade --no-cache
 WORKDIR /app
 ARG VCS_REF=unknown
 LABEL org.opencontainers.image.title="Buzz Sheet" \