Fix critical issues from code review

- Fix Gemfile.lock Ruby version (3.4.3 → 3.4.6) to match .ruby-version
- Update Dockerfile CMD to use Thruster as documented
- Fix Dockerfile lint warnings:
  - Change 'as' to 'AS' for FROM statements (lines 3, 35)
  - Remove SECRET_KEY_BASE from ENV (security warning)
  - Set SECRET_KEY_BASE only during RUN command for asset precompilation
- Add version constraint to thruster gem (~> 0.1)
- Set early_hints debug to false in production (was true)

These changes resolve:
- CI bundler failures (frozen lockfile mismatch)
- Dockerfile build failures (exit code 16)
- Docker security warnings
- Configuration inconsistency (Dockerfile vs Procfile)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: justin808

.controlplane/Dockerfile

@@ -1,6 +1,6 @@
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version and Gemfile
 ARG RUBY_VERSION=3.4.6
-FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim as base
+FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base
 
 # Current commit hash environment variable
 ARG GIT_COMMIT
@@ -32,7 +32,7 @@ ENV RAILS_ENV="production" \
 
 
 # Throw-away build stage to reduce size of final image
-FROM base as build
+FROM base AS build
 
 # Install application gems
 COPY Gemfile Gemfile.lock ./
@@ -60,23 +60,26 @@ COPY --from=build /app /app
 
 RUN chmod +x /app/.controlplane/*.sh
 
+# Set environment variables for asset compilation
 ENV RAILS_ENV=production \
-    NODE_ENV=production \
-    SECRET_KEY_BASE=NOT_USED_NON_BLANK
-# compiling assets requires any value for ENV of SECRET_KEY_BASE
+    NODE_ENV=production
 
 # These files hardly ever change
 RUN bin/rails react_on_rails:locale
 
 # These files change together, /app/lib/bs are temp build files for rescript,
 # and /app/client/app are the client assets that are bundled, so not needed once built
 # Helps to have smaller images b/c of smaller Docker Layer Caches and smaller final images
-RUN yarn res:build && bin/rails assets:precompile && rm -rf /app/lib/bs /app/client/app
+# SECRET_KEY_BASE is required for asset precompilation but is not persisted in the image
+RUN SECRET_KEY_BASE=precompile_placeholder yarn res:build && \
+    SECRET_KEY_BASE=precompile_placeholder bin/rails assets:precompile && \
+    rm -rf /app/lib/bs /app/client/app
 
 # This is like the shell initialization that will take the CMD as args
 # For Kubernetes and ControlPlane, this is the command on the workload.
 ENTRYPOINT ["./.controlplane/entrypoint.sh"]
 
 # Default args to pass to the entry point that can be overridden
 # For Kubernetes and ControlPlane, these are the "workload args"
-CMD ["./bin/rails", "server"]
+# Use Thruster HTTP/2 proxy for optimized performance
+CMD ["bundle", "exec", "thrust", "bin/rails", "server"]

Gemfile

@@ -15,7 +15,7 @@ gem "rails", "~> 8.0"
 gem "pg"
 
 gem "puma"
-gem "thruster"
+gem "thruster", "~> 0.1"
 
 # Use SCSS for stylesheets
 gem "sass-rails"

Gemfile.lock

@@ -140,7 +140,6 @@ GEM
     factory_bot_rails (6.4.3)
       factory_bot (~> 6.4)
       railties (>= 5.0.0)
-    ffi (1.17.2)
     ffi (1.17.2-arm64-darwin)
     ffi (1.17.2-x86_64-linux-gnu)
     foreman (0.88.1)
@@ -181,7 +180,6 @@ GEM
     matrix (0.4.2)
     method_source (1.1.0)
     mini_mime (1.1.5)
-    mini_portile2 (2.8.9)
     minitest (5.26.0)
     mize (0.4.1)
       protocol (~> 2.0)
@@ -195,9 +193,6 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.4)
-    nokogiri (1.18.10)
-      mini_portile2 (~> 2.8.2)
-      racc (~> 1.4)
     nokogiri (1.18.10-arm64-darwin)
       racc (~> 1.4)
     nokogiri (1.18.10-x86_64-linux-gnu)
@@ -417,6 +412,8 @@ GEM
       mize
       tins (~> 1.0)
     thor (1.4.0)
+    thruster (0.1.16-arm64-darwin)
+    thruster (0.1.16-x86_64-linux)
     tilt (2.4.0)
     timeout (0.4.3)
     tins (1.33.0)
@@ -453,7 +450,6 @@ GEM
 PLATFORMS
   arm64-darwin
   arm64-darwin-22
-  ruby
   x86_64-linux
   x86_64-linux-gnu
 
@@ -500,12 +496,13 @@ DEPENDENCIES
   spring
   spring-commands-rspec
   stimulus-rails (~> 1.3)
+  thruster (~> 0.1)
   turbo-rails (~> 2.0)
   uglifier
   web-console
 
 RUBY VERSION
-   ruby 3.4.3p32
+   ruby 3.4.6p54
 
 BUNDLED WITH
    2.4.17

config/shakapacker.yml

@@ -67,4 +67,4 @@ production:
   # Early hints configuration
   early_hints:
     enabled: true
-    debug: true # Outputs debug info as HTML comments
+    debug: false # Set to true to output debug info as HTML comments