update Dockerfile and github workflows

Dockerfile

@@ -1,25 +1,28 @@
 # ---- build ----
-FROM node:22-alpine AS builder
+FROM node:20-alpine AS builder
 WORKDIR /app
 
-COPY package*.json ./
-RUN npm ci --no-audit --no-fund
+COPY package.json package-lock.json tsconfig*.json ./
+RUN npm ci
 
-COPY . .
-RUN npm run build
+COPY src ./src
+COPY assets ./assets
 
-# only prod dependencies
-RUN npm prune --omit=dev
+RUN npx tsc -p tsconfig.build.json
 
 # ---- runtime ----
-FROM node:22-alpine AS runner
+FROM node:20-alpine AS runner
 WORKDIR /app
 
 ENV NODE_ENV=production
 ENV IS_DOCKER=true
 
-COPY --from=builder /app/package*.json ./
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/dist ./dist
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
 
-CMD [ "node", "dist/index.js" ]
+USER node
+
+COPY --from=builder --chown=node:node /app/dist ./dist
+COPY --from=builder --chown=node:node /app/assets ./assets
+
+CMD ["node", "dist/index.js"]