loadtest: package as a runnable Docker image + publish workflow

[arnaubennassar]

Summary

Stacked on #41. Packages the bridge load-test CLI (loadtest/) as a standalone, runnable image so it can be executed against a real network (e.g. Bali) as a Job/pod, without a docker-compose devnet or a VPN-connected laptop — needed for P5-04 of the aggkit-autoclaim deployment plan.

• Dockerfile.loadtest: node:24-slim + pnpm 10.30.3 (matching package.json's packageManager/engines.node), full repo source, pnpm install --frozen-lockfile. Headless only — no Chromium/Playwright browser binary is downloaded (pnpm's default build-script allowlist already skips @playwright/test's postinstall; PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 makes that explicit). No ENTRYPOINT, so docker run <image> pnpm loadtest <command> ... works as-is. Does not touch or build against the existing root Dockerfile (UI-only, unrelated).
• .github/workflows/loadtest-image.yaml: workflow_dispatch-only (no push/PR trigger), builds Dockerfile.loadtest and publishes ghcr.io/agglayer/agglayer-dev-ui-loadtest:<sha> (multi-arch amd64/arm64), mirroring docker-publish.yaml's GHCR login/permissions/QEMU+Buildx pattern.

Does not merge #41 and does not touch its branch beyond stacking on top of it.

Verification (local)

docker build -f Dockerfile.loadtest -t agglayer-dev-ui-loadtest:local .
# ... build succeeds, no chromium binary installed ...

docker run --rm -v "$(pwd)/docker-smoke.loadtest.json:/app/docker-smoke.loadtest.json:ro" \
  agglayer-dev-ui-loadtest:local pnpm loadtest validate docker-smoke.loadtest.json

> agglayer-dev-ui@0.1.0 loadtest /app
> tsx loadtest/cli.ts validate docker-smoke.loadtest.json

docker-smoke.loadtest.json is valid.

docker-smoke.loadtest.json is a local, uncommitted copy of the repo's own loadtest/config/examples/testnet.loadtest.json with the deliberate REPLACE-ME placeholder aggkitProxyUrl swapped for a dummy non-placeholder host (validate performs no network I/O, only schema + operational checks — see loadtest/config/schema.ts's checkOperationalConstraints).

Test plan

• docker build -f Dockerfile.loadtest succeeds
• pnpm loadtest validate <cfg> succeeds inside the built image
• No Chromium/Playwright browser binary present in the image
• workflow_dispatch run of loadtest-image.yaml to actually publish the image to GHCR (left for a maintainer / CI — not triggered by this PR; see gh workflow run loadtest-image.yaml --ref feat/bridge-loadtest-docker)

🤖 Generated with Claude Code

https://claude.ai/code/session_01MzG99erVv82HCYo6priDnN

[claude]

Code review — 1 issue found

Checked for bugs and CLAUDE.md compliance. No bugs found. One team-standards compliance issue in Dockerfile.loadtest.

Dockerfile.loadtest (lines 28-44): docs/team-standards.md violation — single-stage build hand-copies source into the runtime image

The team standards require: pnpm deploy for the runtime bundle — single-package and monorepos both. Never hand-copy node_modules, src/, or package.json into the runtime stage.

This single-stage Dockerfile copies package.json/lockfile (line 28) and the full source tree via COPY . . (line 44) directly into the image that ships. The root Dockerfile achieves compliance via a multi-stage build where the runtime stage (nginx:alpine) contains no Node, pnpm, or source.

Suggested fix: Use a two-stage build with a builder stage that installs deps and copies source, then a slim runtime stage that COPY --from=builder only the necessary artifacts. Alternatively, if the full-source single-stage approach is intentional for this dev tool, consider documenting it as a known deferral in CLAUDE.md alongside the existing Other known deferrals section.

Workflow file (.github/workflows/loadtest-image.yaml) is clean — correct YAML, appropriate permissions, secure auth, and sound step ordering.