ENG-1989 Remove sconification API & deployment from iapp

[Christophe-iExec]

Summary

Removes the sconification API and its deployment infrastructure from the iapp project, following the dropping of SGX support and the discovery that the Azure custom self-hosted runners used for deployment are being cleaned up (ENG-1974).

Changes

API source code — deleted

• api/src/sconify/sconifyBuild.handler.ts — WebSocket SCONIFY_BUILD request handler
• api/src/sconify/sconifyBuild.service.ts — sconification orchestration service
• api/src/singleFunction/ — all 8 Docker operation helpers (checkPushToken, getSconifiedImageFingerprint, inspectImage, pruneBuilderCache, pullPublicImage, pullSconeImage, pushImage, removeContainer, removeImage, sconifyImage)
• api/src/utils/websocket.ts — WebSocket server (exclusively used for sconification)
• api/src/utils/ethereumAddressZodSchema.ts — wallet address validator (only used by sconify handler)
• api/src/utils/parseImagePath.ts — image path parser (only used by sconify service)
• api/src/utils/utils.ts — sleep helper (only used in websocket.ts)
• api/src/constants/constants.ts — all content was sconification-related (SCONIFY_IMAGE_NAME, SCONIFY_IMAGE_VERSIONS, template configs, WS timing constants)

API source code — modified

• api/src/index.ts — removed all sconify HTTP stubs (/sconify, /sconify/build), WebSocket setup and related imports; retains health and root endpoints
• api/src/utils/errors.ts — removed zod-validation-error ValidationError handling (no longer triggered after removing zod-based request validation)

CI/CD workflows — deleted

• .github/workflows/reusable-api-deploy.yml — SSH deployment workflow using Azure_runners (the specific file flagged in ENG-1974)
• .github/workflows/api-deploy-rollback.yml — rollback deployment workflow

CI/CD workflows — modified

• .github/workflows/api-deploy-release.yml — removed the deploy job that called reusable-api-deploy.yml; docker-publish job is retained

Deployment config — modified

• api/docker-compose.yml — removed ENCLAVE_KEY_PATH environment variable and sig/enclave-key.pem volume mount (SGX signing key artefacts)

Dependencies — modified

• api/package.json — removed ensure-signing-key npm script; removed dependencies: dockerode, ethers, jwt-decode, zod, zod-validation-error; removed devDependencies: @types/dockerode, @types/ws
• api/package-lock.json — needs to be regenerated: run npm install inside api/ and commit the result before merging (the full lock file could not be pushed programmatically due to size constraints)

Testing

After applying this PR, verify:

cd api
npm install          # regenerates package-lock.json
npm run check-types  # should pass with no errors
npm run lint         # should pass with no errors
npm run check-format # should pass

Key: ENG-1989

Co-authored by Claude agent for Jira.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​express@​5.0.1 ⏵ 5.0.6
	npm/​typescript-eslint@​8.67.0
	npm/​tsx@​4.19.3 ⏵ 4.23.12	+1		+1	+3
	npm/​rimraf@​6.1.3
	npm/​pino-pretty@​13.0.0 ⏵ 13.1.3	+1
	npm/​pino-http@​10.4.0 ⏵ 10.5.0
	npm/​globals@​16.5.0
	npm/​express@​5.1.0 ⏵ 5.2.1
	npm/​@​eslint/​js@​9.24.0 ⏵ 9.39.5			+10	+2
	npm/​typescript@​5.9.3
	npm/​pino@​9.6.0 ⏵ 9.14.0	+1
	npm/​uuid@​11.1.1
	npm/​eslint@​9.24.0 ⏵ 9.39.5	+10			-1
	npm/​prettier@​3.9.6

View full report