ci: use alpine for const

Dockerfile.const

@@ -1,29 +1,22 @@
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/fedora:34@sha256:321dbc444dfeda328a85dc3c31545a65c1fae8390aa5ba6dc1f5222b53b42697 AS const-build
-
-# add additional root CAs
-COPY cert.pem* /certs/
-RUN if [ -e /certs/cert.pem ]; then cp /certs/cert.pem /etc/pki/tls/certs/ca-bundle.crt; fi
+FROM node:16-alpine@sha256:004dbac84fed48e20f9888a23e32fa7cf83c2995e174a78d41d9a9dd1e051a20 as const-build
 
 # fetch scripts/guardian-set-init.sh deps
-RUN dnf -y install jq
-RUN dnf -y install make
-RUN dnf -y install findutils
+RUN apk update && apk add bash g++ make python3 curl jq findutils
 
-# fetch clients/** deps
-RUN curl -fsSL https://rpm.nodesource.com/setup_16.x | bash - && dnf -y install nodejs
-
-# configure node & npm to work with custom root CAs
-ENV NODE_EXTRA_CA_CERTS=/certs/cert.pem
-ENV NODE_OPTIONS=--use-openssl-ca
-RUN if [ -e /certs/cert.pem ]; then npm config set cafile /certs/cert.pem; fi
+# Support additional root CAs
+COPY README.md cert.pem* /certs/
+# Alpine
+RUN if [ -e /certs/cert.pem ]; then cp /certs/cert.pem /etc/ssl/cert.pem; fi
 
 # install CLI deps & build
 WORKDIR /clients/js
+
 # copy package.json & package-lock.json by themselves to create a cache layer
 COPY clients/js/package.json clients/js/package-lock.json ./
 # mount the buildkit cache on npm's cache dir, install dependencies
-RUN --mount=type=cache,target=/root/.npm npm ci
+RUN --mount=type=cache,uid=1000,gid=1000,target=/home/node/.npm \
+    npm ci
 # copy the rest of the source files, as a layer on top of the deps
 COPY clients/js ./
 # build CLI