29b302cdf0
Some checks failed
CI / skinny-install (aco) (push) Successful in 46s
CI / skinny-install (api) (push) Successful in 28s
CI / skinny-install (bcda) (push) Successful in 26s
CI / skinny-install (bib) (push) Successful in 24s
CI / skinny-install (bls) (push) Successful in 28s
CI / skinny-install (ccw) (push) Successful in 31s
CI / skinny-install (cli) (push) Successful in 26s
CI / skinny-install (cms) (push) Successful in 26s
CI / skinny-install (conf) (push) Successful in 26s
CI / skinny-install (pfs) (push) Successful in 26s
CI / skinny-install (rex) (push) Successful in 24s
CI / lint-test (push) Successful in 5m50s
Infra CI / notebooks (push) Successful in 1m14s
Infra CI / zotero (push) Failing after 5s
Infra CI / docs (push) Successful in 6s
Infra CI / api (push) Successful in 13s
Infra CI / mc (push) Successful in 7s
Deploy / build-scan-report (push) Successful in 5m6s
Cherry-picked from feat/pkg-supply-chain, adapted for infra/ tree layout: - dev/scripts/pkg_inventory.py — scans Dockerfiles, pyproject.toml, CI workflows, and shell scripts to build a unified package manifest - dev/scripts/pkg_mirror_sync.py — syncs PyPI/APK/npm packages to Gitea package registry (replaces devpi/apt-cacher-ng) - dev/scripts/pkg_drift.py — compares mirror contents against manifest, flags missing or stale packages - dev/scripts/pkg_issues.py — auto-creates Gitea issues for drift and CVE findings - dev/scripts/test_network_isolation.sh — verifies containers can't reach the internet except through mirrors - dev/pipelines/pkg-supply-chain.yml — CI-agnostic pipeline spec - .gitea/workflows/pkg-supply-chain.yml — daily + push-triggered CI job - PYPI_INDEX_URL build arg added to api and notebooks Dockerfiles
34 lines
955 B
Docker
34 lines
955 B
Docker
# syntax=docker/dockerfile:1
|
|
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# Local package registry (Gitea) — set via --build-arg to pull from mirror
|
|
ARG PYPI_INDEX_URL=""
|
|
|
|
# Patch base image CVEs
|
|
RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy project files for install
|
|
COPY pyproject.toml uv.lock README.md ./
|
|
COPY src/ src/
|
|
|
|
# Install the package (no dev deps)
|
|
ENV UV_PYTHON_PREFERENCE=only-system \
|
|
UV_LINK_MODE=copy \
|
|
UV_PROJECT_ENVIRONMENT=.venv \
|
|
UV_INDEX_URL=${PYPI_INDEX_URL}
|
|
RUN uv sync --no-dev && uv pip install -e .
|
|
|
|
# Config
|
|
COPY stack.toml ./
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
|
|
|
|
CMD ["uv", "run", "--no-sync", "uvicorn", "api.server:app", \
|
|
"--host", "0.0.0.0", "--port", "8000", \
|
|
"--workers", "1", "--log-level", "info"]
|