activity-core/Dockerfile

# Stage 1 — install Python deps
FROM python:3.12-slim@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS builder
RUN pip install uv==0.5.9 --no-cache-dir
WORKDIR /app
COPY pyproject.toml uv.lock ./
COPY src/ ./src/
RUN uv sync --no-dev --frozen

# Repo Manager CLI for the bounded operation repo_manager_freshness
# (RMGR-WP-0020-T04, ACTIVITY-WP-0044). Isolated venv from repo-manager's own
# lock at the founder-reviewed commit; git verifies the commit identity. Git is
# needed only in this build stage and does not enter the runtime image.
ARG REPO_MANAGER_COMMIT=e77f8b457647ff23697e45a74615edde5f42d39d
RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/* \
 && git init -q /opt/repo-manager \
 && git -C /opt/repo-manager fetch -q --depth 1 https://forgejo.coulomb.social/coulomb/repo-manager.git "${REPO_MANAGER_COMMIT}" \
 && git -C /opt/repo-manager checkout -q --detach FETCH_HEAD \
 && test "$(git -C /opt/repo-manager rev-parse HEAD)" = "${REPO_MANAGER_COMMIT}" \
 && cd /opt/repo-manager && uv sync --no-dev --frozen --no-editable \
 && /opt/repo-manager/.venv/bin/rmgr freshness run --help > /dev/null

# Isolated CI checks; development dependencies do not enter the runtime image.
FROM builder AS test
# Real-Git transport fixtures require Git only in the isolated test image.
RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
COPY tests/ ./tests/
COPY Dockerfile ./Dockerfile
COPY .forgejo/workflows/image.yaml ./.forgejo/workflows/image.yaml
COPY schemas/ ./schemas/
COPY k8s/ ./k8s/
COPY scripts/render_gitops.py scripts/check_gitops_promotion.py scripts/verify_custodian_bundle.py ./scripts/
COPY activity-definitions/ ./activity-definitions/
RUN uv sync --frozen --extra dev && uv run --no-sync python scripts/render_gitops.py --check --verify-frontend --verify-platform && uv run --no-sync pytest -q -p no:cacheprovider tests/test_frontend_patterns.py tests/test_frontend_monthly_review.py tests/test_pqrst_monthly.py tests/test_repository_grant.py tests/test_instruction_evaluation.py tests/test_admin_sync_api.py tests/test_gitops_release.py tests/test_release_broker.py tests/test_release_transport.py tests/test_release_dispatch.py tests/test_custodian_bundle.py tests/test_custodian_inputs.py tests/test_custodian_operations.py

# Stage 2 — runtime image
FROM python:3.12-slim@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS runtime
WORKDIR /app
COPY --from=builder /app/.venv /app/.venv
COPY --from=builder /app/src /app/src
COPY --from=builder /opt/repo-manager/.venv /opt/repo-manager/.venv
COPY alembic.ini ./
COPY migrations/ ./migrations/
COPY scripts/ ./scripts/
# Pinned owner commands; local hash verification performs no network or execution.
COPY k8s/custodian-release/commands/ /opt/custodian-commands/
COPY k8s/custodian-release/input-policy.json /opt/custodian-input-policy.json
RUN python /app/scripts/verify_custodian_bundle.py --root /opt/custodian-commands
COPY activity-definitions/ ./activity-definitions/
COPY event-types/ ./event-types/
COPY tasks/ ./tasks/
ENV PATH="/app/.venv/bin:$PATH"
ENV PYTHONPATH="/app/src"
ENV ACTIVITY_CORE_RMGR_BIN="/opt/repo-manager/.venv/bin/rmgr"
CMD ["python", "-m", "activity_core.worker"]