tegwick
34d1dc575c
Install repo-manager e77f8b4 from its own uv.lock into an isolated venv in the builder stage (commit identity asserted via git), copy it into the runtime image and set ACTIVITY_CORE_RMGR_BIN. Add a pin test and the founder-executed rollout package (Argo CD manifest diff, PVC, token route blocker, trial runbooks). Nothing deployed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 692292@bnt-lap001 Assistant-Session: 89c7d8e8-e1b3-47eb-9411-a0ab227fca2f
49 lines
2.8 KiB
Docker
49 lines
2.8 KiB
Docker
# Stage 1 — install Python deps
|
|
FROM python:3.12-slim@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS builder
|
|
RUN pip install uv==0.5.9 --no-cache-dir
|
|
WORKDIR /app
|
|
COPY pyproject.toml uv.lock ./
|
|
COPY src/ ./src/
|
|
RUN uv sync --no-dev --frozen
|
|
|
|
# Repo Manager CLI for the bounded operation repo_manager_freshness
|
|
# (RMGR-WP-0020-T04, ACTIVITY-WP-0044). Isolated venv from repo-manager's own
|
|
# lock at the founder-reviewed commit; git verifies the commit identity. Git is
|
|
# needed only in this build stage and does not enter the runtime image.
|
|
ARG REPO_MANAGER_COMMIT=e77f8b457647ff23697e45a74615edde5f42d39d
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/* \
|
|
&& git init -q /opt/repo-manager \
|
|
&& git -C /opt/repo-manager fetch -q --depth 1 https://forgejo.coulomb.social/coulomb/repo-manager.git "${REPO_MANAGER_COMMIT}" \
|
|
&& git -C /opt/repo-manager checkout -q --detach FETCH_HEAD \
|
|
&& test "$(git -C /opt/repo-manager rev-parse HEAD)" = "${REPO_MANAGER_COMMIT}" \
|
|
&& cd /opt/repo-manager && uv sync --no-dev --frozen --no-editable \
|
|
&& /opt/repo-manager/.venv/bin/rmgr freshness run --help > /dev/null
|
|
|
|
# Isolated CI checks; development dependencies do not enter the runtime image.
|
|
FROM builder AS test
|
|
# Real-Git transport fixtures require Git only in the isolated test image.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
|
|
COPY tests/ ./tests/
|
|
COPY Dockerfile ./Dockerfile
|
|
COPY .forgejo/workflows/image.yaml ./.forgejo/workflows/image.yaml
|
|
COPY schemas/ ./schemas/
|
|
COPY k8s/ ./k8s/
|
|
COPY scripts/render_gitops.py scripts/check_gitops_promotion.py ./scripts/
|
|
RUN uv sync --frozen --extra dev && uv run --no-sync python scripts/render_gitops.py --check --verify-frontend --verify-platform && uv run --no-sync pytest -q -p no:cacheprovider tests/test_frontend_patterns.py tests/test_frontend_monthly_review.py tests/test_pqrst_monthly.py tests/test_repository_grant.py tests/test_instruction_evaluation.py tests/test_admin_sync_api.py tests/test_gitops_release.py tests/test_release_broker.py tests/test_release_transport.py tests/test_release_dispatch.py
|
|
|
|
# Stage 2 — runtime image
|
|
FROM python:3.12-slim@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS runtime
|
|
WORKDIR /app
|
|
COPY --from=builder /app/.venv /app/.venv
|
|
COPY --from=builder /app/src /app/src
|
|
COPY --from=builder /opt/repo-manager/.venv /opt/repo-manager/.venv
|
|
COPY alembic.ini ./
|
|
COPY migrations/ ./migrations/
|
|
COPY scripts/ ./scripts/
|
|
COPY activity-definitions/ ./activity-definitions/
|
|
COPY event-types/ ./event-types/
|
|
COPY tasks/ ./tasks/
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
ENV PYTHONPATH="/app/src"
|
|
ENV ACTIVITY_CORE_RMGR_BIN="/opt/repo-manager/.venv/bin/rmgr"
|
|
CMD ["python", "-m", "activity_core.worker"]
|