tegwick
9fabcce1cb
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
46 lines
2.1 KiB
Docker
46 lines
2.1 KiB
Docker
ARG SOURCE_SET_DIGEST=unknown
|
|
|
|
FROM docker.io/nginxinc/nginx-unprivileged@sha256:15c994d10d6d78658721c3bcafff14cb281fba2a4bdf9d5ba92c416a472516e3 AS runtime-base
|
|
|
|
# Preserve the full upstream module set while applying fixed Alpine packages.
|
|
USER root
|
|
RUN apk add --no-cache --upgrade tiff=4.7.2-r0 zlib=1.3.2-r1
|
|
USER 101:101
|
|
|
|
ARG VCS_REVISION=unknown
|
|
ARG SOURCE_SET_DIGEST
|
|
LABEL org.opencontainers.image.title="policy-nexus" \
|
|
org.opencontainers.image.description="Canonical Coulomb policy publication surface" \
|
|
org.opencontainers.image.source="https://forgejo.coulomb.social/coulomb/policy-nexus" \
|
|
org.opencontainers.image.revision="$VCS_REVISION" \
|
|
org.coulomb.policy.source-set-digest="$SOURCE_SET_DIGEST"
|
|
|
|
COPY --chown=101:101 deploy/nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
USER 101:101
|
|
EXPOSE 8080
|
|
|
|
FROM runtime-base AS local-artifact
|
|
COPY --chown=101:101 build/ /usr/share/nginx/html/
|
|
|
|
FROM docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31 AS release-builder
|
|
# Staged-source review tests exercise real Git index semantics. Builder only.
|
|
RUN apk add --no-cache git
|
|
ARG SOURCE_SET_DIGEST
|
|
ENV POLICY_NEXUS_SOURCE_ROOT=/workspace/_sources
|
|
WORKDIR /workspace/policy-nexus
|
|
COPY . /workspace/policy-nexus
|
|
COPY _sources /workspace/_sources
|
|
RUN python3 -m unittest discover -s tests -p 'test_*.py' \
|
|
&& python3 tools/build_site.py publication.json --output build \
|
|
&& python3 tools/source_inventory.py check \
|
|
--source-root /workspace/_sources \
|
|
--lock /workspace/_sources/source-lock.json \
|
|
--report build/source-inventory.json \
|
|
&& test "$(python3 -c 'import json; print(json.load(open("/workspace/_sources/source-lock.json"))["source_set_digest"])')" = "$SOURCE_SET_DIGEST" \
|
|
&& cp /workspace/_sources/source-lock.json build/source-lock.json \
|
|
&& python3 tools/verify_release.py build \
|
|
&& python3 tools/check_currency.py publication.json
|
|
|
|
FROM runtime-base AS release-artifact
|
|
COPY --from=release-builder --chown=101:101 /workspace/policy-nexus/build/ /usr/share/nginx/html/
|