Use apko and melange for container creation

.apko.yaml

@@ -0,0 +1,39 @@
+contents:
+  keyring:
+    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+    - ./melange.rsa.pub
+  repositories:
+    - https://packages.wolfi.dev/os
+    - '@local ./work/packages'
+  packages:
+    - vocalizr@local
+cmd: /usr/bin/vocalizr
+archs:
+  - amd64
+environment:
+  GRADIO_SERVER_PORT: 7860
+  GRADIO_SERVER_NAME: 0.0.0.0
+  HF_HOME: /home/nonroot/hf
+accounts:
+  groups:
+    - groupname: nonroot
+      gid: 10000
+  users:
+    - username: nonroot
+      uid: 10000
+  run-as: nonroot
+work-dir: /home/nonroot
+paths:
+  - path: /home/nonroot
+    type: directory
+    uid: 10000
+    gid: 10000
+    permissions: 0o777
+  - path: /usr/share/vocalizr
+    type: directory
+    uid: 10000
+    gid: 10000
+    permissions: 0o777
+layering:
+  strategy: origin
+  budget: 5

.github/workflows/.docker.yaml

@@ -20,8 +20,8 @@ permissions:
   attestations: write
   id-token: write
 jobs:
-  check_dockerfile:
-    name: Validate Dockerfile
+  build_apk:
+    name: Build APK with Melange
     runs-on: ubuntu-latest
     if: ${{ inputs.is_test }}
     environment:
@@ -32,33 +32,36 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - name: Log in to ${{ inputs.registry }} Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
-        with:
-          registry: ${{ inputs.registry }}
-          username: mh0386
-          password: ${{ inputs.registry == 'ghcr.io' && secrets.GH_TOKEN || inputs.registry == 'docker.io' && secrets.TOKEN_KEY_DOCKER
-            }}
-      - name: Validate build configuration
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
-        with:
-          call: check
-      - name: Job Summary (Success)
-        if: ${{ success() }}
-        run: |
-          echo "# Dockerfile Check" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "No issues found :heavy_check_mark:" >> $GITHUB_STEP_SUMMARY
-      - name: Job Summary (Failure)
-        if: ${{ failure() }}
-        run: |
-          echo "# Dockerfile Check" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Check failed :x:" >> $GITHUB_STEP_SUMMARY
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Install Melange
+        uses: addnab/docker-run-action@v3
+        with:
+          registry: cgr.dev
+          image: chainguard/melange:latest-dev
+          options: --rm -v ${{ github.workspace }}:/work
+          run: melange keygen
+          shell: bash
+      - name: Build APK
+        uses: addnab/docker-run-action@v3
+        with:
+          registry: cgr.dev
+          image: chainguard/melange:latest-dev
+          options: --privileged --rm -v ${{ github.workspace }}:/work
+          run: melange build melange.yaml --arch amd64 --signing-key melange.rsa
+          shell: bash
+      - name: Upload APK artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: apk
+          path: packages/
+      - name: Upload Melange key artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: melange
+          path: melange.rsa.pub
   build_image:
     name: Build and push Docker image to ${{ inputs.registry }}
-    needs: check_dockerfile
+    needs: build_apk
     if: ${{ always() && !cancelled() }}
     runs-on: ubuntu-latest
     outputs:
@@ -86,24 +89,17 @@ jobs:
             /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle
 
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - name: Get Python version from pyproject.toml
-        id: get_python_version
-        uses: mikefarah/yq@796317b885ae219215caa36e9bdacc87c9962c15 # v4.48.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Download APK artifact
+        uses: actions/download-artifact@v6.0.0
         with:
-          cmd: yq -roy '.project.requires-python' pyproject.toml
-      - name: Log in to ${{ inputs.registry }} Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+          name: apk
+          path: work/packages/
+      - name: Download Melange key artifact
+        uses: actions/download-artifact@v6.0.0
         with:
-          registry: ${{ inputs.registry }}
-          username: mh0386
-          password: ${{ inputs.registry == 'ghcr.io' && secrets.GH_TOKEN || inputs.registry == 'docker.io' && secrets.TOKEN_KEY_DOCKER
-            }}
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
-      - name: Docker meta
+          name: melange
+      - name: Container metadata
         id: meta
         uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
         with:
@@ -114,23 +110,18 @@ jobs:
             type=ref,event=tag
             type=ref,event=branch
       - name: Build and Push to ${{ inputs.registry }}
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
-        id: push
-        with:
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-          build-args: |
-            INSTALL_SOURCE=${{ inputs.install_source }}
-            PYTHON_VERSION=${{ steps.get_python_version.outputs.result }}
+        uses: chainguard-images/actions/apko-publish@v1.0.7
+        id: apko
+        with:
+          tag: ${{ steps.meta.outputs.tags }}
+          generic-user: mh0386
+          generic-pass: ${{inputs.registry == 'ghcr.io' && secrets.GH_TOKEN || inputs.registry == 'docker.io' && secrets.TOKEN_KEY_DOCKER}}
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
         if: ${{ inputs.is_test == false }}
         with:
-          subject-name: ${{ inputs.registry == 'docker.io' && 'index.docker.io' || inputs.registry }}/${{ github.repository
-            }}
-          subject-digest: ${{ steps.push.outputs.digest }}
+          subject-name: ${{inputs.registry == 'docker.io' && 'index.docker.io' || inputs.registry}}/${{github.repository}}
+          subject-digest: ${{ steps.apko.outputs.digest }}
           push-to-registry: true
       - name: Update Docker Hub Description
         if: ${{ inputs.registry == 'docker.io' }}
@@ -168,8 +159,7 @@ jobs:
         with:
           registry: ${{ inputs.registry }}
           username: mh0386
-          password: ${{ inputs.registry == 'ghcr.io' && secrets.GH_TOKEN || inputs.registry == 'docker.io' && secrets.TOKEN_KEY_DOCKER
-            }}
+          password: ${{inputs.registry == 'ghcr.io' && secrets.GH_TOKEN || inputs.registry == 'docker.io' && secrets.TOKEN_KEY_DOCKER}}
       - name: Docker Scout
         uses: docker/scout-action@f8c776824083494ab0d56b8105ba2ca85c86e4de # v1
         continue-on-error: true
@@ -191,16 +181,15 @@ jobs:
         image: ${{ needs.build_image.outputs.image_tag }}
         ports:
           - 7860:7860
-        options: >-
-          --health-cmd "curl -o /dev/null -f -s -w 'Status: %{http_code}, Time: %{time_total}s' http://localhost:7860/" --health-interval
-          10s --health-timeout 10s --health-start-period 20s --health-retries 15
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
       - name: Echo URL
         run: echo "Vocalizr available on localhost:${{ job.services.vocalizr.ports['7860'] }}"
+      - name: Sleep for 10 seconds
+        run: sleep 10s
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Install uv
@@ -224,7 +213,7 @@ jobs:
     needs:
       - api_test
       - docker_scout
-    if: ${{ always() && !cancelled() && inputs.registry == 'ghcr.io' }}
+    if: ${{ inputs.registry == 'ghcr.io' }}
     runs-on: ubuntu-latest
     environment:
       name: docker_image

.gitignore

@@ -5,4 +5,8 @@
 .venv/
 logs/
 results/
-pycrucible_payload/
+pycrucible_payload/
+launcher
+*.rsa*
+packages/
+*.tar

melange.yaml

@@ -0,0 +1,49 @@
+package:
+  name: vocalizr
+  version: 0.0.13
+  description: Voice Generator part of the Chatacter Backend
+  copyright:
+    - license: MIT
+  dependencies:
+    runtime:
+      - python-${{vars.python_version}}
+  options:
+    no-depends: true
+vars:
+  python_version: 3.12
+environment:
+  contents:
+    keyring:
+      - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+      - ./melange.rsa.pub
+    repositories:
+      - https://packages.wolfi.dev/os
+    packages:
+      - busybox
+      - uv
+      - python-${{vars.python_version}}
+pipeline:
+  - name: Build
+    runs: |-
+      set -x
+      export UV_LINK_MODE="copy"
+      export UV_NO_BUILD="1"
+      export UV_NO_CACHE="1"
+      export UV_NO_DEV="1"
+      export UV_SYSTEM_PYTHON="1"
+      export UV_NO_MANAGED_PYTHON="1"
+      export UV_TOOL_BIN_DIR="/usr/bin"
+      export UV_TOOL_DIR="/usr/share"
+      export TOOL_BIN_DIR="${{targets.destdir}}${UV_TOOL_BIN_DIR}"
+      export TOOL_DIR="${{targets.destdir}}${UV_TOOL_DIR}"
+      uv tool install ${{package.name}}
+      ${UV_TOOL_DIR}/${{package.name}}/bin/python -m spacy download en_core_web_sm
+      find ${UV_TOOL_DIR}/${{package.name}} -type d -name "__pycache__" -exec rm -rf {} +
+      find ${UV_TOOL_DIR}/${{package.name}} -type d -name "tests" -exec rm -rf {} +
+      rm $UV_TOOL_DIR/.lock
+      mkdir -p $TOOL_BIN_DIR $TOOL_DIR
+      ln -s "${UV_TOOL_DIR}/${{package.name}}/bin/${{package.name}}" "${TOOL_BIN_DIR}/${{package.name}}"
+      cp -r "${UV_TOOL_DIR}/${{package.name}}" "${TOOL_DIR}/${{package.name}}"
+      rm -rf "${UV_TOOL_DIR}/${{package.name}}"
+      rm -rf ~/.cache
+  - uses: strip