From 2c608a28254ce3b0b9a418a0f452e140b5634538 Mon Sep 17 00:00:00 2001 From: Nemanja Date: Tue, 14 Jul 2026 08:38:29 +0200 Subject: [PATCH] fix: Docker/CI build hygiene issues from #79 - Drop silent uv sync fallback in Dockerfile so lockfile drift fails the build loudly instead of producing an unpinned, unsigned image - Split Dockerfile into builder/runtime stages so the runtime image runs python -m server.main directly instead of re-resolving the env via `uv run` at container start, and no longer ships uv - Align setup-uv action version to v7 in both CI lint and test jobs Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 2 +- Dockerfile | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ab92157..e134541 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v5 + - uses: astral-sh/setup-uv@v7 with: enable-cache: true - name: Install dependencies diff --git a/Dockerfile b/Dockerfile index 8b7b0f8..032de1f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,17 +1,25 @@ -FROM python:3.12-slim AS runtime +FROM python:3.12-slim AS builder COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ WORKDIR /app -# Install Python dependencies -COPY pyproject.toml uv.lock* ./ -RUN uv sync --frozen --no-dev --no-editable 2>/dev/null || uv sync --no-dev --no-editable +# Install Python dependencies (fails loudly on lockfile drift instead of silently re-resolving) +COPY pyproject.toml uv.lock ./ +RUN uv sync --frozen --no-dev --no-editable # Copy server source and config COPY server/ ./server/ COPY config.yaml ./ +FROM python:3.12-slim AS runtime + +WORKDIR /app + +COPY --from=builder /app /app + +ENV PATH="/app/.venv/bin:$PATH" + EXPOSE 8090 -CMD ["uv", "run", "python", "-m", "server.main"] +CMD ["python", "-m", "server.main"]