chore(docker): consolidate Dockerfiles and tidy up compose

Author: alexhambley

.github/workflows/build-with-profiles.yml

@@ -39,8 +39,11 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile.fivesafes-profile
           push: true
+          # Bake the five-safes profile into the shared Dockerfile via build args.
+          build-args: |
+            FIVE_SAFES_PROFILE_VERSION=five-safes-0.7.4-beta
+            PROFILES_ARCHIVE_URL=https://github.com/eScienceLab/rocrate-validator/archive/refs/tags/five-safes-0.7.4-beta.tar.gz
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 

Dockerfile

@@ -1,7 +1,7 @@
 FROM python:3.11-slim
 
-# Install required system packages, including git
-RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+# git is needed by some dependencies; wget is only used when baking a profile.
+RUN apt-get update && apt-get install -y git wget && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -12,6 +12,22 @@ RUN pip install --no-cache-dir -r requirements.txt
 COPY cratey.py LICENSE /app/
 COPY app /app/app
 
+# Optionally bake an extra RO-Crate profile into the validator's bundled
+# profiles directory. A plain build leaves PROFILES_ARCHIVE_URL empty and skips
+# this entirely; the "with profiles" image build passes these as --build-arg.
+# Baked profiles are then found automatically (no PROFILES_PATH needed).
+ARG PROFILES_ARCHIVE_URL=""
+ARG FIVE_SAFES_PROFILE_VERSION=""
+ARG PY_VER=3.11
+RUN if [ -n "$PROFILES_ARCHIVE_URL" ]; then \
+        wget -O /tmp/profiles.tar.gz "$PROFILES_ARCHIVE_URL" && \
+        tar -xzf /tmp/profiles.tar.gz \
+            -C "/usr/local/lib/python${PY_VER}/site-packages/rocrate_validator/profiles/" \
+            --strip-components=3 \
+            "rocrate-validator-${FIVE_SAFES_PROFILE_VERSION}/rocrate_validator/profiles/five-safes-crate" && \
+        rm /tmp/profiles.tar.gz ; \
+    fi
+
 RUN useradd -ms /bin/bash flaskuser
 RUN chown -R flaskuser:flaskuser /app
 
@@ -21,4 +37,5 @@ EXPOSE 5000
 
 CMD ["flask", "run", "--host=0.0.0.0"]
 
-LABEL org.opencontainers.image.source="https://github.com/eScienceLab/Cratey-Validator"
+LABEL org.opencontainers.image.source="https://github.com/eScienceLab/Cratey-Validator"
+LABEL org.cratey.five-safes-profile-version="${FIVE_SAFES_PROFILE_VERSION}"

Dockerfile.fivesafes-profile

@@ -1,4 +1,7 @@
-version: '3.8'
+# Development stack: builds the app image locally from ./Dockerfile and mounts
+# the custom RO-Crate profiles into both the flask and worker containers. Use
+# this when working on the service itself; use docker-compose.yml to run the
+# published image.
 
 services:
   flask:

docker-compose-develop.yml

@@ -1,4 +1,8 @@
-version: '3.8'
+# Default stack, using the published image (ghcr.io/.../cratey-validator).
+# For running the service. Object storage is opt-in: set STORAGE_ENABLED=true
+# and start the "objectstore" profile (docker compose --profile objectstore up).
+# For local development against a freshly built image, use
+# docker-compose-develop.yml instead.
 
 services:
   flask: