|
1 | 1 | FROM python:3.13-alpine AS builder |
2 | 2 | HEALTHCHECK NONE |
3 | 3 |
|
4 | | -ENV PATH="${PATH}:/app/.local/bin" \ |
5 | | - POETRY_VERSION=2.1.2 \ |
6 | | - PYTHONDONTWRITEBYTECODE=1 \ |
7 | | - POETRY_CACHE_DIR=/app/.cache \ |
8 | | - POETRY_NO_INTERACTION=1 \ |
9 | | - POETRY_VIRTUALENVS_IN_PROJECT=1 \ |
10 | | - POETRY_VIRTUALENVS_CREATE=1 |
| 4 | +ENV UV_LINK_MODE=copy \ |
| 5 | + UV_COMPILE_BYTECODE=1 \ |
| 6 | + UV_PYTHON_DOWNLOADS=never \ |
| 7 | + UV_PYTHON=python3.13 \ |
| 8 | + UV_NO_PROGRESS=1 |
11 | 9 |
|
12 | | -# kics-scan ignore-line |
13 | | -RUN apk add --no-cache musl-dev libffi-dev gcc |
14 | | -RUN addgroup -g 1000 app && adduser -G app -u 999 -s /sbin/nologin -h /app app -D |
| 10 | +COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv |
15 | 11 | WORKDIR /app |
16 | | -COPY pyproject.toml poetry.lock ./ |
17 | | -RUN chmod -R a+r . |
18 | | -USER app |
19 | | -RUN pip install poetry==${POETRY_VERSION} --no-cache-dir |
20 | | -RUN poetry install --only main |
| 12 | +RUN --mount=type=cache,target=/root/.cache \ |
| 13 | + --mount=type=bind,source=uv.lock,target=uv.lock \ |
| 14 | + --mount=type=bind,source=pyproject.toml,target=pyproject.toml \ |
| 15 | + uv sync \ |
| 16 | + --locked \ |
| 17 | + --no-dev \ |
| 18 | + --no-install-project --no-editable |
| 19 | +COPY pyproject.toml uv.lock ./ |
| 20 | +COPY *.py ./ |
| 21 | +RUN --mount=type=cache,target=/root/.cache/uv \ |
| 22 | + uv sync --locked --no-editable --no-dev |
21 | 23 |
|
22 | 24 | FROM python:3.13-alpine AS runtime |
23 | 25 | HEALTHCHECK NONE |
24 | 26 |
|
25 | | -ENV VIRTUAL_ENV=/app/.venv \ |
26 | | - PATH="/app/.venv/bin:${PATH}" |
| 27 | +ENV PATH="/app/.venv/bin:${PATH}" |
27 | 28 |
|
28 | 29 | RUN addgroup -g 1000 app && adduser -G app -u 999 -s /sbin/nologin -h /app app -D |
29 | 30 | WORKDIR /app |
30 | | -COPY --from=builder ${VIRTUAL_ENV} ${VIRTUAL_ENV} |
31 | | -COPY *.py ./ |
| 31 | +COPY --from=builder /app /app |
32 | 32 | RUN chmod -R a+r . |
33 | | -USER app |
34 | 33 | LABEL org.opencontainers.image.source=https://github.com/notdodo/github-actions/tree/main/auto-tagger |
35 | 34 | LABEL org.opencontainers.image.description="A GitHub Action to automatically bump and/or create tags upon push to the default branch, using SemVer formatting." |
36 | 35 |
|
37 | | -CMD ["python", "/app/main.py"] |
| 36 | +USER app |
| 37 | +CMD ["python", "-OO", "/app/main.py"] |
0 commit comments