Djeex
6eba3916b4
- gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR - new ruff lint stage (ruff.toml pins known-first-party for host/container consistency; F841/B007 in webui.py left un-fixed via per-file-ignores — app-logic changes, flagged for review rather than auto-fixed) - pytest --cov-fail-under=90 gate on the test stage (already had pytest-cov, never wired into CI until now) - scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR if it clears the finding, instead of just failing red - ruff --fix/--format applied to existing code to start the gate clean
39 lines
918 B
Docker
39 lines
918 B
Docker
FROM python:3.14.7-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apk add --no-cache gcc musl-dev jpeg-dev zlib-dev
|
|
|
|
COPY requirements.txt .
|
|
RUN pip wheel --no-cache-dir --wheel-dir=/wheels -r requirements.txt
|
|
|
|
FROM python:3.14.7-alpine AS base
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder /wheels /wheels
|
|
RUN pip install --no-cache-dir --find-links=/wheels /wheels/* && rm -rf /wheels
|
|
|
|
COPY build.py gallery.py VERSION /app/
|
|
COPY ./src/ ./src/
|
|
COPY ./config /app/default
|
|
COPY ./docker/.sh/entrypoint.sh /app/entrypoint.sh
|
|
RUN chmod +x /app/entrypoint.sh
|
|
|
|
FROM base AS test
|
|
|
|
COPY requirements.txt requirements-dev.txt pytest.ini /app/
|
|
RUN pip install --no-cache-dir -r requirements-dev.txt
|
|
COPY ./tests/ ./tests/
|
|
COPY ./demo/ ./demo/
|
|
|
|
FROM base AS lint
|
|
|
|
RUN pip install --no-cache-dir ruff==0.16.4
|
|
COPY ruff.toml /app/ruff.toml
|
|
COPY ./tests/ ./tests/
|
|
RUN ruff check . && ruff format --check .
|
|
|
|
FROM base
|
|
|
|
ENTRYPOINT ["/app/entrypoint.sh"] |