Djeex
30c9b83c17
- gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR - new ruff lint stage (ruff.toml pins known-first-party for host/container consistency; B905 in env_config.py's zip() left un-fixed — app-logic change, see feedback-no-app-logic-changes) - pytest --cov-fail-under=75 gate on the test stage - scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR if it clears the finding, instead of just failing red - ruff --fix/--format applied to existing code to start the gate clean
35 lines
617 B
Docker
35 lines
617 B
Docker
FROM python:3.14.7-alpine AS base
|
|
|
|
RUN apk add --no-cache ca-certificates
|
|
|
|
WORKDIR /app
|
|
|
|
COPY VERSION /VERSION
|
|
COPY /app/ /app/
|
|
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
FROM base AS test
|
|
|
|
RUN pip install --no-cache-dir pytest==9.1.1 pytest-cov==7.1.0
|
|
|
|
COPY pytest.ini /app/pytest.ini
|
|
COPY /tests/ /app/tests/
|
|
|
|
CMD ["pytest", "-v"]
|
|
|
|
FROM base AS lint
|
|
|
|
RUN pip install --no-cache-dir ruff==0.16.4
|
|
COPY ruff.toml /app/ruff.toml
|
|
COPY /tests/ /app/tests/
|
|
RUN ruff check . && ruff format --check .
|
|
|
|
FROM base
|
|
|
|
RUN addgroup -g 911 nvbot && adduser -D -u 911 -G nvbot nvbot
|
|
|
|
USER nvbot
|
|
|
|
CMD ["python", "main.py"]
|