Skip to content

Use uv.lock file to build docker images#4374

Merged
nvuillam merged 10 commits intooxsecurity:mainfrom
echoix:uv-lock-file
Dec 14, 2024
Merged

Use uv.lock file to build docker images#4374
nvuillam merged 10 commits intooxsecurity:mainfrom
echoix:uv-lock-file

Conversation

@echoix
Copy link
Copy Markdown
Collaborator

@echoix echoix commented Dec 10, 2024

Fixes #

Proposed Changes

  1. Updates the python project's version that was still kept at 7.13.0 even though multiple releases have been made since.
  2. Uses a stage to include the dependencies before installing the project. Uses newer instructions and commands that are now available with uv: https://docs.astral.sh/uv/guides/integration/docker/#intermediate-layers

Readiness Checklist

Author/Contributor

  • Add entry to the CHANGELOG listing the change and linking to the corresponding issue (if appropriate)
  • If documentation is needed for this change, has that been included in this pull request

Reviewing Maintainer

  • Label as breaking if this is a large fundamental change
  • Label as either automation, bug, documentation, enhancement, infrastructure, or performance

@echoix
Copy link
Copy Markdown
Collaborator Author

echoix commented Dec 10, 2024

There were also some missing licences that the build scripts were finding

@echoix
Copy link
Copy Markdown
Collaborator Author

echoix commented Dec 10, 2024

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.

@nvuillam
Copy link
Copy Markdown
Member

@echoix looks great :)

For my culture, how is generated/maintained uv.lock ?

@echoix
Copy link
Copy Markdown
Collaborator Author

echoix commented Dec 10, 2024

Manually, uv lock.
Otherwise, it should be weekly with renovate, just like the npm

There is uv sync --frozen to install following the lock file, similar to npm and cargo.

It doesn't include the dev deps, only the ones that run the Megalinter core (in Python), the ones listed in pyproject.toml.

@echoix
Copy link
Copy Markdown
Collaborator Author

echoix commented Dec 10, 2024

Otherwise using uv with operations on packages, or installing without mentionning --frozen and outdated updates it, like npm

@nvuillam
Copy link
Copy Markdown
Member

Thank for the explanations :)

@echoix
Copy link
Copy Markdown
Collaborator Author

echoix commented Dec 11, 2024

It's ready now!

@nvuillam nvuillam merged commit 62ebd4a into oxsecurity:main Dec 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants