61f6b8d2d5
Comprehensive deploy safety audit implementing 19 improvements across CI/CD pipeline, test coverage, and source code. ### CI/CD Pipeline - ruff + mypy added to both release.yml and keboola-deploy.yml (continue-on-error) - Smoke test added to keboola-deploy.yml (was missing) - Automatic rollback on smoke test failure in release.yml - Expanded smoke-test.sh with catalog, admin/tables, marketplace.zip, metrics - Required status checks via .github/settings.yml - Dependabot + CODEOWNERS + pre-commit hooks + ruff config ### Source Code - DB schema version check in /api/health (db_schema: ok/mismatch/unhealthy) - Config versioning (config_version: 1 in instance.yaml, non-blocking validation) - BigQuery extractor ATTACH error handling (try/except around INSTALL+ATTACH) - Post-deploy smoke test script for prod VM validation ### Test Coverage (~50 new tests) - v13->v14 migration, Email magic link TTL, PAT, Marketplace ZIP/Git, Jira webhooks, Hybrid Query BQ, Keboola/BQ extractor failure modes, Orchestrator failure modes Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
36 lines
1.2 KiB
Docker
36 lines
1.2 KiB
Docker
FROM python:3.13-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends curl git && rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
|
|
ARG AGNES_VERSION=dev
|
|
ARG RELEASE_CHANNEL=dev
|
|
ARG AGNES_COMMIT_SHA=unknown
|
|
ARG AGNES_TAG=unknown
|
|
ENV AGNES_VERSION=${AGNES_VERSION}
|
|
ENV RELEASE_CHANNEL=${RELEASE_CHANNEL}
|
|
ENV AGNES_COMMIT_SHA=${AGNES_COMMIT_SHA}
|
|
ENV AGNES_TAG=${AGNES_TAG}
|
|
|
|
WORKDIR /app
|
|
|
|
COPY . .
|
|
|
|
# Build wheel artifact (served at /cli/download)
|
|
RUN uv build --wheel --out-dir /app/dist
|
|
|
|
# Install production dependencies from pyproject.toml
|
|
RUN uv pip install --system --no-cache .
|
|
|
|
# Run as non-root user for container hardening (C13).
|
|
# uid/gid pinned to 999 so host-side chown in startup-script.sh.tpl can match
|
|
# without parsing /etc/passwd inside the image. Changing this number breaks
|
|
# every existing PD-backed deploy until the operator re-chowns /data.
|
|
RUN useradd --system --uid 999 --create-home --shell /usr/sbin/nologin agnes && \
|
|
mkdir -p /data && chown -R agnes:agnes /data && \
|
|
chown -R agnes:agnes /app
|
|
USER agnes
|
|
|
|
EXPOSE 8000
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers", "--forwarded-allow-ips", "*"]
|