Migrate to ruff, update to Python 3.12 and other modern shit

.github/workflows/docker.yml → .github/workflows/build-docker-image.yml

@@ -1,49 +1,48 @@
-name: Create and publish a Docker image
+name: Build and push Docker image
 
 on:
   push:
     branches:
-      - 'main'
-      - 'dev'
+      - "main"
     tags:
-      - '*.*.*'
+      - "*"
   pull_request:
     branches:
-      - 'main'
+      - "main"
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
+  lint:
+    uses: ./.github/workflows/lint.yml
   build-and-push-image:
     runs-on: ubuntu-latest
+    needs: [lint]
     permissions:
       contents: read
       packages: write
-
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - name: Log in to the Container registry
+      - name: Log in to the container registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          target: production

.github/workflows/lint.yml

@@ -1,35 +1,39 @@
-name: Lint with pre-commit
+name: Lint
 
-on: [pull_request, push]
+on: [workflow_call]
+
+env:
+  RUFF_OUTPUT_FORMAT: "github"
+  RUFF_NO_CACHE: true
 
 jobs:
-  quality:
+  lint:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.9']
+        python-version: ["3.12"]
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install Poetry
-        uses: Gr1N/setup-poetry@v4
+        uses: Gr1N/setup-poetry@v9
 
       - name: Cache virtualenv
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         id: cache
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: poetry-${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}
           restore-keys: poetry-${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}
 
-      - name: Install Dependencies
+      - name: Install dependencies
         run: poetry install
         if: steps.cache.outputs.cache-hit != 'true'
 
       - name: Lint
-        uses: pre-commit/action@v2.0.0
+        uses: pre-commit/action@v3.0.0

.pre-commit-config.yaml

@@ -1,30 +1,50 @@
 repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.0.1
+  - repo: local
     hooks:
-      - id: check-yaml
       - id: end-of-file-fixer
-      - id: trailing-whitespace
+        name: end-of-file-fixer
+        entry: poetry run end-of-file-fixer
+        language: system
+        types: [text]
 
-  - repo: https://github.com/psf/black
-    rev: '21.12b0'
-    hooks:
-      - id: black
-        exclude: '^(data/)'
+      - id: trailing-whitespace-fixer
+        name: trailing-whitespace-fixer
+        entry: poetry run trailing-whitespace-fixer
+        language: system
+        types: [text]
 
-  - repo: https://gitlab.com/pycqa/flake8
-    rev: '4.0.1'
-    hooks:
-      - id: flake8
-        exclude: |
-          (?x)(
-            ^data/|
-            ^\.git/|
-            ^__pycache__|
-          )
+      - id: check-yaml
+        name: check-yaml
+        entry: poetry run check-yaml
+        language: system
+        types: [yaml]
 
-  - repo: https://github.com/pycqa/isort
-    rev: 5.9.1
-    hooks:
-      - id: isort
-        args: ['--profile', 'black', '--extend-skip', 'data/', '--src-path', 'pste']
+      - id: check-toml
+        name: check-toml
+        entry: poetry run check-toml
+        language: system
+        types: [toml]
+
+      - id: check-shebang-scripts-are-executable
+        name: check-shebang-scripts-are-executable
+        entry: poetry run check-shebang-scripts-are-executable
+        language: system
+        types: [text]
+
+      - id: shellcheck
+        name: shellcheck
+        entry: shellcheck
+        language: system
+        types: [shell]
+
+      - id: ruff-check
+        name: ruff-check
+        entry: poetry run ruff check --fix
+        language: system
+        types: [python]
+
+      - id: ruff-format
+        name: ruff-format
+        entry: poetry run ruff format --force-exclude
+        language: system
+        types: [python]

Dockerfile

@@ -1,18 +1,19 @@
-ARG ARG_PYTHON_VERSION=3.9
-ARG ARG_NODE_VERSION=17
-ARG ARG_POETRY_VERSION=1.1.12
+# syntax=docker/dockerfile:1
 
-## Base
-FROM python:${ARG_PYTHON_VERSION}-slim as python-base
+ARG DEBIAN_VERSION=bookworm
+ARG PYTHON_VERSION=3.12
+ARG NODE_VERSION=20
 
+## Base
+FROM python:${PYTHON_VERSION}-slim-${DEBIAN_VERSION} as python-base
 ARG ARG_APP_USER=app
 
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=off \
     PIP_DISABLE_PIP_VERSION_CHECK=on \
     PIP_DEFAULT_TIMEOUT=100 \
-    POETRY_VERSION=$ARG_POETRY_VERSION \
+    POETRY_VERSION="" \
     POETRY_HOME="/opt/poetry" \
     POETRY_VIRTUALENVS_IN_PROJECT=true \
     POETRY_NO_INTERACTION=1 \
@@ -67,11 +68,11 @@ WORKDIR $PYSETUP_PATH
 COPY poetry.lock pyproject.toml ./
 
 # Install runtime deps - uses $POETRY_VIRTUALENVS_IN_PROJECT internally
-RUN poetry install --no-dev
+RUN poetry install --only main
 
 
 ## JS builder
-FROM node:${ARG_NODE_VERSION}-bullseye-slim as node-builder-base
+FROM node:${NODE_VERSION}-bullseye-slim as node-builder-base
 
 ENV NODE_MODULES="/opt/node"
 WORKDIR $NODE_MODULES
@@ -143,5 +144,5 @@ ENV FLASK_ENV="production"
 VOLUME ["/static", "/config", "/data"]
 EXPOSE 5000
 
-HEALTHCHECK --interval=10s --timeout=5s CMD ["/bin/healthcheck"]
+HEALTHCHECK --start-interval=1s --start-period=10s --interval=10s --timeout=5s CMD ["/docker-healthcheck.sh"]
 ENTRYPOINT ["/init"]

docker/rootfs/bin/healthcheck → docker/rootfs/docker-healthcheck.sh

@@ -1,3 +1,3 @@
 #!/bin/sh
-set -e
+set -eu
 curl -sSL "http://$GUNICORN_HOST:$GUNICORN_PORT" > /dev/null && echo "OK"