Issues/1: More work on CICD

.github/workflows/build-pipeline.yml

@@ -45,6 +45,7 @@ jobs:
       deploy_env: ${{ steps.poetry-build.outputs.deploy_env }}
       version: ${{ steps.poetry-build.outputs.the_version }}
       pyproject_name: ${{ steps.poetry-build.outputs.pyproject_name }}
+      python_dist: ${{ steps.poetry-build.outputs.pyproject_name }}-dist
     steps:
       - uses: getsentry/action-github-app-token@v3
         name: podaac cicd token
@@ -190,6 +191,7 @@ jobs:
           echo "the_version=$(poetry version | awk '{print $2}')" >> $GITHUB_OUTPUT
           echo "pyproject_name=$(poetry version | awk '{print $1}')" >> $GITHUB_OUTPUT
       - uses: actions/upload-artifact@v4
+        id: python-dist
         with:
           name: ${{ steps.poetry-build.outputs.pyproject_name }}-dist
           path: dist/*
@@ -313,28 +315,32 @@ jobs:
   publish-pypi:
     needs: [ build ]
     runs-on: ubuntu-latest
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
     if: |
       github.ref == 'refs/heads/develop' ||
       startsWith(github.ref, 'refs/heads/release') ||
       github.ref == 'refs/heads/main'
     steps:
+      - name: Download python dist
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.build.outputs.python_dist }}
+          path: ${{ github.workspace }}/dist
       - name: Publish to test.pypi.org
         id: pypi-test-publish
         if: |
           github.ref == 'refs/heads/develop' ||
           startsWith(github.ref, 'refs/heads/release')
-        env:
-          POETRY_PYPI_TOKEN_TESTPYPI: ${{secrets.POETRY_PYPI_TOKEN_TESTPYPI}}
-        run: |
-          poetry config repositories.testpypi https://test.pypi.org/legacy/
-          poetry publish -r testpypi
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
       - name: Publish to pypi.org
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: |
+          github.ref == 'refs/heads/main'
         id: pypi-publish
-        env:
-          POETRY_PYPI_TOKEN_PYPI: ${{secrets.POETRY_PYPI_TOKEN_PYPI}}
-        run: |
-          poetry publish
+        uses: pypa/gh-action-pypi-publish@release/v1
 
   publish-docker:
     needs: [ build, publish-pypi ]

docker/.dockerignore

@@ -0,0 +1,72 @@
+.travis.yaml
+.swagger-codegen-ignore
+README.md
+tox.ini
+git_push.sh
+test-requirements.txt
+setup.py
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*,cover
+.hypothesis/
+venv/
+.python-version
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+#Ipython Notebook
+.ipynb_checkpoints

docker/Dockerfile

@@ -0,0 +1,51 @@
+# Copyright 2019, by the California Institute of Technology.
+# ALL RIGHTS RESERVED. United States Government Sponsorship acknowledged.
+# Any commercial use must be negotiated with the Office of Technology
+# Transfer at the California Institute of Technology.
+#
+# This software may be subject to U.S. export control laws. By accepting
+# this software, the user agrees to comply with all applicable U.S. export
+# laws and regulations. User has the responsibility to obtain export
+# licenses, or other export authority as may be required before exporting
+# such information to foreign countries or providing access to foreign
+# persons.
+
+FROM python:3.10-slim
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
+    gcc \
+    libnetcdf-dev \
+    libhdf5-dev \
+    hdf5-helpers \
+    && pip3 install --upgrade pip \
+    && pip3 install cython \
+    && apt-get clean
+
+# Create a new user
+RUN adduser --quiet --disabled-password --shell /bin/sh --home /home/dockeruser --gecos "" --uid 1000 dockeruser
+USER dockeruser
+ENV HOME /home/dockeruser
+ENV PYTHONPATH "${PYTHONPATH}:/home/dockeruser/.local/bin"
+ENV PATH="/home/dockeruser/.local/bin:${PATH}"
+
+# The 'SOURCE' argument is what will be used in 'pip install'.
+ARG SOURCE
+
+# Set this argument if running the pip install on a local directory, so
+# the local dist files are copied into the container.
+ARG DIST_PATH
+
+USER root
+RUN mkdir -p /worker && chown dockeruser /worker
+USER dockeruser
+WORKDIR /worker
+
+COPY --chown=dockeruser $DIST_PATH $DIST_PATH
+USER dockeruser
+RUN pip3 install --no-cache-dir --force --user --index-url https://pypi.org/simple/ --extra-index-url https://test.pypi.org/simple/ $SOURCE \
+    && rm -rf $DIST_PATH
+
+COPY --chown=dockeruser ./docker/docker-entrypoint.sh docker-entrypoint.sh
+# Run the subsetter
+ENTRYPOINT ["./docker-entrypoint.sh"]

docker/Readme.md

@@ -0,0 +1,49 @@
+# net2cog Service Docker Image
+
+This directory contains the `Dockerfile` used to build the Docker image capable of running the net2cog service.
+
+## Building
+
+The docker image is setup to install the net2cog project into userspace using pip. It will look
+in both PyPi and TestPyPi indexes unless building from a local wheel file.
+
+In order to build the image the following build arguments are needed
+
+- `SOURCE` : The value of this build arg will be used in the `pip install` command to install the net2cog package 
+- `DIST_PATH` (optional): The value of this build arg should be the path (relative to the context) to the directory containing a locally built wheel file 
+
+### Building from PyPi or TestPyPi
+
+If the version of the net2cog package has already been uploaded to PyPi, all that is needed is to supply
+the `SOURCE` build argument with the package specification.  
+
+Example:
+
+```shell script
+docker build -f docker/Dockerfile --build-arg SOURCE="net2cog[harmony]==1.1.0-alpha.9" .
+```
+
+### Building from local code
+
+First build the project with Poetry.
+
+```
+poetry build
+```
+
+That will create a folder `dist/` and a wheel file that is named with the version of the software that was built. 
+
+In order to use the local wheel file, the `DIST_PATH` build arg must be provided to the `docker build` command
+and the `SOURCE` build arg should be set to the path to the wheel file.
+
+Example:
+
+```shell script
+docker build -f docker/Dockerfile --build-arg SOURCE="dist/net2cog-1.1.0a1-py3-none-any.whl[harmony]" --build-arg DIST_PATH="dist/" .
+```
+
+## Running
+
+If given no arguments, running the docker image will invoke the [Harmony service](https://github.com/nasa/harmony-service-lib-py) CLI.  
+This requires the `[harmony]` extra is installed when installing the `net2cog` package from pip (as shown in the examples above).
+

docker/docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+
+if [ "$1" = 'net2cog' ]; then
+  echo "Not implemented"
+  exit 3
+elif [ "$1" = 'net2cog_harmony' ]; then
+  exec net2cog_harmony "$@"
+else
+  exec net2cog_harmony "$@"
+fi

pyproject.toml

@@ -37,7 +37,12 @@ sphinx = "^7.0.1"
 harmony = ["harmony-service-lib"]
 
 [tool.poetry.scripts]
-netcdf_harmony = 'net2cog.netcdf_converter.netcdf_convert_harmony:main'
+net2cog_harmony = 'net2cog.netcdf_convert_harmony:main'
+net2cog = 'net2cog.netcdf_convert:main'
+
+[tool.poetry.scripts]
+l2ss_harmony = 'podaac.subsetter.subset_harmony:main'
+l2ss-py = 'podaac.subsetter.run_subsetter:main'
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]