Docker CI (#7)

* added dockerfiles for dev, staging and prod envs

* added ci script for building and publishing docker images

* updated Dockerfile.dev

* used commit SHAs for actions and correct docker files to build

* updated dependencies

* updated authors

* updated documentation regarding univcorn port

.dockerignore

@@ -0,0 +1,152 @@
+# LINT.IfChange
+# Byte-compiled / optimized / DLL files
+__pycache__/
+**/*.py[cod]
+**/*$py.class
+
+# C extensions
+**/*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Pip package build symlinks for "tfx" / "ml-pipelines-sdk"
+package_build/*/README*.md
+package_build/*/build
+package_build/*/dist
+package_build/*/setup.py
+package_build/*/tfx
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don’t work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# celery beat schedule file
+celerybeat-schedule
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# Intellij project settings
+.idea
+
+# VSCode project settings
+.vscode
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# Bazel generated files
+bazel-*
+**/*_pb2.py
+**/*_pb2_grpc.py
+# LINT.ThenChange(.gitignore)
+
+# Github integration settings
+.github
+
+# .dockerignore, Dockerfile and builder script themselves are not needed by
+# docker build.
+.dockerignore
+tfx/tools/docker/Dockerfile*
+tfx/tools/docker/build_docker_image.sh

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: Build and Publish Docker Images
+
+on:
+  push:
+    branches: [main, staging, dev]
+  pull_request:
+    branches: [main, staging, dev]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  # if branch is main, use prod, else staging or dev as necessary
+  BUILD_NAME: ${{ github.ref == 'refs/heads/main' && 'prod' || github.ref == 'refs/heads/staging' && 'staging' || 'dev' }}
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+
+      - name: Echo GITHUB_ENV
+        run: |
+          echo $GITHUB_ENV
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Login into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@9dc751fe249ad99385a2583ee0d084c400eee04e
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          labels: |
+            org.opencontainers.image.description=Slick Telemetry backend ${{ env.BUILD_NAME }} image
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
+        with:
+          context: .
+          file: ./Dockerfile.${{ env.BUILD_NAME }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/codeql.yml

@@ -13,9 +13,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: ["main"]
+    branches: [main, staging, dev]
   pull_request:
-    branches: ["main"]
+    branches: [main, staging, dev]
   schedule:
     - cron: "26 3 * * 6"
 
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/tests.yml

@@ -2,29 +2,29 @@ name: Run Tests
 
 on:
   push:
-    branches: [ main ]
+    branches: [main, staging, dev]
   pull_request:
-    branches: [ main ]
+    branches: [main, staging, dev]
 
 jobs:
   test:
     name: 📊 PyTest
     runs-on: ubuntu-latest
     steps:
-    - name: ⬇️ Checkout repo
-      uses: actions/checkout@v4
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
-    - name: Install poetry
-      run: pipx install poetry
+      - name: Install poetry
+        run: pipx install poetry
 
-    - name: 🐍 Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: 3.12
-        cache: 'poetry'
+      - name: 🐍 Set up Python
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
+        with:
+          python-version: 3.12
+          cache: "poetry"
 
-    - name: Install dependencies
-      run: poetry install --no-root
+      - name: Install dependencies
+        run: poetry install --no-root
 
-    - name: 📊 Run tests
-      run: poetry run pytest
+      - name: 📊 Run tests
+        run: poetry run pytest

.vscode/extensions.json

@@ -2,15 +2,16 @@
   "recommendations": [
     "aaron-bond.better-comments",
     "ms-python.black-formatter",
-    "christian-kohler.path-intellisense",
-    "Gruntfuggly.todo-tree",
-    "naumovs.color-highlight",
+    "ms-vscode-remote.remote-containers",
+    "ms-azuretools.vscode-docker",
+    "tamasfe.even-better-toml",
     "kisstkondoros.vscode-gutter-preview",
     "ms-python.isort",
     "yzhang.markdown-all-in-one",
-    "ms-python.black-formatter",
-    "tamasfe.even-better-toml",
+    "christian-kohler.path-intellisense",
+    "esbenp.prettier-vscode",
+    "ms-python.vscode-pylance",
     "ms-python.python",
-    "ms-python.vscode-pylance"
+    "Gruntfuggly.todo-tree"
   ]
 }

Dockerfile.dev

@@ -0,0 +1,31 @@
+FROM python:3.12.1-slim
+
+# Set the working directory to /code.
+WORKDIR /code
+
+# Copy the current directory to the /code directory.
+COPY . /code
+
+# Install gcc and other dependencies
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Poetry
+RUN pip install --no-cache-dir poetry
+
+# Use Poetry to install dependencies
+RUN poetry config virtualenvs.create false \
+    && poetry install --no-interaction --no-ansi
+
+# Make port 80 available to the world outside this container
+EXPOSE 80
+
+# Healthcheck
+HEALTHCHECK --interval=5m --timeout=3s \
+    CMD curl -f http://localhost/health || exit 1
+
+# Run the uvicorn command, telling it to use the app object imported from app.main.
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "80", "--reload"]
+
+# CMD ["uvicorn", "app.main:app", "--proxy-headers", "--host", "0.0.0.0", "--port", "80" "--reload"]

Dockerfile.prod

@@ -0,0 +1,49 @@
+# https://fastapi.tiangolo.com/deployment/docker/#docker-image-with-poetry
+
+# First stage
+FROM python:3.12.1-slim as requirements-stage
+
+# Set /tmp as the current working directory.
+WORKDIR /tmp
+
+# Install Poetry
+RUN pip install poetry
+
+# Copy the pyproject.toml and poetry.lock files to the /tmp directory.
+COPY ./pyproject.toml ./poetry.lock* /tmp/
+
+# Generate the requirements.txt file.
+RUN poetry export -f requirements.txt --output requirements.txt --without-hashes
+
+# This is the final stage, anything here will be preserved in the final container image.
+FROM python:3.12.1-slim
+
+# Install gcc and other dependencies
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+# Set the current working directory to /code.
+WORKDIR /code
+
+# Copy the requirements.txt file to the /code directory.
+# This file only lives in the previous Docker stage, that's why we use --from-requirements-stage to copy it.
+COPY --from=requirements-stage /tmp/requirements.txt /code/requirements.txt
+
+# Install the package dependencies in the generated requirements.txt file.
+RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
+
+# Copy the app directory to the /code directory.
+COPY ./app /code/app
+
+# Make port 80 available to the world outside this container
+EXPOSE 80
+
+# Healthcheck
+HEALTHCHECK --interval=5m --timeout=3s \
+    CMD curl -f http://localhost/health || exit 1
+
+# Run the uvicorn command, telling it to use the app object imported from app.main.
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "80"]
+
+# CMD ["uvicorn", "app.main:app", "--proxy-headers", "--host", "0.0.0.0", "--port", "80"]