ducoterra
d22d260b8b
All verification is complete — this pass needed no code changes. Final report: **Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)** - Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired. - No defects found; zero changes made — working tree left exactly as the task executors left it. - Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation. - Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings. - Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules. - Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted. - Next pending phase: **none** — 91 is the last phase in `todo/`.
66 lines
3.4 KiB
Docker
66 lines
3.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Brain of Reese — production image (Podman/Docker compatible).
|
|
#
|
|
# Stage 1 (frontend): minify/bundle the local frontend with esbuild.
|
|
# NO CDN — every asset is built into this image.
|
|
# Stage 2 (python): install dependencies with uv (locked).
|
|
# Stage 3 (runtime): slim, non-root, migrations + uvicorn.
|
|
|
|
# ---------- Stage 1: frontend ----------
|
|
FROM docker.io/node:22-alpine AS frontend
|
|
WORKDIR /build
|
|
# Global install: puts the pinned esbuild binary on the PATH for the build step below
|
|
# (a local `npm install` leaves it in node_modules/.bin, invisible to RUN).
|
|
RUN npm install --no-audit --no-fund -g esbuild@0.25.5
|
|
COPY frontend ./
|
|
RUN mkdir -p /out/assets \
|
|
&& esbuild ./assets/app.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/app.js \
|
|
&& esbuild ./assets/router.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/router.js \
|
|
&& esbuild ./assets/token-gate.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/token-gate.js \
|
|
&& esbuild ./assets/document.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/document.js \
|
|
&& esbuild ./assets/login.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/login.js \
|
|
&& esbuild ./assets/shared.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/shared.js \
|
|
&& esbuild ./assets/doc-edit.js --bundle --minify --format=esm --target=es2022 --outfile=/out/assets/doc-edit.js \
|
|
&& esbuild ./assets/brand.js --minify --outfile=/out/assets/brand.js \
|
|
&& esbuild ./assets/markdown.js --minify --outfile=/out/assets/markdown.js \
|
|
&& esbuild ./assets/styles.css --minify --outfile=/out/assets/styles.css \
|
|
&& cp ./assets/favicon.svg /out/assets/favicon.svg \
|
|
&& cp ./index.html ./document.html ./login.html ./shared.html ./doc-edit.html /out/
|
|
|
|
# ---------- Stage 2: python dependencies ----------
|
|
FROM docker.io/python:3.12-slim AS python
|
|
WORKDIR /app
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN uv sync --frozen --no-dev --no-cache --no-install-project
|
|
COPY app ./app
|
|
RUN uv sync --frozen --no-dev --no-cache
|
|
|
|
# ---------- Stage 3: runtime ----------
|
|
FROM docker.io/python:3.12-slim AS runtime
|
|
ENV PATH="/app/.venv/bin:$PATH" \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
BOR_STATIC_DIR=/app/static \
|
|
BOR_ENVIRONMENT=production
|
|
RUN apt update && apt install -y git
|
|
RUN useradd --create-home --uid 10001 reese
|
|
WORKDIR /app
|
|
COPY --from=python /app/.venv /app/.venv
|
|
COPY --from=python /app/app /app/app
|
|
# app/api/sync.py (phase 32) imports scripts.git_sync / scripts.import_docs
|
|
# at module level — the scripts package must ship in the image or the
|
|
# container crashes on boot (phase 33: ModuleNotFoundError: No module
|
|
# named 'scripts').
|
|
COPY scripts ./scripts
|
|
COPY --from=frontend /out /app/static
|
|
COPY alembic ./alembic
|
|
COPY alembic.ini ./alembic.ini
|
|
COPY scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/entrypoint.sh && chown -R reese:reese /app
|
|
USER reese
|
|
EXPOSE 8000
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 \
|
|
CMD ["python", "-c", "import sys, httpx; sys.exit(0 if httpx.get('http://127.0.0.1:8000/api/health', timeout=4).status_code == 200 else 1)"]
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|