feat!: use poetry for building and update os to ubi9-minimal (#255)

Updates several subsystems:
* Python 3.11 (upgrading from 3.9)
* AlmaLinux 9 instead of CentOS 7
* Poetry instead of setuptools
* ruff instead of pylint/mypy
* helm chart for deployment

.dockerignore

@@ -0,0 +1 @@
+vuln.json

.github/ct.yaml

@@ -0,0 +1,3 @@
+target-branch: main
+charts:
+  - charts/catpage

.github/workflows/main.yaml

@@ -4,23 +4,54 @@ on:
   pull_request:
 
 jobs:
-  call-workflow:
-    uses: radiorabe/actions/.github/workflows/test-pre-commit.yaml@main
-  test:
+  pre-commit:
+    uses: radiorabe/actions/.github/workflows/[email protected]
+  python-poetry:
+    uses: radiorabe/actions/.github/workflows/[email protected]
+  helm-chart:
+    name: Test Helm Chart
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: [ '3.x', '3.9' ]
-    name: Test python ${{ matrix.python-version }}
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install
-      run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements-dev.txt
-    - name: Test
-      run: |
-        pytest --cov=app --cov-report=term --cov-fail-under=100
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Build dev image
+        run: |
+          docker build -t ghcr.io/radiorabe/catpage:latest -f Dockerfile .
+          docker save -o /tmp/catpage.tar ghcr.io/radiorabe/catpage:latest
+
+      - name: Set up Helm
+        uses: azure/[email protected]
+        with:
+          version: v3.11.0
+
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+
+      - name: Install chart-testing
+        uses: helm/[email protected]
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct --config=.github/ct.yaml list-changed)
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Run chart-testing (lint)
+        run: ct --config=.github/ct.yaml lint
+
+      - name: Create kind cluster
+        uses: helm/[email protected]
+        if: steps.list-changed.outputs.changed == 'true'
+
+      - name: Load dev image
+        run: |
+          kind load image-archive /tmp/catpage.tar --name chart-testing
+        if: steps.list-changed.outputs.changed == 'true'
+
+      - name: Run chart-testing (install)
+        run: ct --config=.github/ct.yaml install

.github/workflows/release.yaml

@@ -1,4 +1,4 @@
-name: Publish Container Images
+name: Release
 
 on:
   push:
@@ -7,68 +7,52 @@ on:
   pull_request:
 
 jobs:
-  docker:
+  release-container:
+    uses: radiorabe/actions/.github/workflows/[email protected]
+    with:
+      image: 'ghcr.io/radiorabe/catpage'
+      name: 'catpage'
+      display-name: 'Cat Page'
+      tags: 'minimal rhel9 rabe s2i python python311 catpage'
+  helm-chart:
     runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - release-container
+    permissions:
+      actions: none
+      checks: none
+      contents: none
+      deployments: none
+      issues: none
+      packages: write
+      pull-requests: none
+      repository-projects: none
+      security-events: none
+      statuses: none
+      id-token: none
     steps:
-      -
-        name: Checkout
+      - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Prepare additional Metadata
-        id: addtional_meta
-        run: |
-          echo ::set-output name=created::$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+      - name: Prepare Chart Metadata
+        id: chartmeta
+        run: echo version=${GITHUB_REF#refs/tags/v} >> $GITHUB_OUTPUT
 
-      - name: Prepare Image Metadata
-        id: meta
-        uses: docker/metadata-action@v4
+      - name: Set up Helm
+        uses: azure/[email protected]
         with:
-          images: |
-            ghcr.io/radiorabe/catpage
-          tags: |
-            type=schedule
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=sha
-          labels: |
-            name=cat-page
-            summary=${{ github.event.repository.description }}
-            url=${{ github.event.repository.html_url }}
-            vcs-ref=${{ github.sha }}
-            revision=${{ github.sha }}
-            release=${{ github.sha }}
-            build-date=${{ steps.addtional_meta.outputs.created }}
-            io.k8s.display-name=Cat Page
-            io.k8s.description=${{ github.event.repository.description }}
-            io.openshift.tags=minimal rhel8 rabe s2i python python39 catpage
-            version=1
+          version: v3.12.0
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+      - name: Package Chart
+        run: helm package --version ${{ steps.chartmeta.outputs.version }} --app-version ${{ steps.chartmeta.outputs.version }} --destination=dist charts/catpage
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v2
-        if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: |
-            ${{ steps.meta.outputs.labels }}
-            version=${{ steps.meta.outputs.version }}
+      - name: Push Chart
+        run: helm push dist/*.tgz oci://ghcr.io/radiorabe/helm

.github/workflows/semantic-release.yaml

@@ -8,15 +8,6 @@ on:
 
 jobs:
   semantic-release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Run go-semantic-release
-        id: semrel
-        uses: go-semantic-release/action@v1
-        with:
-          github-token: ${{ secrets.RABE_ITREAKTION_GITHUB_TOKEN }}
+    uses: radiorabe/actions/.github/workflows/[email protected]
+    secrets:
+      RABE_ITREAKTION_GITHUB_TOKEN: ${{ secrets.RABE_ITREAKTION_GITHUB_TOKEN }}

.gitignore

@@ -4,3 +4,4 @@ __pycache__
 /cov/
 /.coverage
 /node_modules/
+venv/

.pre-commit-config.yaml

@@ -4,7 +4,7 @@ repos:
     hooks:
       - id: pyupgrade
         args:
-          - --py39-plus
+          - --py311-plus
   - repo: local
     hooks:
       - id: black
@@ -22,3 +22,17 @@ repos:
         language: system
         entry: flake8
         types: [python]
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: ^src/api/client.js$
+      - id: end-of-file-fixer
+        exclude: ^src/api/client.js$
+      - id: check-symlinks
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: detect-aws-credentials
+        args:
+          - --allow-missing-credentials
+      - id: detect-private-key

Dockerfile

@@ -1,17 +1,24 @@
-FROM ghcr.io/radiorabe/s2i-python:1.1.0 AS build
+FROM ghcr.io/radiorabe/s2i-python:2.0.0 AS build
 
 COPY --chown=1001:0 ./ /opt/app-root/src/
 
 RUN    npm install \
-    && cp node_modules/typeface-fjalla-one/files/fjalla-one-* app/static/ \
-    && python3 setup.py bdist_wheel
+    && cp node_modules/typeface-fjalla-one/files/fjalla-one-* app/static/
 
+RUN    python -mbuild
 
-FROM ghcr.io/radiorabe/python-minimal:1.0.3 AS app
+
+FROM ghcr.io/radiorabe/python-minimal:2.0.0 AS app
 
 COPY --from=build /opt/app-root/src/dist/*.whl /tmp/dist/
 
-RUN    python3 -mpip --no-cache-dir install /tmp/dist/*.whl \
+RUN    microdnf install -y \
+         python3.11-pip \
+    && python -mpip --no-cache-dir install /tmp/dist/*.whl \
+    && microdnf remove -y \
+         python3.11-pip \
+         python3.11-setuptools \
+    && microdnf clean all \
     && rm -rf /tmp/dist/
 
 USER nobody

README.md

@@ -18,33 +18,55 @@ Overengineered intranet landing page for [Radio Bern RaBe](https://www.rabe.ch).
 
 See `python app/server.py --help` for usage message and configuration info.
 
-### Docker
+### Container
 
 ```bash
-docker run --rm -ti -p 8080:8080 radiorabe/catpage
+# using docker
+docker run --rm -ti -p 8080:8080 ghcr.io/radiorabe/catpage
+# or podman
+podman run --rm -ti -p 8080:8080 ghcr.io/radiorabe/catpage
 ```
 
 Connect to [localhost:8080](http://localhost:8080).
 
-### Docker-compose
+### Podman-compose
 
 ```bash
 cp env.example .env
 $EDITOR .env
-docker-compose up -d
+podman-compose up -d
+```
+
+### Kubernetes
+
+```bash
+helm install catpage oci://ghcr.io/radiorabe/helm/catpage --version x.y.z
 ```
 
 ## Contributing
 
 Contributions are welcome. Please keep in mind that everything here is completely overengineered.
 
+## Development
+
+### Setup
+
+```bash
+python -mvenv venv
+. ./venv/bin/activate
+
+pipx install poetry
+
+poetry install
+```
+
 ### Running tests
 
 You can run our tests with `pytest`. Please keep in mind that we expect to keep the coverage at
 100% and that this is enforced by CI.
 
 ```bash
-pytest --cov=app
+poetry run pytest
 ```
 
 ### Formating code using a pre-commit hook
@@ -54,7 +76,6 @@ this on your dev env to ensure that all the code is properly formatted and your
 
 ```bash
 pip install pre-commit
-pip install -r requirements-dev.txt -U
 pre-commit install
 ```