Merge pull request #3 from FrancescoSaverioZuppichini/dev

Dev

Author: FrancescoSaverioZuppichini

.github/workflows/build.yml

@@ -0,0 +1,61 @@
+#
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a change is pushed to the branch called `release` or a new release is created.
+on:
+  release:
+    types: [published]
+  push:
+    branches: ["release"]
+
+# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      #
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/publish.yml

@@ -4,7 +4,7 @@ on:
     branches:
       - main
 jobs:
-  build:
+  build-format-and-publish-to-pypi:
     runs-on: ubuntu-latest
 
     steps:
@@ -28,5 +28,4 @@ jobs:
       - name: 🚀 Publish
         run: |
           uv build
-
           uv publish --token ${{ secrets.UV_PUBLISH_TOKEN }}

.github/workflows/test.yml

@@ -4,7 +4,7 @@ on:
     branches: [main, dev]
 
 jobs:
-  build:
+  build-lint-format-and-test:
     runs-on: ubuntu-latest
 
     steps:

Dockerfile

@@ -0,0 +1,39 @@
+# Build stage
+FROM python:3.12-slim AS builder
+
+# Update image
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+# Install uv
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+# Set working directory
+WORKDIR /app
+
+# Install the project without the the source code (only dependencies)  
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync --frozen --no-install-project --no-dev --compile-bytecode
+
+# Install the project's source packages
+ADD .python-version pyproject.toml uv.lock src/ /app/
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install --compile-bytecode .
+
+# Use alpine for the final image to reduce the total size
+FROM python:3.12-alpine
+
+# Copy the installed environment from builder
+COPY --from=builder --chown=app:app /app /app
+
+# Set working directory
+WORKDIR /app
+
+# Configure PATH for executables, packages are in the /app/.venv folder
+ENV PATH="/app/.venv/bin:$PATH"
+
+# Run command
+CMD ["make_me_laugh"]

README.md

@@ -6,7 +6,7 @@ Features:
 - [x] 💅 [`ruff`](https://docs.astral.sh/ruff/) for linting and formatting
 - [x] 🧪 [`pytest`](https://docs.pytest.org/en/stable/) 
 - [x] 🧹 [`Makefile`](Makefile) with code quality checks
-- [ ] 🐳 Optimized Docker Image
+- [x] 🐳 CI/CD Optimized Docker Image runs when a new *release* is created pushing to gh registry
 - [x] 🦾 GitHub actions:
     - [x] auto publish to [`pypi`](https://pypi.org/) on push on `main`
     - [ ] auto creating a new tag on push on `main`, sync versions
@@ -67,4 +67,19 @@ ruff format
 Tests inside `/tests` are run using [`pytest`](https://docs.pytest.org/en/stable/) on PR both on `dev` and `main`
 
 ### Publish Package
- In order to publish to [pypi](https://pypi.org/) you need to create a secret called `UV_PUBLISH_TOKEN` with your [pypi access token](https://pypi.org/manage/account/) under **API tokens**.
+ In order to publish to [pypi](https://pypi.org/) you need to create a secret called `UV_PUBLISH_TOKEN` with your [pypi access token](https://pypi.org/manage/account/) under **API tokens**.
+
+
+### Docker
+[`Dockerfile`](Dockerfile) contains a multi stage build that uses `--compile-bytecode` to compite your package. For this example, the resulting image is just
+
+```bash
+docker build -t python-template .
+```
+
+```
+REPOSITORY        TAG       IMAGE ID       CREATED          SIZE
+python-template   latest    1ded7d260b1c   58 seconds ago   55.4MB
+```
+
+The image is build using the [`build`](.github/workflows/build.yml) workflow when a new *relaese* is created