Add robustness, update deps and base images

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 1.5.0
+current_version = 1.6.0
 commit = False
 tag = False
 

.github/workflows/build.yml

@@ -14,15 +14,15 @@ jobs:
           grep "version = " /tmp/main_pyproject.toml >/tmp/main_version.txt
           diff /tmp/main_version.txt /tmp/version.txt && exit 1 || exit 0
 
-  test:
+  lint:
     runs-on: arc-runner-set
     permissions:
       contents: write
       pull-requests: write
       checks: write
     strategy:
       matrix:
-        python-version: ["3.11", "3.10"] # , "3.12"]
+        python-version: ["3.14"]
     env:
       PIP_INDEX_URL: https://nexus.dev.pvarki.fi/repository/python/simple
       POETRY_PYPI_MIRROR_URL: https://nexus.dev.pvarki.fi/repository/python/simple
@@ -48,9 +48,42 @@ jobs:
       - name: Do pre-commit checks (black, lint, mypy)
         run: |
           poetry run docker/pre_commit_init.sh
+
+
+  test:
+    runs-on: arc-runner-set
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: write
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.10", "3.12", "3.13", "3.14"]
+    env:
+      PIP_INDEX_URL: https://nexus.dev.pvarki.fi/repository/python/simple
+      POETRY_PYPI_MIRROR_URL: https://nexus.dev.pvarki.fi/repository/python/simple
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install poetry
+          poetry self add poetry-plugin-pypi-mirror
+          poetry install
       - name: Test with pytest
         run: |
-          poetry run py.test -v --junitxml=pytest.xml
+          poetry run py.test -v --junitxml=pytest-${{ matrix.python-version }}.xml
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@v4
         if: success() || failure() # always run even if the previous step fails

Dockerfile

@@ -0,0 +1,152 @@
+# syntax=docker/dockerfile:1.1.7-experimental
+#############################################
+# Tox testsuite for multiple python version #
+#############################################
+FROM advian/tox-base:ubuntu-noble as tox
+ARG PYTHON_VERSIONS="3.11 3.10 3.12 3.13 3.14"
+ARG POETRY_VERSION="2.2.1"
+RUN export RESOLVED_VERSIONS=`pyenv_resolve $PYTHON_VERSIONS` \
+    && poetry self update $POETRY_VERSION || pip install -U poetry==$POETRY_VERSION \
+    && pip3 install --root-user-action ignore -U tox \
+    && apt-get update \
+    && apt-get install -y \
+        git \
+    && echo RESOLVED_VERSIONS=$RESOLVED_VERSIONS \
+    && for pyver in $RESOLVED_VERSIONS; do pyenv install -s $pyver; done \
+    && pyenv global $RESOLVED_VERSIONS \
+    && true
+
+######################
+# Base builder image #
+######################
+FROM python:3.14-alpine3.24 as builder_base
+
+ENV \
+  # locale
+  LC_ALL=C.UTF-8 \
+  # python:
+  PYTHONFAULTHANDLER=1 \
+  PYTHONUNBUFFERED=1 \
+  PYTHONHASHSEED=random \
+  # pip:
+  PIP_NO_CACHE_DIR=off \
+  PIP_DISABLE_PIP_VERSION_CHECK=on \
+  PIP_DEFAULT_TIMEOUT=100 \
+  # poetry:
+  POETRY_VERSION=2.2.1
+
+
+RUN apk add --no-cache \
+        curl \
+        git \
+        bash \
+        build-base \
+        libffi-dev \
+        linux-headers \
+        openssl \
+        openssl-dev \
+        zeromq \
+        tini \
+        openssh-client \
+        cargo \
+    # githublab ssh
+    && mkdir -p -m 0700 ~/.ssh && ssh-keyscan gitlab.com github.com | sort > ~/.ssh/known_hosts \
+    # Installing `poetry` package manager:
+    && curl -sSL https://install.python-poetry.org | python3 - \
+    && echo 'export PATH="/root/.local/bin:$PATH"' >>/root/.profile \
+    && export PATH="/root/.local/bin:$PATH" \
+    && true
+
+SHELL ["/bin/bash", "-lc"]
+
+
+# Copy only requirements, to cache them in docker layer:
+WORKDIR /pysetup
+COPY ./poetry.lock ./pyproject.toml /pysetup/
+# Install basic requirements (utilizing an internal docker wheelhouse if available)
+RUN --mount=type=ssh pip3 install --root-user-action ignore wheel virtualenv \
+    && poetry self add poetry-plugin-export \
+    && poetry export -f requirements.txt --without-hashes -o /tmp/requirements.txt \
+    && pip3 wheel --wheel-dir=/tmp/wheelhouse -r /tmp/requirements.txt \
+    && virtualenv /.venv && source /.venv/bin/activate && echo 'source /.venv/bin/activate' >>/root/.profile \
+    && pip3 install --no-deps --find-links=/tmp/wheelhouse/ -r /tmp/requirements.txt \
+    && true
+
+
+####################################
+# Base stage for production builds #
+####################################
+FROM builder_base as production_build
+# Copy entrypoint script
+COPY ./docker/entrypoint.sh /docker-entrypoint.sh
+# Only files needed by production setup
+COPY ./poetry.lock ./pyproject.toml ./README.rst ./src /app/
+WORKDIR /app
+# Build the wheel package with poetry and add it to the wheelhouse
+RUN --mount=type=ssh source /.venv/bin/activate \
+    && poetry build -f wheel --no-interaction --no-ansi \
+    && cp dist/*.whl /tmp/wheelhouse \
+    && chmod a+x /docker-entrypoint.sh \
+    && true
+
+
+#########################
+# Main production build #
+#########################
+FROM python:3.14-alpine3.24 as production
+COPY --from=production_build /tmp/wheelhouse /tmp/wheelhouse
+COPY --from=production_build /docker-entrypoint.sh /docker-entrypoint.sh
+WORKDIR /app
+# Install system level deps for running the package (not devel versions for building wheels)
+# and install the wheels we built in the previous step. generate default config
+RUN --mount=type=ssh apk add --no-cache \
+        bash \
+        tini \
+    && chmod a+x /docker-entrypoint.sh \
+    && WHEELFILE=`echo /tmp/wheelhouse/multikeyjwt-*.whl` \
+    && pip3 install --root-user-action ignore --find-links=/tmp/wheelhouse/ "$WHEELFILE"[all] \
+    && rm -rf /tmp/wheelhouse/ \
+    # Do whatever else you need to
+    && true
+ENTRYPOINT ["/sbin/tini", "--", "/docker-entrypoint.sh"]
+
+
+#####################################
+# Base stage for development builds #
+#####################################
+FROM builder_base as devel_build
+# Install deps
+COPY . /app
+WORKDIR /app
+RUN --mount=type=ssh source /.venv/bin/activate \
+    && poetry install --no-interaction --no-ansi \
+    && true
+
+
+#0############
+# Run tests #
+#############
+FROM devel_build as test
+COPY . /app
+WORKDIR /app
+ENTRYPOINT ["/sbin/tini", "--", "docker/entrypoint-test.sh"]
+# Re run install to get the service itself installed
+RUN --mount=type=ssh source /.venv/bin/activate \
+    && poetry install --no-interaction --no-ansi \
+    && docker/pre_commit_init.sh \
+    && true
+
+
+###########
+# Hacking #
+###########
+FROM devel_build as devel_shell
+# Copy everything to the image
+COPY . /app
+WORKDIR /app
+RUN apk add --no-cache zsh vim \
+    && sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" \
+    && echo "source /root/.profile" >>/root/.zshrc \
+    && pip3 install --root-user-action ignore git-up \
+    && true
+ENTRYPOINT ["/bin/zsh", "-l"]