fix(docker): revert runtime base image to python:3.13-slim

#1290 bumped the runtime stage to python:3.14-slim. gensim is a base
(non-extras-gated) dependency and publishes no cp314 wheel on PyPI, so
pip falls back to building it from source, which needs a C compiler
this slim image doesn't carry:

  error: [Errno 2] No such file or directory: 'gcc'

This has broken the Docker build (and Container Security Scan) on
every push to main since #1290 merged. Confirmed via
`pip index versions gensim` / the PyPI files listing that gensim 4.4.0
ships cp313 wheels but no cp314 ones; the earlier lockfile fix in
#1290 only validated that `uv pip compile` could *resolve* dependencies
for 3.14, which reads sdist metadata and doesn't need a compiler --
it doesn't validate that `pip install` can actually *build* them,
which is what fails here.

Reverts to the exact base image digest that was building successfully
before #1290 and regenerates explorer-extra-py313.txt against today's
PyPI state. Once gensim (and anything else pulled in transitively)
ships cp314 wheels, the 3.14 bump can be retried.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.dockerignore

@@ -19,7 +19,7 @@
 .github
 .github/**
 !.github/requirements/
-!.github/requirements/explorer-extra-py314.txt
+!.github/requirements/explorer-extra-py313.txt
 !.github/requirements/pep517-build.txt
 .claude
 .claude/**

.github/requirements/README.md

@@ -8,7 +8,7 @@ These exist because OpenSSF Scorecard's Pinned-Dependencies check flags any
 the project's own local-source install.
 
 Each `.txt` was generated from the adjacent `.in` (or, for `explorer-extra-py311.txt`,
-`explorer-extra-py314.txt`, and `base-deps.txt`, from `pyproject.toml` directly) with:
+`explorer-extra-py313.txt`, and `base-deps.txt`, from `pyproject.toml` directly) with:
 
 ```
 uv pip compile <input> --python-version 3.11 --python-platform linux \
@@ -29,7 +29,7 @@ each file's own autogenerated header comment for its exact command).
 | `bootstrap.txt` | security-scan.yml, benchmark.yml | pip, setuptools (upgrade before anything else) |
 | `pep517-build.txt` | ci.yml, benchmark.yml, Dockerfile | exact `[build-system] requires` from `pyproject.toml` (setuptools, wheel) - installed with `--no-build-isolation` before any `pip install -e .` / `pip install .`, since `--no-deps` alone doesn't stop pip's PEP 517 build isolation from fetching those two *unhashed* |
 | `explorer-extra-py311.txt` | ci.yml | semantica's base deps + the `explorer` extra, resolved for python 3.11 |
-| `explorer-extra-py314.txt` | Dockerfile | the same, resolved for python 3.14 (the image's actual interpreter) |
+| `explorer-extra-py313.txt` | Dockerfile | the same, resolved for python 3.13 (the image's actual interpreter) |
 | `pytest-tool.txt` | ci.yml | pytest, for the pre-all-extras deterministic test |
 | `uv-tool.txt` | ci.yml | uv, to verify requirements-ci.txt is current |
 | `build-tools.txt` | ci.yml, release.yml | build, wheel |
@@ -39,19 +39,19 @@ each file's own autogenerated header comment for its exact command).
 | `base-deps.txt` | benchmark.yml | semantica's base deps (no extras) |
 | `benchmark-extra.txt` | benchmark.yml | the benchmark-only libs (neo4j, pdfplumber, etc.) |
 
-`explorer-extra-py311.txt` and `explorer-extra-py314.txt` are large (they
-mirror most of `requirements-ci.txt`) because semantica's `dependencies`
-list in `pyproject.toml` isn't extras-gated - installing the package at all
-pulls the full base set. That's expected, not a mistake.
+`explorer-extra-py31{1,3}.txt` and `base-deps.txt` are large (they mirror
+most of `requirements-ci.txt`) because semantica's `dependencies` list in
+`pyproject.toml` isn't extras-gated - installing the package at all pulls
+the full base set. That's expected, not a mistake.
 
-`explorer-extra-py311.txt` and `explorer-extra-py314.txt` are **not**
+`explorer-extra-py311.txt` and `explorer-extra-py313.txt` are **not**
 interchangeable, and can't be collapsed into one file compiled for either
 version: `librosa`'s `audioread` dependency needs `standard-aifc` /
 `standard-sunau` only under `python_version >= "3.13"` (Python 3.13 dropped
 `aifc`/`sunau` from stdlib). A file resolved for 3.11 simply omits those
-packages' hashes, so installing it with `--require-hashes` on a real 3.14
+packages' hashes, so installing it with `--require-hashes` on a real 3.13
 interpreter (the Dockerfile's base image) fails outright rather than
-silently under-pinning. Any other file shared across a 3.11 and 3.14
+silently under-pinning. Any other file shared across a 3.11 and 3.13
 consumer would need the same split if it hits a similar stdlib-removal
 edge case - check for `ERROR: In --require-hashes mode, all requirements
 must have their versions pinned` on the *other* Python version before

.github/requirements/explorer-extra-py313.txt

@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml --extra explorer --python-version 3.14 --python-platform linux --generate-hashes --constraint requirements-ci.txt -o .github/requirements/explorer-extra-py314.txt
+#    uv pip compile pyproject.toml --extra explorer --python-version 3.13 --python-platform linux --generate-hashes --constraint requirements-ci.txt -o .github/requirements/explorer-extra-py313.txt
 annotated-doc==0.0.5 \
     --hash=sha256:117bac03a25ede5df5440e855b32d556049ca169ead221505badf432fed4b101 \
     --hash=sha256:c7e58ce09192557605d8bbd92836d7e1d520ac9580096042c0bfd197efacf1bb

.github/workflows/ci.yml

@@ -112,8 +112,8 @@ jobs:
           # `uv pip compile pyproject.toml --extra explorer --python-version 3.11 --constraint requirements-ci.txt --generate-hashes`
           # - regenerate it the same way if pyproject.toml's base/explorer
           # deps change. Resolved specifically for this job's python 3.11
-          # (see the Dockerfile's explorer-extra-py314.txt for why this
-          # can't be shared with python 3.14: audioread needs extra
+          # (see the Dockerfile's explorer-extra-py313.txt for why this
+          # can't be shared with python 3.13: audioread needs extra
           # standard-aifc/standard-sunau hashes only on 3.13+).
           #
           # --no-deps only skips *runtime* dependency resolution - `-e .`

.github/workflows/container-scan.yml

@@ -12,7 +12,7 @@ on:
       - 'README.md'
       - 'LICENSE'
       - 'MANIFEST.in'
-      - '.github/requirements/explorer-extra-py314.txt'
+      - '.github/requirements/explorer-extra-py313.txt'
       - '.github/requirements/pep517-build.txt'
       - 'semantica/**'
       - 'integrations/**'

Dockerfile

@@ -20,7 +20,18 @@ RUN mkdir -p /app/semantica && npm run build
 # .github/dependabot.yml opens a PR bumping the digest pin above. Also: this
 # image only serves plain HTTP via uvicorn and never opens a QUIC listener,
 # so the bug isn't reachable here regardless.
-FROM python:3.14-slim@sha256:cae66f2ef0ec51a9891263eeee7f987dacf0a9879e8aa9353d5606e0530619a5 AS runtime
+#
+# Pinned to 3.13, NOT 3.14: #1290 bumped this to python:3.14-slim and broke
+# the build outright (Container Security Scan, every run since) - gensim
+# (a base, non-extras-gated dependency) ships no cp314 wheel on PyPI yet, so
+# pip falls back to building it from source, which needs a C compiler this
+# slim image doesn't carry ("error: [Errno 2] No such file or directory:
+# 'gcc'"). Revisit the 3.14 bump once gensim (and anything else pulled in
+# transitively) publishes cp314 wheels - check with
+# `pip index versions gensim` / the project's PyPI files page, not just
+# whether `uv pip compile` resolves (resolution only reads sdist metadata,
+# it doesn't attempt the build that fails here).
+FROM python:3.13-slim@sha256:7ce4b6dfe35e55397b7cda544f8a13f191b7ae28dc5aad71fe664dbc9bc2623f AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -34,18 +45,18 @@ RUN groupadd --system semantica \
     && useradd --system --gid semantica --home-dir /app --shell /usr/sbin/nologin semantica
 
 COPY pyproject.toml README.md LICENSE MANIFEST.in \
-     .github/requirements/explorer-extra-py314.txt .github/requirements/pep517-build.txt ./
+     .github/requirements/explorer-extra-py313.txt .github/requirements/pep517-build.txt ./
 COPY semantica/ ./semantica/
 COPY integrations/ ./integrations/
 COPY --from=frontend-builder /app/semantica/static ./semantica/static
 
-# explorer-extra-py314.txt is `uv pip compile pyproject.toml --extra explorer
-# --python-version 3.14 --constraint requirements-ci.txt --generate-hashes`
+# explorer-extra-py313.txt is `uv pip compile pyproject.toml --extra explorer
+# --python-version 3.13 --constraint requirements-ci.txt --generate-hashes`
 # (see ci.yml's explorer-extra-py311.txt for the CI counterpart, resolved
 # for CI's python 3.11 instead - the two aren't interchangeable: audioread
 # (via librosa) needs standard-aifc/standard-sunau only on python>=3.13,
 # since aifc/sunau left stdlib there, so a 3.11-resolved lockfile is
-# missing hashes pip needs on this image's actual 3.14 interpreter and
+# missing hashes pip needs on this image's actual 3.13 interpreter and
 # --require-hashes fails outright rather than silently under-pinning).
 # Every fetched package is hash-verified (Scorecard Pinned-Dependencies)
 # and pinned to the same versions CI audited, e.g. msgpack==1.2.1 and
@@ -59,9 +70,9 @@ COPY --from=frontend-builder /app/semantica/static ./semantica/static
 # build-system.requires; installing it first and passing
 # --no-build-isolation makes pip reuse those hash-verified copies instead
 # of fetching its own.
-RUN pip install --no-cache-dir -r explorer-extra-py314.txt -r pep517-build.txt --require-hashes \
+RUN pip install --no-cache-dir -r explorer-extra-py313.txt -r pep517-build.txt --require-hashes \
     && pip install --no-cache-dir --no-deps --no-build-isolation . \
-    && rm -f explorer-extra-py314.txt pep517-build.txt \
+    && rm -f explorer-extra-py313.txt pep517-build.txt \
     && chown -R semantica:semantica /app
 
 USER semantica