mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-01 04:00:28 +00:00
Mohd KaifandSameer6305
a4aa71ad87
* fix(ci): unblock py3.9 install matrix and raise Scorecard pinning/signing pip install semantica failed on Python 3.9 across all three OSes because spacy had no upper bound, so pip resolved spacy 3.8.16 whose thinc>=8.3.12 requirement has no cp39 wheels and no working sdist build path. Cap spacy/thinc for python_version < '3.10' to the last wheel-compatible pair. Also addresses the two OpenSSF Scorecard findings that were actually fixable in code: - Pinned-Dependencies: Dockerfile base images (node:26-alpine, python:3.13-slim) were unpinned by digest; pin both, and pin five previously-unversioned pip install calls in CI (build, safety, bandit, semgrep, jq, pip-audit). - Signed-Releases: attest-build-provenance only publishes to the GH attestations API, which Scorecard doesn't inspect. Sign dist/* with Sigstore and attach the .sigstore.json bundles as release assets. * fix(ci): correct Sigstore artifact inputs --------- Co-authored-by: Sameer6305 <sskadam6305@gmail.com>
41 lines
1.4 KiB
Docker
41 lines
1.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM node:26-alpine@sha256:2d984a15c9b54fd0aeb608b8e0d0d83529eb34d2966db27a1fb4f1edc3d298a3 AS frontend-builder
|
|
|
|
WORKDIR /app
|
|
COPY explorer/package*.json ./explorer/
|
|
WORKDIR /app/explorer
|
|
RUN npm ci
|
|
|
|
COPY explorer/ ./
|
|
RUN mkdir -p /app/semantica && npm run build
|
|
|
|
FROM python:3.13-slim@sha256:7ce4b6dfe35e55397b7cda544f8a13f191b7ae28dc5aad71fe664dbc9bc2623f AS runtime
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
FALKORDB_HOST=falkordb \
|
|
FALKORDB_PORT=6379 \
|
|
ALLOWED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000
|
|
|
|
WORKDIR /app
|
|
|
|
RUN groupadd --system semantica \
|
|
&& useradd --system --gid semantica --home-dir /app --shell /usr/sbin/nologin semantica
|
|
|
|
COPY pyproject.toml README.md LICENSE MANIFEST.in ./
|
|
COPY semantica/ ./semantica/
|
|
COPY integrations/ ./integrations/
|
|
COPY --from=frontend-builder /app/semantica/static ./semantica/static
|
|
|
|
RUN pip install --no-cache-dir ".[explorer]" \
|
|
&& chown -R semantica:semantica /app
|
|
|
|
USER semantica
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD python -c "import json, urllib.request; data=json.load(urllib.request.urlopen('http://127.0.0.1:8000/api/health', timeout=3)); raise SystemExit(0 if data.get('status') == 'ok' else 1)"
|
|
|
|
CMD ["python", "-m", "uvicorn", "semantica.explorer.app:app", "--host", "0.0.0.0", "--port", "8000"]
|