@leverege/build-tools 2.59.2 → 2.61.0-alpha.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.59.2",
+  "version": "2.61.0-alpha.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -81,6 +81,7 @@
     "readline-sync": "^1.4.10",
     "semver": "^7.6.3",
     "simple-git": "^3.27.0",
+    "toml": "^3.0.0",
     "zx": "^8.3.0"
   },
   "devDependencies": {

package/src/Docker.mjs

@@ -1,4 +1,6 @@
 import fs from 'node:fs'
+import path from 'node:path'
+import url from 'node:url'
 
 import chalk from 'chalk'
 import handlebars from 'handlebars'
@@ -13,6 +15,8 @@ import {
   warning
 } from './Utils.mjs'
 
+const DIRNAME = path.dirname( url.fileURLToPath( import.meta.url ) )
+
 // TODO: change default to node 22 (jod) after 01/01/25
 const dockerfileNodeVersion = 'jod-alpine'
 
@@ -20,74 +24,6 @@ const dockerfileNodeVersion = 'jod-alpine'
 // the build-tools repository, but it just became simpler to pull the contents
 // directly into these variables and forego the file loading.
 //
-const dockerfileTemplate = `
-# Version {{regvers}} @ {{date}}
-#
-# The FROM directive sets the Base Image for subsequent instructions
-FROM node:{{nodeimage}} as intermediate
-ENV NODE_ENV production
-ENV NPM_CONFIG_USERCONFIG /usr/src/app/.npmrc
-
-RUN mkdir -p /usr/src/app
-WORKDIR /usr/src/app
-
-# Install app dependencies
-COPY ./workspace/ /usr/src/app/
-ENV GRPC_VERBOSITY ERROR
-
-# --------------------------------------------------------------
-# copy the ssh keys into place, npm install, and remove them
-# --------------------------------------------------------------
-
-# Install packages to install private repos with ssh keys
-COPY ./.npmrc \${NPM_CONFIG_USERCONFIG}
-RUN apk --no-cache add openssh-client && \
-    apk --update add --no-cache --virtual build-dep g++ gcc libgcc \\
-      libstdc++ linux-headers make {{apkadds}} && \
-    npm install -g {{npmVersion}}
-
-{{preInstallPluginfile}}
-
-# Use SKIP_PREPARE to disable hook-and-release from running
-ENV SKIP_PREPARE=true
-
-# Do the clean install and remove the npm token and ssh keys from the image
-RUN npm ci --only=production --no-optional {{npmlogging}} && \
-    rm -f \${NPM_CONFIG_USERCONFIG} /root/.ssh/*
-
-# --------------------------------------------------------------
-# Docker Final Stage
-# --------------------------------------------------------------
-
-FROM node:{{nodeimage}}
-ENV NPM_CONFIG_USERCONFIG /usr/src/app/.npmrc
-
-# Copy .npmrc for private registry access for access to any @leverege packages
-COPY ./.npmrc \${NPM_CONFIG_USERCONFIG}
-
-# Install tini for PID 1 and replace shell with bash so we can source files
-RUN apk update && \
-    apk add --no-cache bash curl tini vim {{apkadds}} && \
-    npm install -g {{npmVersion}} && \
-    rm /bin/sh && ln -s /bin/bash /bin/sh && \
-    mkdir -p /usr/src/app /tmp/levlog && \
-    chown node:node /usr/src/app
-
-# Pull in the Dockerfile.plugin file here
-{{pluginfile}}
-
-# Eliminate the sensitive info from the final stage image
-RUN rm -f \${NPM_CONFIG_USERCONFIG}
-
-ENTRYPOINT [ "/sbin/tini", "--" ]
-WORKDIR /usr/src/app
-
-COPY --chown=node:node --from=intermediate /usr/src/app /usr/src/app
-
-USER {{runuser}}
-COPY ./bashrc /home/node/.bashrc
-CMD [ "/bin/bash", "-c", "source /home/node/.bashrc && node index.js" ]`
-
 const pluginTemplate = `
 # Dockerfile.plugin - optionally extend the service Docker image
 #
@@ -103,72 +39,15 @@ const pluginTemplate = `
 # footprints small, so adding packages "just because" is not considered
 # a best practice.
 `
-
-const bashrcTemplate = `#!/bin/bash
-#
-alias h=history
-
-alias ls='ls -CF --color=auto'
-alias ll='ls -lh'
-alias lla='ls -lha'
-alias glep='grep -l -s'
-alias m=less
-alias menv='env | sort | less'
-
-alias whatsmyip='wget -qO- ifconfig.co'
-
-alias err='wget -q -O- localhost:5111/logLevel/error'
-alias wrn='wget -q -O- localhost:5111/logLevel/warn'
-alias inf='wget -q -O- localhost:5111/logLevel/info'
-alias dbg='wget -q -O- localhost:5111/logLevel/debug'
-alias trc='wget -q -O- localhost:5111/logLevel/trace'
-
-socks()
-{
-  netstat -ant | awk '{print }' | sort | uniq -c | sort -n
-}
-
-cmetrics()
-{
-  wget -qO- localhost:5111/metrics
-}
-
-cmstat()
-{
-  wget -qO- localhost:5111
-}
-
-cmclear()
-{
-  # Future me - thinking this should call cmstat and pass in the endpoint as
-  # a parameter? Well don't do it - without escaping the dollar 1 in cmstat
-  # the port will end up being 51111, and escaping causes linting to complain
-  # about unnecessary escaping.
-  wget -qO- localhost:5111/status/clear
-}
-
-dunm() {
-  du -sh /usr/src/app/node_modules/* | sort -sh
-}
-`
-const cloudBuildSteps = `
-steps:
-  - name: 'gcr.io/cloud-builders/docker'
-    args:
-      - 'build' 
-      - '--network=cloudbuild'
-      - '-t'
-      - '{{imageName}}:{{imageVersion}}'
-      - '.'
-    
-images:
-  - '{{imageName}}:{{imageVersion}}'
-`
+const dockerfileTemplate = fs.readFileSync( path.join( DIRNAME, './templates/dockerfileTemplate.hbs' ), 'utf8' )
+const bashrcTemplate = fs.readFileSync( path.join( DIRNAME, './templates/bashrcTemplate.hbs' ), 'utf8' )
+const cloudBuildSteps = fs.readFileSync( path.join( DIRNAME, './templates/cloudBuildSteps.hbs' ), 'utf8' )
 
 const defaultSettings = {
   apkadds : '',
   date : getDateTimestamp(),
   nodeimage : 'jod-alpine',
+  imageBase : 'node:jod-alpine',
   npmlogging : process.env.VERBOSE_NPM_LOGGING ? '--ddd' : '--silent',
   npmVersion : 'npm@11',
   pluginfile : '# NO PLUGIN',
@@ -196,7 +75,7 @@ const generateDockerfile = ( options ) => {
   if ( !settings.nodeimage ) {
     settings.nodeimage = dockerfileNodeVersion
   }
-
+  settings.image = settings.imageBase || `node:${settings.nodeimage}`
   // Ensure the presence of the docker dir with plugin and bashrc - this code
   // could probably be tightened up a little.
   try {
@@ -207,7 +86,9 @@ const generateDockerfile = ( options ) => {
   }
 
   const bashrcFile = './docker/bashrc'
-  if ( !fs.existsSync( bashrcFile ) ) {
+  // DISABLING exists check. With addition of Bashrc.plugin, the file needs to
+  // always be created or we encounter errors
+  if ( true ) { // !fs.existsSync( bashrcFile ) ) {
     let bf = bashrcTemplate
     const bashrcFilePlugin = './docker/Bashrc.plugin'
     if ( fs.existsSync( bashrcFilePlugin ) ) {

package/src/DockerPy.mjs

@@ -0,0 +1,257 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import url from 'node:url'
+
+import chalk from 'chalk'
+import handlebars from 'handlebars'
+
+import {
+  errorExit,
+  getDateTimestamp,
+  getGcpAccount,
+  log,
+  proceed,
+  shellCmd,
+  warning
+} from './Utils.mjs'
+
+const DIRNAME = path.dirname( url.fileURLToPath( import.meta.url ) )
+
+// The contents of these variables were initially located in files that live in
+// the build-tools repository, but it just became simpler to pull the contents
+// directly into these variables and forego the file loading.
+//
+const pluginTemplate = `
+# Dockerfile.plugin - optionally extend the service Docker image
+#
+# This file may be used to run additional docker commands during the image
+# build process without needing to maintain a local custom Dockerfile. For
+# example, uncommenting the following docker RUN command will cause the
+# curl and vim packages to be added to the deployed image thus making them
+# available from the pod's command line on k8s:
+#
+# RUN apk update && apk add --no-cache curl vim
+#
+# Keep in mind that the Alpine Linux base image is used to keep image
+# footprints small, so adding packages "just because" is not considered
+# a best practice.
+`
+const dockerfileTemplate = fs.readFileSync( path.join( DIRNAME, './templates/dockerfileTemplatePy.hbs' ), 'utf8' )
+const cloudBuildSteps = fs.readFileSync( path.join( DIRNAME, './templates/cloudBuildSteps.hbs' ), 'utf8' )
+let bashrcTemplate = fs.readFileSync( path.join( DIRNAME, './templates/bashrcTemplate.hbs' ), 'utf8' )
+const bashrcPyTemplate = fs.readFileSync( path.join( DIRNAME, './templates/bashrcTemplatePy.hbs' ), 'utf8' )
+bashrcTemplate = `${bashrcTemplate}\n${bashrcPyTemplate}`
+
+const defaultSettings = {
+  apkadds : '',
+  date : getDateTimestamp(),
+  nodeimage : 'jod-alpine',
+  imageBase : 'node:jod-alpine',
+  npmlogging : process.env.VERBOSE_NPM_LOGGING ? '--ddd' : '--silent',
+  npmVersion : 'npm@11',
+  pluginfile : '# NO PLUGIN',
+  preInstallPluginfile : '# NO PRE-INSTALL PLUGIN',
+  regvers : 'package.version',
+  runuser : 'python',
+}
+
+const previousFile = './docker/.previous'
+
+function getPreviousBuild() {
+  return fs.existsSync( previousFile ) ? fs.readFileSync( previousFile ) : 'FIRST BUILD'
+}
+
+const setPreviousBuild = ( version ) => {
+  fs.writeFileSync( previousFile, version )
+}
+
+function generateDockerfile( options ) {
+
+  const settings = { ...defaultSettings, ...options }
+
+  if ( !settings.imageBase ) {
+    warning( 'using the default image python:3.12.8-slim-bookworm' )
+    settings.image = 'python:3.12.8-slim-bookworm'
+  } else {
+    settings.image = settings.imageBase
+  }
+  // Ensure the presence of the docker dir with plugin and bashrc - this code
+  // could probably be tightened up a little.
+  try {
+    fs.readdirSync( './docker' )
+  } catch ( err ) {
+    warning( 'creating the missing ./docker directory' )
+    fs.mkdirSync( './docker' ) // TODO: blindly assumes the mkdir succeeds
+  }
+
+  const bashrcFile = './docker/bashrc'
+  let bf = bashrcTemplate
+  const bashrcFilePlugin = './docker/Bashrc.plugin'
+  if ( fs.existsSync( bashrcFilePlugin ) ) {
+    const bashrcAdditions = fs.readFileSync( bashrcFilePlugin )
+    bf = `${bf}\n${bashrcAdditions}`
+  }
+  fs.writeFileSync( bashrcFile, bf )
+
+  const dockerfilePlugin = './docker/Dockerfile.plugin'
+  if ( !fs.existsSync( dockerfilePlugin ) ) {
+    warning( `creating the missing ${dockerfilePlugin} file in the docker directory` )
+    fs.writeFileSync( dockerfilePlugin, pluginTemplate )
+  }
+
+  try {
+    const build = fs.readdirSync( './build' )
+    if ( build.length === 0 ) {
+      errorExit( `***ERROR: the build dir is empty - ${chalk.yellow( 'npm run build' )}` )
+    }
+  } catch ( err ) {
+    errorExit( `***ERROR: expected the ./build directory to exist - ${chalk.yellow( 'npm run build' )}` )
+  }
+
+  // At this point the plugin template better exist.
+  if ( fs.existsSync( dockerfilePlugin ) ) {
+    settings.pluginfile = fs.readFileSync( dockerfilePlugin )
+  } else {
+    errorExit( `***ERROR: something went wrong with ${dockerfilePlugin} plugin creation` )
+  }
+
+  const dockerfilePrePlugin = './docker/DockerfilePreInstall.plugin'
+  if ( fs.existsSync( dockerfilePrePlugin ) ) {
+    settings.preInstallPluginfile = fs.readFileSync( dockerfilePrePlugin )
+  }
+
+  const compiled = handlebars.compile( dockerfileTemplate, { noEscape : true } )
+  const replaced = compiled( settings )
+  // temporarily write the Dockerfile to the docker subdir - the container
+  // image builder will then move it over to the build subdir
+  const dockerfile = './docker/Dockerfile'
+  try {
+    fs.writeFileSync( dockerfile, replaced )
+  } catch ( err ) {
+    errorExit( `***ERROR: failed to write ${dockerfile}\n${err}` )
+  }
+
+  const previousBuild = getPreviousBuild()
+  const dockerInfo = { dockerfile, previousBuild, ...settings }
+  delete dockerInfo.pluginfile
+  return dockerInfo
+}
+
+function formCloudBuildBucketName( artifactProject ) {
+  return `gs://${artifactProject}_cloudbuild`
+}
+
+async function validateCloudBuildBucket( artifactProject ) {
+  const bucketName = formCloudBuildBucketName( artifactProject )
+  log( chalk.green.bold( `Verifying the build bucket exists => ${bucketName}\n` ) )
+  try {
+    await shellCmd( `gsutil ls -p ${artifactProject} -b ${bucketName}` )
+  } catch ( error ) {
+    errorExit( `***Error: from Docker.validateCloudBuildBucket\n\n${chalk.bold.yellow( error )}` )
+  }
+}
+
+async function buildContainerImage( {
+  artifactProject, artifactRegistry, containerName, 
+  imageVersion, isNpmWorkspace, options
+} ) {
+
+  const useCloudBuildFile = true
+  const buildWorkspace = './build/workspace' // passed to Cloud Build
+  const imageName = `${artifactRegistry}/images/${containerName}`
+
+  if ( fs.existsSync( buildWorkspace ) ) {
+    fs.renameSync( buildWorkspace, `${buildWorkspace}-junk` )
+    try {
+      fs.rmSync( `${buildWorkspace}-junk`, { recursive : true } )
+    } catch ( err ) {
+      log( `***Error: from Docker.buildContainerImage\n\n${chalk.bold.yellow( err )}` )
+    }
+  }
+
+  // TODO: This is janky - I'll clean it up later
+  // NOTE: this is dealing with raw filesystem interactions, meaning there
+  //   isn't a shell performing file globbing and what not
+  fs.renameSync( './build', './workspace' )
+  fs.mkdirSync( './build' )
+  fs.renameSync( './workspace', buildWorkspace )
+  fs.renameSync( './docker/Dockerfile', './build/Dockerfile' )
+  // fs.cpSync( `${process.env.HOME}/.npmrc`, './build/.npmrc' )
+  fs.cpSync( './docker/bashrc', './build/bashrc' )
+  // fs.cpSync( './package.json', `${buildWorkspace}/package.json` )
+  // fs.cpSync( './package-lock.json', `${buildWorkspace}/package-lock.json` )
+
+  setPreviousBuild( imageVersion ) // update docker/.previous file
+
+  const { fullName : builderName } = await getGcpAccount()
+  const gcloudBuild = `time gcloud builds submit --project ${artifactProject}`
+  const gcloudLogs = `--gcs-log-dir ${formCloudBuildBucketName( artifactProject )}/log`
+  let gcloudTags = `--tag ${imageName}:${imageVersion}`
+  
+  if ( useCloudBuildFile ) {
+    const cloudBuildFile = './docker/cloudbuild.yaml'
+    gcloudTags = `--config=${cloudBuildFile}`
+    const cbst = handlebars.compile( cloudBuildSteps, { noEscape : true } )
+    const cbs = cbst( { artifactProject, artifactRegistry, imageName, imageVersion } )
+
+    fs.writeFileSync( cloudBuildFile, cbs )
+  }
+
+  log( chalk.green.bold( `
+  *** Submitting Build as ${builderName} ***
+      ${gcloudBuild} \\
+           ${gcloudLogs}  \\
+           ${gcloudTags}
+  ` ) )
+
+  if ( process.env.DRY_RUN === '1' ) {
+    log( '\n***Exiting from DRY_RUN\n' )
+    process.exit( 0 )
+  }
+
+  await shellCmd( `${gcloudBuild} ${gcloudLogs} ${gcloudTags} ./build`, { stdio : 'inherit' } )
+
+  const imageTag = `${defaultSettings.date}-${defaultSettings.nodeimage}-${builderName}`
+  await shellCmd(
+    `gcloud container images add-tag --quiet ${imageName}:${imageVersion} ${imageName}:${imageTag} ${imageName}:latest`
+  )
+}
+
+async function repoCleanup() {
+  // remove garbage from the repo
+  const garbage = [
+    'build',
+    'dist',
+    'docker/.keep',
+    'docker/.npmrc',
+    'docker/.gitignore',
+    'docker/.previous',
+    'docker/Dockerfile',
+    'docker/workspace',
+  ]
+  garbage.forEach( trash => fs.rmSync( trash, { recursive : true, force : true } ) )
+
+  fs.writeFileSync( 'docker/.gitignore', '.previous\nDockerfile' )
+
+  await shellCmd( 'git add -f docker' )
+
+  log( `
+  ${chalk.yellow.bold( '***IMPORTANT***' )}
+
+  Please make the following .gitignore modifications:
+    change /dist to ${chalk.green.bold( '/build' )}
+    remove ${chalk.red.bold( '/docker' )}
+` )
+
+  await proceed( 'Acknowledge the .gitignore mods were made?' )
+}
+
+export default {
+  getPreviousBuild,
+  setPreviousBuild,
+  generateDockerfile,
+  formCloudBuildBucketName,
+  validateCloudBuildBucket,
+  buildContainerImage,
+  repoCleanup,
+}

package/src/docker-to-registry-py.mjs

@@ -0,0 +1,291 @@
+#!/usr/bin/env node
+/*
+ * docker-to-registry-py will...
+ */
+import fs from 'node:fs'
+import toml from 'toml'
+import chalk from 'chalk'
+import semver from 'semver'
+
+import {
+  debug, log,
+  errorExit,
+  getGitBranchAndUpstream,
+  gitRepoIsDirty,
+  parseHelmChart,
+  proceed,
+  shellCmd } from './Utils.mjs'
+
+import Docker from './DockerPy.mjs'
+import { version } from 'node:os'
+
+// refresh-npm-token does not throw so no need to try, but it emits in debug
+const refreshErr = await shellCmd( 'refresh-npm-token' )
+if ( refreshErr && !process.env.BUILD_TOOLS_DEBUG ) {
+  log( refreshErr ) // most likely the token refreshed message
+}
+
+const options = {}
+let imageVersion = null
+// Expected to be invoked like docker-to-registry-py v1.2.3
+for ( let n = 2; n < process.argv.length; n++ ) {
+  if ( process.argv[n].startsWith( '-' ) ) {
+    const str = process.argv[n].slice( 1 )
+    if ( str.indexOf( '=' ) > 0 ) {
+      const [ key, value ] = str.split( '=' )
+      options[key] = value
+    } else {
+      options[str] = true
+    }
+  } else {
+    imageVersion = process.argv[n]
+  }
+}
+if ( !imageVersion ) {
+  errorExit( '***Error: docker-to-registry-py requires an image version' )
+}
+
+// may use guide-me or guideme to ask for update guidance
+const giveGuidance = imageVersion.match( /^guide-*me$/ ) !== null
+
+const willGitTag = imageVersion.match( /^v\d+\.\d+\.\d+$/ )
+const tagInfo = willGitTag ?
+  chalk.yellow.bold( 'will be git tagged' ) :
+  chalk.red( 'BETA RELEASE WILL NOT BE GIT TAGGED' )
+
+const repoIsDirty = await gitRepoIsDirty()
+
+if ( willGitTag && repoIsDirty ) {
+  log( `
+  ${chalk.red.bold( '***ERROR: attempting to tag a non-beta dirty git repository' )}
+
+  You are attempting to create a tagged release image for pushing to the
+  artifact registry, but there are locally modified files. This is not
+  allowed since the applied tag will not be relevant to the image version
+  due to the pending commits.
+
+  Available options for proceeding:
+
+    ${chalk.green.bold( '1) cleanly commit all local mods assuming relevance' )}
+    ${chalk.yellow( '2) eliminate unwanted local modifications' )}
+    ${chalk.red( '3) stash anything that is irrelevant to this release' )}
+
+  ` )
+  process.exit( 1 )
+}
+
+if ( !fs.existsSync( './helm' ) ) {
+  log( `
+  ${chalk.red.bold( '***Error: docker-to-registry-py requires a helm chart directory' )}
+
+  The docker-to-registry-py script expects to run in the root directory of a k8s
+  service, which requires a helm chart directory. It also expects a docker
+  directory but will build that if it does not exist.
+
+  ` )
+  process.exit( 1 )
+}
+
+const tomlStr = fs.readFileSync( './pyproject.toml' )
+const pyproject = toml.parse( tomlStr )
+const repoDescr = {
+  artifactProject : pyproject.leverege.project || 'leverege-registry',
+  containerName : pyproject.project.name,
+  packageVersion : pyproject.project.version,
+  artifactRegistry : pyproject.leverege.registry || 'us-docker.pkg.dev/leverege-registry/stack',
+  registryFolder : `${pyproject.leverege.registryFolder}/images/${pyproject.project.name}`,
+  imageBase : pyproject.leverege.imageBase,
+  helmChart : await parseHelmChart(),
+}
+
+debug( { repoDescr }, '<==The Repo Description' )
+
+const dockerInfo = await Docker.generateDockerfile( {
+  regvers : repoDescr.packageVersion,
+  imageBase : repoDescr.imageBase,
+} )
+
+debug( { dockerInfo }, '<==The Docker Info' )
+
+const {
+  artifactProject,
+  artifactRegistry,
+  packageVersion,
+  containerName,
+  helmChart,
+} = repoDescr
+
+if ( giveGuidance ) {
+  await Docker.validateCloudBuildBucket( artifactProject )
+}
+
+const registryFolder = `${artifactRegistry}/images/${containerName}`
+
+// Update the dependencies...
+log( chalk.green.bold( 'Updating dependencies and workspace...' ) )
+await shellCmd( 'npm install', { stdio : 'inherit' } )
+
+if ( giveGuidance ) {
+  await Docker.repoCleanup() // adjusts gitignore files and removes cruft
+  log( `
+
+
+
+  ${chalk.green.bold( '-------------------- Potential Helm Chart Mods --------------------' )}
+
+  Moving to the new artifact-registry for docker image storage may also require
+  helm chart changes depending on how old the current charts are. Charts that
+  contain helm/values.yaml files resembling this:
+
+  ${chalk.yellow.bold( `serviceConfig:
+    VERSION: v1.2.3
+    PREEMPTIBLE: true` )}
+
+  are pre-ignition era charts and should be replaced with the latest helm chart
+  templates available from ignition. Either dive in or ask devops for a hand
+  when converting these legacy / deprecated charts.
+
+
+  More recently updated helm charts that have already started the migration to
+  the new approach may already have registry entries like this:
+
+  ${chalk.yellow.bold( `image:
+    registry: gcr.io/leverege-docker-images
+    tag: ""` )}
+
+  The above registry statement references the deprecated container registry and
+  must be adjusted accordingly to resemble:
+
+    ${chalk.green.bold( 'registry: us-docker.pkg.dev/leverege-registry/<registry folder>/images' )}
+
+  There may also be a corresponding modification needed in the helm template
+  deployment.yaml file in the container image spec:
+
+    ${chalk.green.bold( 'image: {{ .Values.image.registry }}/{{ .Chart.Name }}:{{ default .Chart.AppVersion .Values.image.tag }}' )}
+
+
+  ${chalk.magenta.bold( `Upgrading all service charts to the latest ignition template chart structure
+  is the preferred approach to making the transition to the artifact registry.` )}
+
+  ` )
+  log( chalk.green.bold( '*** docker-to-registry-py guidance complete - ready for dockerization ***' ) )
+  process.exit( 0 )
+}
+
+// do chart checks too
+let chart
+if ( options?.helmChecks !== 'false' ) {
+  chart = helmChart?.yaml['Chart.yaml']
+  const values = helmChart?.yaml['values.yaml']
+  const expectedChartRegistry = `${artifactRegistry}/images`
+
+  if ( expectedChartRegistry !== values.image?.registry ) {
+    log( `
+  ${chalk.red.bold( '***Error: mismatched package.json registry and helm/values.yaml' )}
+
+  The registry specified in the package.json leverege stanza does not line up
+  with the image registry in helm/values.yaml. The naming convention expects
+  the '/images' suffix to be added to the package.json registry string and then
+  stored as the image.registry in the helm/values.yaml file.
+
+    Current settings:
+      package.json registry => ${chalk.yellow.bold( artifactRegistry )}
+      values.yaml  registry => ${chalk.red.bold( values.image?.registry )}
+
+    Expected settings:
+      values.yaml  registry => ${chalk.green.bold( expectedChartRegistry )}
+  ` )
+
+    if ( !values.image ) {
+      log( `
+  ${chalk.yellow.bold( '***DEPRECATED: legacy helm charts detected' )}
+
+  The helm chart structure appears to be based on the pre-ignition helm chart
+  layouts. The charts must be upgraded before docker-to-registry-py can complete
+  its job.
+
+    ` )
+    }
+
+    process.exit( 1 )
+  }
+}
+
+// Give the summary and the user a chance to proceed or not
+log( `
+  ${chalk.green.bold( 'Build Information:' )}
+    Container:     ${chalk.green.bold( containerName )}
+    Version:       ${chalk.green.bold( imageVersion )}   ${tagInfo}
+    Registry:      ${chalk.green.bold( artifactRegistry )}
+    Image Folder:  ${chalk.yellow.bold( registryFolder )}
+
+  ${chalk.green.bold( 'Docker Information:' )}
+    NodeImage:     ${chalk.green.bold( dockerInfo.imageBase || `node:${dockerInfo.nodeimage}` )}
+    Docker Env:    ${chalk.green.bold( dockerInfo.buildEnv || 'alpine' )}
+    AddedPkgs:     ${chalk.green.bold( dockerInfo.apkadds )}
+    Run User:      ${chalk.green.bold( dockerInfo.runuser )}
+    Previous:      ${chalk.yellow.bold( dockerInfo.previousBuild )}
+    DateStamp:     ${chalk.green.bold( dockerInfo.date )}
+    NPM Logs:      ${chalk.green.bold( dockerInfo.npmlogging )}
+    NPM Version:   ${chalk.green.bold( dockerInfo.npmVersion )}
+` )
+
+if ( imageVersion !== packageVersion ) {
+  log( `
+  ${chalk.yellow.bold( '***WARNING: specified version does not match project version' )}
+        pyproject.toml => ${chalk.green.bold( packageVersion )}
+        specified    => ${chalk.red.bold( imageVersion )}
+  ` )
+
+  if ( willGitTag ) {
+    log( chalk.red.bold( '... and you are attempting to release so NOPE!\n' ) )
+    process.exit( 1 )
+  }
+}
+
+const repoInfo = await getGitBranchAndUpstream()
+
+if ( willGitTag && !repoInfo.upstream ) {
+  log( `
+  ${chalk.red.bold( '***ERROR: the current branch must have an upstream' )}
+
+  You are attempting to create a tagged release image for pushing to the
+  container registry, but the current branch does not have an upstream to
+  push to. This is not allowed since the applied tag will be stranded here
+  in your local repository, which is what we are trying to avoid.
+
+  Available options for proceeding:` )
+  log( chalk.green.bold( `
+    1) set an upstream for this branch via:
+           git push --set-upstream origin ${repoInfo.branch}` ) )
+  log( chalk.yellow.bold( `
+    2) rebase, squash and merge onto a branch with an upstream` ) )
+
+  process.exit( 1 )
+}
+
+if ( willGitTag ) {
+  if ( chart.appVersion !== imageVersion ) {
+    log( `
+  ${chalk.yellow.bold( '***WARNING: the helm/Chart.yaml appVersion does not align with the build version' )}
+    chart appVersion => ${chalk.yellow.bold( chart.appVersion )}
+    build version    => ${chalk.green.bold( imageVersion )}
+  ` )
+  }
+}
+
+await proceed()
+
+log( chalk.green.bold( 'Building the Docker Image...' ) )
+await Docker.buildContainerImage( { ...repoDescr, options, imageVersion } )
+log( chalk.blue.bold( 'Done Building the Docker Image...' ) )
+
+if ( willGitTag ) {
+  const tagDescription = `docker_${imageVersion}`
+  const fullImageTag = repoDescr.isMonoRepo ? `${repoDescr.containerName}/${imageVersion}` : imageVersion
+  log( chalk.green.bold( `Tagging and Pushing ${fullImageTag}\n` ) )
+  await shellCmd( `git tag -f ${fullImageTag} -m ${tagDescription}` )
+  await shellCmd( 'git push --follow-tags' )
+} else {
+  log( chalk.yellow.bold( '\n*** Skipped git tagging - beta release' ) )
+}

package/src/docker-to-registry.mjs

@@ -96,6 +96,8 @@ if ( semver.lt( semver.coerce( repoDescr.buildToolsVersion ), minimumBuildToolsV
 
 const dockerInfo = await docker.generateDockerfile( {
   regvers : repoDescr.packageVersion,
+  imageBase : repoDescr.closestPackageJson.leverege?.imageBase,
+  buildEnv : repoDescr.closestPackageJson.leverege?.buildEnv || 'alpine',
   nodeimage : repoDescr.closestPackageJson.leverege?.nodeimg, // left as nodeimg in package.json for backwards compat
 } )
 debug( { dockerInfo }, '<==The Docker Info' )
@@ -216,7 +218,8 @@ log( `
     NPM Workspace: ${chalk.green.bold( isNpmWorkspace )}
 
   ${chalk.green.bold( 'Docker Information:' )}
-    NodeImage:     ${chalk.green.bold( dockerInfo.nodeimage )}
+    NodeImage:     ${chalk.green.bold( dockerInfo.imageBase || `node:${dockerInfo.nodeimage}` )}
+    Docker Env:    ${chalk.green.bold( dockerInfo.buildEnv || 'alpine' )}
     AddedPkgs:     ${chalk.green.bold( dockerInfo.apkadds )}
     Run User:      ${chalk.green.bold( dockerInfo.runuser )}
     Previous:      ${chalk.yellow.bold( dockerInfo.previousBuild )}

package/src/templates/bashrcTemplate.hbs

@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+alias h=history
+
+alias ls='ls -CF --color=auto'
+alias ll='ls -lh'
+alias lla='ls -lha'
+alias glep='grep -l -s'
+alias m=less
+alias menv='env | sort | less'
+
+alias whatsmyip='wget -qO- ifconfig.co'
+
+alias err='wget -q -O- localhost:5111/logLevel/error'
+alias wrn='wget -q -O- localhost:5111/logLevel/warn'
+alias inf='wget -q -O- localhost:5111/logLevel/info'
+alias dbg='wget -q -O- localhost:5111/logLevel/debug'
+alias trc='wget -q -O- localhost:5111/logLevel/trace'
+
+socks()
+{
+  netstat -ant | awk '{print }' | sort | uniq -c | sort -n
+}
+
+cmetrics()
+{
+  wget -qO- localhost:5111/metrics
+}
+
+cmstat()
+{
+  wget -qO- localhost:5111
+}
+
+cmclear()
+{
+  # Future me - thinking this should call cmstat and pass in the endpoint as
+  # a parameter? Well don't do it - without escaping the dollar 1 in cmstat
+  # the port will end up being 51111, and escaping causes linting to complain
+  # about unnecessary escaping.
+  wget -qO- localhost:5111/status/clear
+}
+
+dunm() {
+  du -sh /usr/src/app/node_modules/* | sort -sh
+}

package/src/templates/bashrcTemplatePy.hbs

@@ -0,0 +1 @@
+export PYTHONPYCACHEPREFIX=/tmp/pycache

package/src/templates/cloudBuildSteps.hbs

@@ -0,0 +1,13 @@
+steps:
+  - name: 'gcr.io/cloud-builders/docker'
+    args:
+      - 'build' 
+      - '--network=cloudbuild'
+      - '-t'
+      - '{{imageName}}:{{imageVersion}}'
+      - '--cache-from'
+      - '{{imageName}}:{{imageVersion}}'
+      - '.'
+    
+images:
+  - '{{imageName}}:{{imageVersion}}'

package/src/templates/dockerfileTemplate.hbs

@@ -0,0 +1,86 @@
+# Version {{regvers}} @ {{date}}
+
+# The FROM directive sets the Base Image for subsequent instructions
+FROM {{image}} as intermediate
+
+ARG BUILD_ENV="{{buildEnv}}"
+
+ENV NODE_ENV production
+ENV NPM_CONFIG_USERCONFIG /usr/src/app/.npmrc
+
+RUN mkdir -p /usr/src/app
+WORKDIR /usr/src/app
+
+# Install app dependencies
+COPY ./workspace/ /usr/src/app/
+ENV GRPC_VERBOSITY ERROR
+
+# --------------------------------------------------------------
+# copy the ssh keys into place, npm install, and remove them
+# --------------------------------------------------------------
+
+# Install packages to install private repos with ssh keys
+COPY ./.npmrc ${NPM_CONFIG_USERCONFIG}
+
+RUN if [ "${BUILD_ENV}" = "debian" ]; then \
+      apt-get update && \
+      apt-get install -y wget openssh-client build-essential && \
+      npm install -g npm@10; \
+    else \
+      apk --no-cache add openssh-client && \
+      apk --update add --no-cache --virtual build-dep g++ gcc libgcc libstdc++ linux-headers make {{apkadds}} && \
+      npm install -g npm@10; \
+    fi
+
+# Use SKIP_PREPARE to disable hook-and-release from running
+ENV SKIP_PREPARE=true
+
+{{preInstallPluginfile}}
+
+# Do the clean install and remove the npm token and ssh keys from the image
+RUN npm ci --only=production --no-optional {{npmlogging}} && \
+    rm -f ${NPM_CONFIG_USERCONFIG} /root/.ssh/*
+
+# --------------------------------------------------------------
+# Docker Final Stage
+# --------------------------------------------------------------
+
+FROM {{image}}
+
+ARG BUILD_ENV="{{buildEnv}}"
+
+ENV NPM_CONFIG_USERCONFIG /usr/src/app/.npmrc
+
+# Copy .npmrc for private registry access for access to any @leverege packages
+COPY ./.npmrc ${NPM_CONFIG_USERCONFIG}
+
+# Install tini for PID 1 and replace shell with bash so we can source files
+RUN if [ "$BUILD_ENV" = "debian" ]; then \
+      apt-get update && \
+      apt-get install -y tini bash curl vim {{apkadds}} && \
+      npm install -g npm@10 && \
+      rm /bin/sh && ln -s /bin/bash /bin/sh && \
+      mkdir -p /usr/src/app /tmp/levlog && chown node:node /usr/src/app; \
+    else \
+      apk update && \
+      apk add --no-cache bash curl tini vim {{apkadds}} && \
+      npm install -g npm@10 && \
+      rm /bin/sh && ln -s /bin/bash /bin/sh && \
+      mkdir -p /usr/src/app /tmp/levlog && chown node:node /usr/src/app; \
+    fi
+
+
+# Pull in the Dockerfile.plugin file here
+{{pluginfile}}
+
+# Eliminate the sensitive info from the final stage image
+RUN rm -f ${NPM_CONFIG_USERCONFIG}
+
+ENTRYPOINT [ "tini", "--" ]
+WORKDIR /usr/src/app
+
+COPY --chown=node:node --from=intermediate /usr/src/app /usr/src/app
+
+USER {{runuser}}
+COPY ./bashrc /home/node/.bashrc
+CMD [ "/bin/bash", "-c", "source /home/node/.bashrc && node index.js" ]

package/src/templates/dockerfileTemplatePy.hbs

@@ -0,0 +1,75 @@
+# Version {{regvers}} @ {{date}}
+
+# The FROM directive sets the Base Image for subsequent instructions
+FROM {{image}} as intermediate
+
+ARG BUILD_ENV="{{buildEnv}}"
+
+RUN apt-get update && apt-get install -y \
+    wget
+#    gcc \
+#    git \
+#    libgl1 \
+#    libglib2.0-0 \
+#    && rm -rf /var/lib/apt/lists/*
+
+# Copy uv binary from the official distroless Docker image.
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
+
+# Define the working directory.
+WORKDIR /usr/src/app
+
+#ENV NODE_ENV production
+#ENV NPM_CONFIG_USERCONFIG /usr/src/app/.npmrc
+
+RUN mkdir -p /usr/src/app
+WORKDIR /usr/src/app
+
+# Install app dependencies
+COPY ./workspace/ /usr/src/app/
+ENV GRPC_VERBOSITY ERROR
+
+
+# Setup pip.conf for Google Artifact Registry.
+RUN mkdir -p ~/.config/pip
+RUN echo "[global]" >> ~/.config/pip/pip.conf && \
+    echo "break-system-packages = true" >> ~/.config/pip/pip.conf 
+
+
+# Set up the virtual environment.
+RUN uv venv
+ENV VIRTUAL_ENV=/usr/src/app/.venv
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+
+# Setup keyring for Google Artifact Registry.
+RUN uv pip install keyring
+RUN uv pip install keyrings.google-artifactregistry-auth
+
+RUN echo "extra-index-url = https://oauth2accesstoken@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple" >> ~/.config/pip/pip.conf
+
+ENV UV_EXTRA_INDEX_URL "https://oauth2accesstoken@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple"
+
+
+{{preInstallPluginfile}}
+
+RUN cat 
+
+RUN ls -al
+# Install uv
+RUN uv sync --keyring-provider subprocess --extra-index-url https://oauth2accesstoken@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple
+
+
+# Pull in the Dockerfile.plugin file here
+{{pluginfile}}
+
+# Eliminate the sensitive info from the final stage image
+#RUN rm -f ${NPM_CONFIG_USERCONFIG}
+
+# ENTRYPOINT [ "tini", "--" ]
+#WORKDIR /usr/src/app
+
+#COPY --chown=node:node --from=intermediate /usr/src/app /usr/src/app
+
+USER {{runuser}}
+COPY ./bashrc /home/{{runuser}}/.bashrc
+CMD [ "/bin/bash", "-c", "source /home/{{runuser}}/.bashrc && python scripts/server.py" ]