leaf-server-common 0.1.18__tar.gz

leaf_server_common-0.1.18/.flake8

@@ -0,0 +1,6 @@
+[flake8]
+max-line-length = 120
+exclude =
+    artifacts,
+    build_scripts,
+    deployment

leaf_server_common-0.1.18/.github/workflows/codeql.yml

@@ -0,0 +1,98 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '28 22 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: python
+          build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

leaf_server_common-0.1.18/.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]  # Trigger only when a GitHub Release is published.
+
+jobs:
+  publish:
+    name: Build and Publish
+    runs-on: ubuntu-latest
+    environment: pypi  # Match this to your configured GitHub Environment.
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+
+      - name: Install build tools
+        run: |
+          pip install --upgrade pip
+          pip install build
+
+      - name: Build wheel and sdist
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}

leaf_server_common-0.1.18/.github/workflows/tests.yml

@@ -0,0 +1,39 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+      - "**"
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.12-slim
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          apt-get update && apt-get install -y shellcheck
+          pip install -r requirements-build.txt
+          pip install -r requirements.txt
+
+      - name: Show installed packages
+        run: pip freeze
+
+      - name: Run pylint
+        run: build_scripts/run_pylint.sh
+
+      - name: Run shellcheck
+        run: build_scripts/run_shellcheck.sh
+
+      - name: Run flake8
+        run: flake8
+
+      - name: Run pytest (excluding integration tests)
+        run: pytest --verbose -m "not integration" --timer-top-n 10

leaf_server_common-0.1.18/.gitignore

@@ -0,0 +1,26 @@
+# PyCharm project files
+.idea/
+
+# ipython notebook checkpoints
+.ipynb_checkpoints/
+
+# virtualenv folder
+venv/
+venv3/
+
+# Python byte code
+*.pyc
+
+# build files
+dist/
+build/
+*.egg-info/
+
+# Vim editor restore files
+*.swp
+
+# Documentation created by mkdocs which may harbor security vulnerabilities
+site/
+
+# Resources used by Dockerfile
+leaf-common/

leaf_server_common-0.1.18/.pylintrc

@@ -0,0 +1,44 @@
+# Note:
+# This is a minimal subset of the options available for Pylint.
+# To generate an exhaustive configuration file based on current settings and defaults, run the following command
+# in the project directory:
+#
+#  pylint --generate-rcfile > ~/.pylintrc
+
+[MASTER]
+
+# Add files or directories to the blacklist. They should be base names, not
+# paths.
+ignore=.git
+
+# Directories from top level that should be ignored.
+ignore-paths=backend/grpc/generated,serving/adapter/grpc_gen/generated
+
+# Add files or directories matching the regex patterns to the blacklist. The
+# regex matches against base names, not paths.
+ignore-patterns=
+
+# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
+# number of processors available to use.
+jobs=0
+
+# Set reasonable line length
+max-line-length=120
+
+# When enabled, pylint would attempt to guess common misconfiguration and emit
+# user-friendly hints instead of false-positive error messages.
+suggestion-mode=yes
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once).You can also use "--disable=all" to
+# disable everything first and then reenable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use"--disable=all --enable=classes
+# --disable=W"
+
+disable=
+    duplicate-code,
+    missing-module-docstring,

leaf_server_common-0.1.18/LICENSE.txt

@@ -0,0 +1,223 @@
+License
+The following license governs the use of leaf-server-common SDK Software in academic
+and educational environments. Commercial use requires a commercial license from
+Cognizant Technology Solutions Corp, www.cognizant.com.
+
+ACADEMIC PUBLIC LICENSE
+Written by Andras Varga (license text is in public domain)
+Adapted by Karl Mutch (license text is in public domain)
+
+Preamble
+This license contains the terms and conditions of using leaf-server-common SDK Software
+in noncommercial settings: at academic institutions for teaching and research
+use, and at non-profit research organizations. You will find that this license
+provides noncommercial users of leaf-server-common SDK Software with rights that are
+similar to the well-known GNU General Public License, yet it retains the
+possibility for leaf-server-common SDK Software authors to financially support the
+development by selling commercial licenses. In fact, if you intend to use
+leaf-server-common SDK Software in a “for-profit” environment, where research is
+conducted to develop or enhance a product, is used in a commercial service
+offering, or when a commercial company uses leaf-server-common SDK Software to
+participate in a research project (for example government-funded or EU-funded
+research projects), then you need to obtain a commercial license for
+leaf-server-common SDK Software. In that case, please contact the Author to inquire
+about commercial licenses.
+
+What are the rights given to noncommercial users? Similarly to GPL, you have the
+right to use the software, to distribute copies, to receive source code, to
+change the software and distribute your modifications or the modified software.
+Also similarly to the GPL, if you distribute verbatim or modified copies of
+this software, they must be distributed under this license.
+
+By modeling the GPL, this license guarantees that you’re safe when using
+leaf-server-common SDK Software in your work, for teaching or research. This license
+guarantees that leaf-server-common SDK Software will remain available free of charge
+for nonprofit use. You can modify leaf-server-common SDK Software to your purposes,
+and you can also share your modifications. Even in the unlikely case of the
+authors abandoning leaf-server-common SDK Software entirely, this license permits
+anyone to continue developing it from the last release, and to create further
+releases under this license.
+
+We believe that the combination of noncommercial open-source and commercial
+licensing will be beneficial for the whole user community, because income from
+commercial licenses will enable faster development and a higher level of
+software quality, while further enjoying the informal, open communication and
+collaboration channels of open source development.
+
+The precise terms and conditions for using, copying, distribution and
+modification follow.
+
+TERMS AND CONDITIONS FOR USE, COPYING, DISTRIBUTION AND MODIFICATION
+
+Definitions
+“Program” means a copy of leaf-server-common SDK Software, which is said to be
+distributed under this Academic Public License.
+
+“Work based on the Program” means either the Program or any derivative work
+under copyright law: that is to say, a work containing the Program or a portion
+of it, either verbatim or with modifications and/or translated into another
+language. (Hereinafter, translation is included without limitation in the term
+“modification”.)
+
+“Using the Program” means any act of creating executables that contain or
+directly use libraries that are part of the Program, running any of the tools
+that are part of the Program, or creating works based on the Program.
+
+Each licensee is addressed as “you”.
+
+§1. Permission is hereby granted to use the Program free of charge for any
+noncommercial purpose, including teaching and research at universities, colleges
+and other educational institutions, research at non-profit research
+institutions, and personal non-profit purposes. For using the Program for
+commercial purposes, including but not restricted to consulting activities,
+design of commercial hardware or software networking products, and a commercial
+entity participating in research projects, you have to contact the Author for an
+appropriate license. Permission is also granted to use the Program for a
+reasonably limited period of time for the purpose of evaluating its usefulness
+for a particular purpose.
+
+§2. You may copy and distribute verbatim copies of the Program’s source code as
+you receive it, in any medium, provided that you conspicuously and appropriately
+publish on each copy an appropriate copyright notice and disclaimer of warranty;
+keep intact all the notices that refer to this License and to the absence of any
+warranty; and give any other recipients of the Program a copy of this License
+along with the Program.
+
+§3. You may modify your copy or copies of the Program or any portion of it, thus
+forming a work based on the Program, and copy and distribute such modifications
+or work under the terms of Section 2 above, provided that you also meet all of
+these conditions:
+
+a) You must cause the modified files to carry prominent notices stating that
+you changed the files and the date of any change.
+
+b) You must cause any work that you distribute or publish, that in whole or in
+part contains or is derived from the Program or any part thereof, to be
+licensed as a whole at no charge to all third parties under the terms of this
+License.
+
+These requirements apply to the modified work as a whole. If identifiable
+sections of that work are not derived from the Program, and can be reasonably
+considered independent and separate works in themselves, then this License, and
+its terms, do not apply to those sections when you distribute them as separate
+works. But when you distribute the same sections as part of a whole which is a
+work based on the Program, the distribution of the whole must be on the terms of
+this License, whose regulations for other licensees extend to the entire whole,
+and thus to each and every part regardless of who wrote it. (If the same,
+independent sections are distributed as part of a package that is otherwise
+reliant on, or is based on the Program, then the distribution of the whole
+package, including but not restricted to the independent section, must be on the
+unmodified terms of this License, regadless of who the author of the included
+sections was.)
+
+Thus, it is not the intent of this section to claim rights or contest your
+rights to work written entirely by you; rather, the intent is to exercise the
+right to control the distribution of derivative or collective works based or
+reliant on the Program.
+
+In addition, mere aggregation of another work not based on the Program with the
+Program (or with a work based on the Program) on a volume of storage or
+distribution medium does not bring the other work under the scope of this
+License.
+
+§4. You may copy and distribute the Program (or a work based on it, under
+Section 3) in object code or executable form under the terms of Sections 2 and 3
+above provided that you also do one of the following:
+
+a) Accompany it with the complete corresponding machine-readable source code,
+which must be distributed under the terms of Sections 2 and 3 above on a medium
+customarily used for software interchange; or,
+
+b) Accompany it with a written offer, valid for at least three years, to give
+any third party, for a charge no more than your cost of physically performing
+source distribution, a complete machine-readable copy of the corresponding
+source code, to be distributed under the terms of Sections 2 and 3 above on a
+medium customarily used for software interchange; or,
+
+c) Accompany it with the information you received as to the offer to distribute
+corresponding source code. (This alternative is allowed only for noncommercial
+distribution and only if you received the program in object code or executable
+form with such an offer, in accord with Subsection b) above.)
+
+The source code for a work means the preferred form of the work for making
+modifications to it. For an executable work, complete source code means all the
+source code for all modules it contains, plus any associated interface
+definition files, plus the scripts used to control compilation and installation
+of the executable. However, as a special exception, the source code distributed
+need not include anything that is normally distributed (in either source or
+binary form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component itself
+accompanies the executable.
+
+If distribution of executable or object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the source code
+from the same place counts as distribution of the source code, even though third
+parties are not compelled to copy the source along with the object code.
+
+§5. You may not copy, modify, sublicense, or distribute the Program except as
+expressly provided under this License. Any attempt otherwise to copy, modify,
+sublicense or distribute the Program is void, and will automatically terminate
+your rights under this License. However, parties who have received copies, or
+rights, from you under this License will not have their licenses terminated so
+long as such parties remain in full compliance.
+
+§6. You are not required to accept this License, since you have not signed it.
+Nothing else grants you permission to modify or distribute the Program or its
+derivative works; law prohibits these actions if you do not accept this License.
+Therefore, by modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License and all its terms and
+conditions for copying, distributing or modifying the Program or works based on
+it, to do so.
+
+§7. Each time you redistribute the Program (or any work based on the Program),
+the recipient automatically receives a license from the original licensor to
+copy, distribute or modify the Program subject to these terms and conditions.
+You may not impose any further restrictions on the recipients’ exercise of the
+rights granted herein. You are not responsible for enforcing compliance by third
+parties to this License.
+
+§8. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues), conditions
+are imposed on you (whether by court order, agreement or otherwise) that
+contradict the conditions of this License, they do not excuse you from the
+conditions of this License. If you cannot distribute so as to satisfy
+simultaneously your obligations under this License and any other pertinent
+obligations, then as a consequence you may not distribute the Program at all.
+For example, if a patent license would not permit royalty-free redistribution of
+the Program by all those who receive copies directly or indirectly through you,
+then the only way you could satisfy both it and this License would be to refrain
+entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply and the
+section as a whole is intended to apply in other circumstances.
+
+§9. If the distribution and/or use of the Program are restricted in certain
+countries either by patents or by copyrighted interfaces, the original copyright
+holder who places the Program under this License may add an explicit
+geographical distribution limitation excluding those countries, so that
+distribution is permitted only in or among countries not thus excluded. In such
+case, this License incorporates the limitation as if written in the body of this
+License.
+
+NO WARRANTY
+
+§10. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR
+THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE
+STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM
+“AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING,
+BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+§11. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED ON IN WRITING WILL
+ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE
+PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL,
+SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY
+TO USE THE PROGRAM INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF
+THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+END OF TERMS AND CONDITIONS

leaf_server_common-0.1.18/NOTICE.txt

@@ -0,0 +1,10 @@
+leaf-server-common SDK Software
+Copyright (C) 2022 Cognizant Digital Business, Evolutionary AI. All Rights Reserved.
+
+This product contains software developed by the
+Cognizant Evolutionary AI organization, and may contain already 
+patented, patent pending, or yet to be patented material.
+
+Any use of this software for any purpose requires a 
+commercially negotiated contract between any party 
+posessing or using the software, and Cognizant Digital Business.

leaf_server_common-0.1.18/PKG-INFO

@@ -0,0 +1,31 @@
+Metadata-Version: 2.4
+Name: leaf-server-common
+Version: 0.1.18
+Summary: Library for common service infrastructure for use by Cognizant AI Lab services
+Author-email: Dan Fink <Daniel.Fink@cognizant.com>
+License-Expression: LicenseRef-CognizantAcademicSource
+Project-URL: Homepage, https://github.com/leaf-ai/leaf-server-common
+Project-URL: Repository, https://github.com/leaf-ai/leaf-server-common
+Project-URL: Documentation, https://github.com/leaf-ai/leaf-server-common#readme
+Keywords: service,infrastructure,grpc
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: leaf-common==1.2.21
+Requires-Dist: grpcio>=1.62.0
+Requires-Dist: grpcio-health-checking>=1.62.0
+Requires-Dist: grpcio-reflection>=1.62.0
+Requires-Dist: grpcio-tools>=1.62.0
+Requires-Dist: protobuf<5.0,>=4.25.3
+Requires-Dist: opentelemetry-api<=1.27.0,>=1.23.0
+Requires-Dist: opentelemetry-sdk<=1.27.0,>=1.23.0
+Requires-Dist: opentelemetry-exporter-otlp<=1.27.0,>=1.23.0
+Dynamic: license-file
+
+# leaf-server-common
+
+Library for common server code for use by ESP, ENN and Unileaf services

leaf_server_common-0.1.18/README.md

@@ -0,0 +1,3 @@
+# leaf-server-common
+
+Library for common server code for use by ESP, ENN and Unileaf services

leaf_server_common-0.1.18/build_scripts/Dockerfile

@@ -0,0 +1,77 @@
+# Base image
+FROM python:3.10-slim
+
+##############################################################
+#			Basic Housekeeping
+##############################################################
+LABEL maintainer=donn.goodhew@cognizant.com
+ENV LANG C.UTF-8
+ENV PYTHON_VERSION 3.10
+ENV PIP3_VERSION 24.3.1
+ENV DEBIAN_FRONTEND noninteractive
+
+# Debian basics
+RUN apt-get update -y
+RUN apt-get install curl git -y
+
+# Install shellcheck test utility.
+# Get all our apt-get installs out of the way early
+RUN apt-get install shellcheck -y
+
+# Change EXTERNAL_BUILD_ROOT to . if debugging locally
+ENV EXTERNAL_BUILD_ROOT .
+
+ARG USERNAME leaf
+RUN  adduser --disabled-password --gecos '' ${USERNAME}
+
+# The APP_HOME home is our root directory within the image
+# where we place the repo's source directory.
+ARG APP_HOME /home/${USERNAME}
+
+ENV OUR_VENV ${APP_HOME}/venv/python-${PYTHON_VERSION}
+ENV PATH="$OUR_VENV/bin:$PATH"
+
+# Make directories as needed
+RUN mkdir -p ${APP_HOME}
+
+# Set up python and pip
+RUN python${PYTHON_VERSION} -m venv $OUR_VENV
+RUN pip3 install --upgrade pip==${PIP3_VERSION} \
+    && pip3 install wheel \
+                    virtualenv
+
+ARG REPO
+ARG APP_SOURCE ${APP_HOME}/${REPO}
+RUN mkdir -p ${APP_SOURCE}
+
+# Now bring all of our requirement files in and pip install as needed.
+# Create a separate layer for each of the requirements files for maximum
+# caching performance. Ordered by general frequency of change, least-to-most.
+# We use A COPY step before the pip install in the RUN step so that requirements
+# only changes cause a proper container rebuild.
+COPY --chown=${USERNAME}:${USERNAME} ${EXTERNAL_BUILD_ROOT}/requirements-build.txt ${APP_SOURCE}
+RUN /bin/bash -c "pip3 install -r ${APP_SOURCE}/requirements-build.txt"
+
+COPY --chown=${USERNAME}:${USERNAME} ${EXTERNAL_BUILD_ROOT}/requirements.txt ${APP_SOURCE}
+RUN /bin/bash -c "pip3 install -r ${APP_SOURCE}/requirements.txt"
+
+# Use the with_creds_requirements secret as the basis for the pip install
+# of the main requirements.  We still do the COPY first so the container
+# cache is properly broken on changes.
+#
+# NOTE: We expect the with_creds_requirement file to provide us with
+#       ephemeral GitHub creds from vault as the proper replacement mechanism
+#       for LEAF_SOURCE_CREDENTIALS.  This way, it's OK if these inherently
+#       short-lived happen to be stored in the container.
+COPY --chown=${USERNAME}:${USERNAME}  ${EXTERNAL_BUILD_ROOT}/requirements-private.txt ${APP_SOURCE}
+RUN --mount=type=secret,id=with_creds_requirements \
+    /bin/bash -c "pip3 install -r <(cat /run/secrets/with_creds_requirements)"
+
+# Now we copy the full source tree into the container, which will almost always
+# in practice break the cache since we build when code changes.
+# We do this after all the requirements are installed as code changes more often than requirements
+COPY --chown=${USERNAME}:${USERNAME} . ${APP_SOURCE}
+
+USER ${USERNAME}
+
+WORKDIR ${APP_HOME}