quoll-cli 0.2.0__py3-none-any.whl

quoll/languages/php/Dockerfile.j2

@@ -0,0 +1,40 @@
+{% block base %}
+FROM dunglas/frankenphp:1-php{{ cfg.version }} AS base
+{{ os_updates }}
+{% if extensions %}
+RUN install-php-extensions {{ extensions | join(" ") }}
+{% endif %}
+{% if env %}
+ENV {% for key, value in env.items() %}{{ key }}={{ value }}{{ " \\\n    " if not loop.last }}{% endfor %}
+
+{% endif %}
+WORKDIR /app
+{% endblock %}
+
+{% block build %}
+FROM base AS build
+RUN install-php-extensions @composer
+ENV COMPOSER_CACHE_DIR=/tmp/composer-cache
+# Dependencies first: code changes don't reinstall them.
+COPY composer.json {{ "composer.lock " if lockfile }}./
+RUN --mount=type=cache,target=/tmp/composer-cache \
+    composer install --no-dev --prefer-dist --no-interaction --no-progress --no-scripts --no-autoloader
+COPY . .
+RUN composer dump-autoload --no-dev --optimize
+{% for command in post_build %}
+RUN {{ command }}
+{% endfor %}
+{% endblock %}
+
+{% block runtime %}
+FROM base
+# Plain HTTP on an unprivileged port: the container runs as non-root, a proxy terminates TLS.
+ENV SERVER_NAME=:{{ cfg.port }}{{ " \\\n    SERVER_ROOT=/app" if not public }}
+# A numeric user: Kubernetes can then check it isn't root (runAsNonRoot).
+RUN useradd --uid 10001 --no-create-home app \
+    && setcap -r /usr/local/bin/frankenphp \
+    && chown -R app:app /config/caddy /data/caddy
+COPY --from=build --chown=app:app /app /app
+USER 10001
+EXPOSE {{ cfg.port }}
+{% endblock %}

quoll/languages/php/__init__.py

@@ -0,0 +1,19 @@
+"""PHP: Composer projects."""
+
+from quoll.languages.base import Language
+from quoll.languages.php.ci import PhpCI
+from quoll.languages.php.detect import detect
+from quoll.languages.php.docker import PhpImage
+from quoll.languages.php.frameworks import laravel, symfony
+
+language = Language(
+    name="php",
+    markers=("composer.json",),
+    package_managers=("composer",),
+    lint_tools=("php-cs-fixer", "phpcs", "pint", "phpstan", "psalm", "rector"),
+    test_runners=("phpunit", "pest"),
+    detect=detect,
+    ci=PhpCI(),
+    frameworks=(symfony.framework, laravel.framework),
+    docker=PhpImage(),
+)

quoll/languages/php/ci.py

@@ -0,0 +1,147 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Sequence
+
+from quoll.ci.steps import ROOT, Cache, Item, Step, on_github, step
+from quoll.languages.base import THRESHOLD_REGEX, CISteps, TestReports
+from quoll.platforms.github.actions import ACTIONS
+
+if TYPE_CHECKING:
+    from quoll.ci.config import CIConfig
+
+# tool: (step name, command, flag printing GitHub annotations)
+_LINT = {
+    "php-cs-fixer": ("PHP CS Fixer", "vendor/bin/php-cs-fixer fix --dry-run --diff", ""),
+    "phpcs": ("PHP_CodeSniffer", "vendor/bin/phpcs", ""),
+    "pint": ("Pint", "vendor/bin/pint --test", ""),
+    "phpstan": ("PHPStan", "vendor/bin/phpstan analyse --no-progress", " --error-format=github"),
+    "psalm": ("Psalm", "vendor/bin/psalm --no-progress", " --output-format=github"),
+    "rector": ("Rector", "vendor/bin/rector process --dry-run --no-progress-bar", ""),
+}
+
+# PHPUnit has no CLI threshold: read the line rate from its Clover report.
+_CLOVER_CHECK = """# shellcheck disable=SC2016 # PHP code: its $ are PHP's
+php -r '
+$m = simplexml_load_file("coverage.xml")->project->metrics;
+$pct = (int) $m["statements"] ? 100 * (int) $m["coveredstatements"] / (int) $m["statements"] : 100;
+$summary = getenv("GITHUB_STEP_SUMMARY");
+if ($summary) file_put_contents($summary, sprintf("### Coverage: %.1f%%\\n", $pct), FILE_APPEND);
+if ($pct < {threshold}) {{ printf("::error::Coverage %.1f%% is below the {threshold}%% threshold\\n", $pct); exit(1); }}
+printf("Coverage %.1f%% (threshold {threshold}%%)\\n", $pct);'"""
+
+# The official images have neither Composer nor most extensions: install them, then the ext-* the lock file needs.
+_EXTENSIONS = """curl -sSLf -o /usr/local/bin/install-php-extensions \\
+  https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions
+chmod +x /usr/local/bin/install-php-extensions
+install-php-extensions @composer zip{coverage}
+if [ -f composer.lock ]; then
+  # Exits 2 when something is missing, which is the point here (the runner sets pipefail).
+  missing=$({{ composer check-platform-reqs --lock --no-interaction 2>/dev/null || true; }} \\
+    | awk '$1 ~ /^ext-/ && /missing/ {{ sub("ext-", "", $1); print $1 }}')
+  if [ -n "$missing" ]; then install-php-extensions $missing; fi
+fi"""
+
+
+class PhpCI(CISteps):
+    version_key = "php-version"
+
+    def setup(self, cfg: CIConfig, version: Optional[str]) -> List[Item]:
+        with_: Dict[str, Any] = (
+            {"php-version": version} if version else {"php-version-file": cfg.path(cfg.version_file)}
+        )
+        with_["coverage"] = "pcov" if cfg.test.enabled and cfg.test.coverage else "none"
+        with_["tools"] = "composer:v2"
+        steps = [step("Set up PHP", uses=ACTIONS["setup-php"], with_=with_)]
+        if cfg.cache:
+            steps += [
+                step(
+                    "Get Composer cache directory",
+                    id_="composer-cache",
+                    run='echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"',
+                ),
+                step(
+                    "Cache Composer packages",
+                    uses=ACTIONS["cache"],
+                    with_={
+                        "path": "${{ steps.composer-cache.outputs.dir }}",
+                        "key": "${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}",
+                        "restore-keys": "${{ runner.os }}-composer-",
+                    },
+                ),
+            ]
+        return steps
+
+    def image(self, cfg: CIConfig, version: str) -> str:
+        return f"php:{version}-cli"
+
+    def image_setup(self, cfg: CIConfig) -> List[Step]:
+        coverage = " pcov" if cfg.test.enabled and cfg.test.coverage else ""
+        return [step("Install Composer and PHP extensions", run=_EXTENSIONS.format(coverage=coverage))]
+
+    def cache(self, cfg: CIConfig) -> Optional[Cache]:
+        if not cfg.cache:
+            return None
+        env = {"COMPOSER_CACHE_DIR": f"{ROOT}/.cache/composer"}
+        return Cache("composer", (".cache/composer",), key_files=("composer.lock",), env=env)
+
+    def install(self, cfg: CIConfig, packages: Sequence[str] = ()) -> List[Item]:
+        return [step("Install dependencies", run=cfg.install)]
+
+    def lint(self, cfg: CIConfig, tools: List[str]) -> List[Item]:
+        steps = self.install(cfg)
+        for tool in tools:
+            name, cmd, github = _LINT[tool]
+            steps.append(step(name, run=cmd + on_github(cfg, github)))
+        return steps
+
+    def test(self, cfg: CIConfig) -> List[Item]:
+        t = cfg.test
+        if t.runner == "pest":
+            cmd = "vendor/bin/pest"
+            if t.coverage:
+                cmd += f" --coverage --min={t.coverage_threshold} --coverage-clover coverage.xml"
+            cmd += report_flags(cfg)
+            name = "Tests" + (" with coverage" if t.coverage else "")
+            return [*self.install(cfg), step(name, run=cmd, secrets=t.env_secrets)]
+        if not t.coverage:
+            cmd = "vendor/bin/phpunit" + report_flags(cfg)
+            return [*self.install(cfg), step("Tests", run=cmd, secrets=t.env_secrets)]
+        cmd = "vendor/bin/phpunit --coverage-clover coverage.xml" + report_flags(cfg)
+        return [
+            *self.install(cfg),
+            step("Tests with coverage", run=cmd, secrets=t.env_secrets),
+            step("Coverage threshold", run=clover_check(t.coverage_threshold)),
+        ]
+
+    def coverage_file(self, cfg: CIConfig) -> str:
+        return "coverage.xml"
+
+    def reports(self, cfg: CIConfig) -> TestReports:
+        coverage = cfg.test.coverage
+        # PHPUnit prints the threshold line of clover_check; Pest and `artisan test` their own total.
+        regex = THRESHOLD_REGEX if cfg.test.runner == "phpunit" else r"/Total:\s+(\d+(?:\.\d+)?) ?%/"
+        return TestReports(
+            junit="junit.xml",
+            cobertura="cobertura.xml" if coverage else "",
+            coverage_regex=regex if coverage else "",
+        )
+
+    def audit(self, cfg: CIConfig) -> List[Item]:
+        return [step("Dependency vulnerability scan", run="composer audit --locked --no-dev")]
+
+    def build(self, cfg: CIConfig) -> List[Item]:
+        return [*self.install(cfg), step("Build", run=cfg.build.command)]
+
+    def dependabot_ecosystem(self, cfg: CIConfig) -> str:
+        return "composer"
+
+
+def report_flags(cfg: CIConfig) -> str:
+    """PHPUnit (and Pest, Laravel's `artisan test`) options writing the JUnit and Cobertura reports."""
+    if not cfg.test.reports:
+        return ""
+    return " --log-junit junit.xml" + (" --coverage-cobertura cobertura.xml" if cfg.test.coverage else "")
+
+
+def clover_check(threshold: int) -> str:
+    return _CLOVER_CHECK.format(threshold=threshold)

quoll/languages/php/detect.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import re
+from typing import Dict
+
+from quoll.languages.base import Detection
+from quoll.project import Project
+from quoll.services import detect_services
+
+PHP_SUPPORTED = ("8.2", "8.3", "8.4", "8.5")
+
+# composer package: lint tool
+_LINT_PACKAGES = {
+    "friendsofphp/php-cs-fixer": "php-cs-fixer",
+    "squizlabs/php_codesniffer": "phpcs",
+    "laravel/pint": "pint",
+    "phpstan/phpstan": "phpstan",
+    "vimeo/psalm": "psalm",
+    "rector/rector": "rector",
+}
+
+
+# Packages and extensions revealing a backing service.
+_SERVICE_PACKAGES = {
+    "postgres": ("ext-pdo_pgsql", "ext-pgsql"),
+    "mysql": ("ext-pdo_mysql", "ext-mysqli"),
+    "redis": ("predis/predis", "ext-redis", "snc/redis-bundle"),
+    "mongodb": ("mongodb/mongodb", "ext-mongodb", "doctrine/mongodb-odm"),
+}
+# Database settings in Symfony's .env / Laravel's .env.example.
+_ENV_DATABASES = {
+    "ext-pdo_pgsql": r"^(DATABASE_URL=\W*postgres|DB_CONNECTION=pgsql)",
+    "ext-pdo_mysql": r"^(DATABASE_URL=\W*(mysql|mariadb)|DB_CONNECTION=(mysql|mariadb))",
+}
+
+
+def detect(project: Project) -> Detection:
+    det = Detection(package_manager="composer", install="composer install --no-interaction --no-progress --prefer-dist")
+    det.lockfile = "composer.lock" if project.exists("composer.lock") else ""
+    if not det.lockfile:
+        det.warnings.append("No composer.lock found — commit it for reproducible builds.")
+
+    packages = composer_packages(project)
+    m = re.search(r"(\d+)\.(\d+)", packages.get("php", ""))
+    low = f"{m.group(1)}.{m.group(2)}" if m else PHP_SUPPORTED[0]
+    det.matrix_versions = [v for v in PHP_SUPPORTED if _key(v) >= _key(low)] or [PHP_SUPPORTED[-1]]
+    if project.exists(".php-version"):
+        det.version_file = ".php-version"
+        det.version = project.read_text(".php-version").strip()
+    else:
+        det.version = det.matrix_versions[-1]
+
+    det.lint_tools = [tool for package, tool in _LINT_PACKAGES.items() if package in packages]
+    if "pestphp/pest" in packages:
+        det.test_runner = "pest"
+    elif "phpunit/phpunit" in packages or "symfony/phpunit-bridge" in packages:
+        det.test_runner = "phpunit"
+    else:
+        det.warnings.append("No test framework found (phpunit/phpunit or pestphp/pest) — the test job is disabled.")
+    env = project.read_text(".env") + project.read_text(".env.example")
+    implied = [ext for ext, pattern in _ENV_DATABASES.items() if re.search(pattern, env, re.M)]
+    det.services = detect_services([*packages, *implied], _SERVICE_PACKAGES)
+    return det
+
+
+def composer_packages(project: Project) -> Dict[str, str]:
+    """`require` and `require-dev` of composer.json, merged."""
+    composer = project.read_json("composer.json")
+    if not isinstance(composer, dict):
+        return {}
+    return {**(composer.get("require") or {}), **(composer.get("require-dev") or {})}
+
+
+def _key(version: str) -> tuple:
+    return tuple(int(p) for p in version.split("."))

quoll/languages/php/docker.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List, Optional
+
+from quoll.languages.base import Detection, DockerDefaults, DockerImage
+from quoll.languages.php.detect import composer_packages
+from quoll.project import Project
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+# composer.json name -> install-php-extensions name, when they differ.
+_EXTENSION_NAMES = {"zend-opcache": "opcache"}
+
+
+class PhpImage(DockerImage):
+    """FrankenPHP: PHP and its web server (Caddy) in one process, so there's no command to run."""
+
+    requires_command = False
+
+    def defaults(self, project: Project, det: Detection) -> DockerDefaults:
+        warnings = [] if project.is_dir("public") else ["No public/ directory: the whole project is served."]
+        return DockerDefaults(port=8080, warnings=warnings)
+
+    def writable_paths(self, cfg: DockerConfig) -> Optional[List[str]]:
+        # Caddy's certificates and configuration.
+        return ["/tmp", "/data/caddy", "/config/caddy"]
+
+    def context(self, project: Project, cfg: DockerConfig) -> Dict[str, Any]:
+        extensions = sorted(
+            _EXTENSION_NAMES.get(name[4:], name[4:]) for name in composer_packages(project) if name.startswith("ext-")
+        )
+        return {
+            "extensions": extensions,
+            "lockfile": project.exists("composer.lock"),
+            "public": project.is_dir("public"),
+            "env": self.env(cfg),
+            "post_build": self.post_build(cfg),
+        }
+
+    def env(self, cfg: DockerConfig) -> Dict[str, str]:
+        """Environment of the build and the runtime."""
+        return {}
+
+    def post_build(self, cfg: DockerConfig) -> List[str]:
+        """Commands run once dependencies and code are in place."""
+        return []
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        return [
+            "vendor",
+            "node_modules",
+            "var",
+            ".phpunit.cache",
+            ".php-cs-fixer.cache",
+            ".env",
+            ".env.*",
+            "!.env.example",
+        ]

quoll/languages/php/frameworks/__init__.py

@@ -0,0 +1 @@
+"""PHP frameworks."""

quoll/languages/php/frameworks/laravel/__init__.py

@@ -0,0 +1,17 @@
+"""Laravel: tests run through artisan, which needs an .env and an application key."""
+
+from quoll.languages.base import Framework
+from quoll.languages.php.frameworks.laravel.ci import LaravelCI
+from quoll.languages.php.frameworks.laravel.detect import detect
+from quoll.languages.php.frameworks.laravel.docker import LaravelImage
+from quoll.languages.php.frameworks.laravel.services import service_env
+
+framework = Framework(
+    name="laravel",
+    language="php",
+    detect=detect,
+    ci=LaravelCI(),
+    test_runners=("artisan",),
+    docker=LaravelImage(),
+    service_env=service_env,
+)

quoll/languages/php/frameworks/laravel/ci.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, List
+
+from quoll.ci.steps import Item, step
+from quoll.languages.base import FrameworkCI
+from quoll.languages.php.ci import report_flags
+
+if TYPE_CHECKING:
+    from quoll.ci.config import CIConfig
+
+
+class LaravelCI(FrameworkCI):
+    def test(self, cfg: CIConfig) -> List[Item]:
+        t = cfg.test
+        cmd = "php artisan test"
+        if t.coverage:
+            cmd += f" --coverage --min={t.coverage_threshold} --coverage-clover coverage.xml"
+        cmd += report_flags(cfg)
+        return [
+            *cfg.language.ci.install(cfg),
+            step("Prepare environment", run="[ -f .env ] || cp .env.example .env\nphp artisan key:generate"),
+            step("Tests" + (" with coverage" if t.coverage else ""), run=cmd, secrets=t.env_secrets),
+        ]

quoll/languages/php/frameworks/laravel/detect.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from quoll.languages.base import Detection
+from quoll.languages.php.detect import composer_packages
+from quoll.project import Project
+
+
+def detect(project: Project, det: Detection) -> bool:
+    if "laravel/framework" not in composer_packages(project) or not project.exists("artisan"):
+        return False
+    # `php artisan test` drives PHPUnit or Pest, whichever the project uses.
+    det.test_runner = "artisan"
+    return True

quoll/languages/php/frameworks/laravel/docker.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Dict, List, Optional
+
+from quoll.languages.php.docker import PhpImage
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+
+class LaravelImage(PhpImage):
+    def writable_paths(self, cfg: DockerConfig) -> Optional[List[str]]:
+        # The framework writes in storage/ and bootstrap/cache/, whose tree must stay: a writable root filesystem.
+        return None
+
+    def env(self, cfg: DockerConfig) -> Dict[str, str]:
+        return {"APP_ENV": "production"}
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        return [
+            *super().dockerignore(cfg),
+            "storage/logs/*",
+            "storage/framework/cache/data/*",
+            "storage/framework/sessions/*",
+            "storage/framework/views/*",
+            "bootstrap/cache/*.php",
+            "public/hot",
+            "public/storage",
+        ]

quoll/languages/php/frameworks/laravel/services.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from typing import Dict
+
+from quoll.services import SERVICES
+
+_CONNECTIONS = {"postgres": "pgsql", "mysql": "mysql"}
+
+
+def service_env(service: str, host: str, database: str) -> Dict[str, str]:
+    """Laravel reads its database and Redis settings from DB_* and REDIS_* rather than URLs."""
+    if service in _CONNECTIONS:
+        user = "root" if service == "mysql" else "app"
+        password = "root" if service == "mysql" else "app"
+        return {
+            "DB_CONNECTION": _CONNECTIONS[service],
+            "DB_HOST": host,
+            "DB_PORT": str(SERVICES[service].port),
+            "DB_DATABASE": database,
+            "DB_USERNAME": user,
+            "DB_PASSWORD": password,
+        }
+    if service == "redis":
+        return {"REDIS_HOST": host}
+    return {}

quoll/languages/php/frameworks/symfony/__init__.py

@@ -0,0 +1,15 @@
+"""Symfony: the console's linters catch broken services, config and templates before the tests do."""
+
+from quoll.languages.base import Framework
+from quoll.languages.php.frameworks.symfony.ci import SymfonyCI
+from quoll.languages.php.frameworks.symfony.detect import detect
+from quoll.languages.php.frameworks.symfony.docker import SymfonyImage
+
+framework = Framework(
+    name="symfony",
+    language="php",
+    detect=detect,
+    ci=SymfonyCI(),
+    lint_tools=("symfony-container", "symfony-yaml", "symfony-twig"),
+    docker=SymfonyImage(),
+)

quoll/languages/php/frameworks/symfony/ci.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, List
+
+from quoll.ci.steps import Item, step
+from quoll.languages.base import FrameworkCI
+
+if TYPE_CHECKING:
+    from quoll.ci.config import CIConfig
+
+# tool: (step name, command)
+_LINT = {
+    "symfony-container": ("Lint service container", "php bin/console lint:container"),
+    "symfony-yaml": ("Lint YAML config", "php bin/console lint:yaml config --parse-tags"),
+    "symfony-twig": ("Lint Twig templates", "php bin/console lint:twig templates"),
+}
+
+
+class SymfonyCI(FrameworkCI):
+    def lint(self, cfg: CIConfig, tool: str) -> List[Item]:
+        name, cmd = _LINT[tool]
+        return [step(name, run=cmd)]

quoll/languages/php/frameworks/symfony/detect.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+from quoll.languages.base import Detection
+from quoll.languages.php.detect import composer_packages
+from quoll.project import Project
+
+
+def detect(project: Project, det: Detection) -> bool:
+    packages = composer_packages(project)
+    if "symfony/framework-bundle" not in packages or not project.exists("bin/console"):
+        return False
+    det.lint_tools.append("symfony-container")
+    if project.is_dir("config"):
+        det.lint_tools.append("symfony-yaml")
+    if "symfony/twig-bundle" in packages and project.is_dir("templates"):
+        det.lint_tools.append("symfony-twig")
+    return True

quoll/languages/php/frameworks/symfony/docker.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Dict, List, Optional
+
+from quoll.languages.php.docker import PhpImage
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+
+class SymfonyImage(PhpImage):
+    def writable_paths(self, cfg: DockerConfig) -> Optional[List[str]]:
+        # The framework writes in var/, whose tree must stay: a writable root filesystem.
+        return None
+
+    def env(self, cfg: DockerConfig) -> Dict[str, str]:
+        return {"APP_ENV": "prod", "APP_DEBUG": "0"}
+
+    def post_build(self, cfg: DockerConfig) -> List[str]:
+        # Flex's auto-scripts: cache:clear (warms the prod cache) and assets:install.
+        return ["composer run-script --no-dev post-install-cmd"]
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        # Symfony commits .env (defaults); secrets live in .env.local.
+        return ["vendor", "node_modules", "var", ".phpunit.cache", ".env.local", ".env.local.php", ".env.*.local"]

quoll/languages/python/Dockerfile.j2

@@ -0,0 +1,61 @@
+{% block build %}
+FROM python:{{ cfg.version }}-slim AS build
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+WORKDIR /app
+{% if cfg.package_manager == "uv" %}
+COPY --from={{ uv_image }} /uv /uvx /bin/
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=0
+# Dependencies first: code changes don't reinstall them.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+{% if lockfile %}
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+{% endif %}
+    uv sync {{ "--locked " if lockfile }}--no-dev --no-install-project
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync {{ "--locked " if lockfile }}--no-dev
+{% elif cfg.package_manager == "poetry" %}
+ENV POETRY_NO_INTERACTION=1 \
+    POETRY_VIRTUALENVS_IN_PROJECT=1
+RUN --mount=type=cache,target=/root/.cache/pip pip install poetry
+# Dependencies first: code changes don't reinstall them.
+COPY pyproject.toml {{ "poetry.lock " if lockfile }}./
+RUN --mount=type=cache,target=/root/.cache/pypoetry poetry install --only main --no-root
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/pypoetry poetry install --only main
+{% else %}
+RUN python -m venv .venv
+ENV PATH="/app/.venv/bin:$PATH"
+{% if requirements %}
+# Dependencies first: code changes don't reinstall them.
+COPY requirements.txt .
+RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt
+{% endif %}
+COPY . .
+{% if installable %}
+RUN --mount=type=cache,target=/root/.cache/pip pip install .
+{% endif %}
+{% endif %}
+{% endblock %}
+
+{% block runtime %}
+FROM python:{{ cfg.version }}-slim
+{{ os_updates }}
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+{% if src_layout %}
+    PYTHONPATH=/app/src \
+{% endif %}
+    PATH="/app/.venv/bin:$PATH"
+# A numeric user: Kubernetes can then check it isn't root (runAsNonRoot).
+RUN groupadd --system --gid 10001 app && useradd --system --uid 10001 --gid app --no-create-home app
+WORKDIR /app
+COPY --from=build --chown=app:app /app /app
+USER 10001:10001
+EXPOSE {{ cfg.port }}
+CMD {{ cfg.command | exec_form }}
+{% endblock %}

quoll/languages/python/__init__.py

@@ -0,0 +1,19 @@
+"""Python: pip, uv and poetry projects."""
+
+from quoll.languages.base import Language
+from quoll.languages.python.ci import PythonCI
+from quoll.languages.python.detect import detect
+from quoll.languages.python.docker import PythonImage
+from quoll.languages.python.frameworks import django, fastapi, flask
+
+language = Language(
+    name="python",
+    markers=("pyproject.toml", "requirements.txt", "setup.py", "setup.cfg", "Pipfile"),
+    package_managers=("pip", "uv", "poetry"),
+    lint_tools=("ruff", "ruff-format", "flake8", "black", "mypy"),
+    test_runners=("pytest",),
+    detect=detect,
+    ci=PythonCI(),
+    frameworks=(django.framework, fastapi.framework, flask.framework),
+    docker=PythonImage(),
+)