splent-cli 1.31.0__tar.gz → 1.32.0__tar.gz

{splent_cli-1.31.0/src/splent_cli.egg-info → splent_cli-1.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.31.0
+Version: 1.32.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli

{splent_cli-1.31.0 → splent_cli-1.32.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.31.0"
+version = "1.32.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"

{splent_cli-1.31.0 → splent_cli-1.32.0}/src/splent_cli/commands/product/product_build.py

@@ -45,6 +45,17 @@ CONTRACTS_FORMAT = 1
 REQUIREMENTS_FILE = "requirements.prod.txt"
 GUNICORN_REQUIREMENT = "gunicorn>=23,<24"
 
+# Every third-party package the production image installs, at the version the
+# last build resolved, read back from the image with pip freeze. The
+# Dockerfile applies it as a constraint on every pip install, so two builds of
+# one commit install the same set. Versioned beside requirements.prod.txt.
+LOCK_FILE = "requirements.lock"
+LOCK_HEADER = (
+    "# Every third-party package the production image installs, at the version\n"
+    "# the last build resolved. Written by splent product:build and\n"
+    "# product:release from the image itself. Do not edit it.\n"
+)
+
 # Database settings every product names the same way. A template writes <SET>
 # for them, and the CLI fills them in rather than ask: nobody needs to choose
 # what the database is called.
@@ -424,6 +435,75 @@ def runtime_requirements(workspace: str) -> str:
     )
 
 
+def _canonical(name: str) -> str:
+    import re
+
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def lock_text(freeze_output: str, product: str) -> str:
+    """docker/requirements.lock from what pip freeze reports in the image.
+
+    SPLENT's own packages (the framework, the CLI, every feature) and the
+    product are left out: their versions are pinned where they are chosen, in
+    requirements.prod.txt and pyproject.toml, and a feature installed from its
+    git tag is not something a constraints file can name.
+    """
+    product_name = _canonical(product)
+    kept = []
+    for line in freeze_output.splitlines():
+        line = line.strip()
+        if not line or line.startswith(("#", "-")) or " @ " in line or "==" not in line:
+            continue
+        name = _canonical(line.split("==", 1)[0])
+        if name.startswith("splent") or name == product_name:
+            continue
+        kept.append(line)
+    return LOCK_HEADER + "".join(f"{line}\n" for line in sorted(kept, key=str.lower))
+
+
+def ensure_lock(docker_path: str) -> str:
+    """The lock's path, written with no pin yet when the product has none."""
+    path = os.path.join(docker_path, LOCK_FILE)
+    if not os.path.isfile(path):
+        atomic_write(path, LOCK_HEADER, dir_owner=True)
+    return path
+
+
+def write_lock_from_image(image: str, product: str, docker_path: str) -> int:
+    """Pin in docker/requirements.lock what ``image`` installed. Returns how many."""
+    frozen = subprocess.run(
+        ["docker", "run", "--rm", "--entrypoint", "pip", image, "freeze"],
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout
+    text = lock_text(frozen, product)
+    atomic_write(os.path.join(docker_path, LOCK_FILE), text, dir_owner=True)
+    return sum(1 for line in text.splitlines() if line and not line.startswith("#"))
+
+
+def resolve_lock(product: str, workspace: str, docker_path: str) -> int:
+    """Resolve the third-party packages afresh and pin them in the lock.
+
+    Builds the image's build stage with SPLENT_FRESH_LOCK=1, which leaves the
+    current lock out, and reads back what it installed. product:release runs
+    this before its commit, so the lock it commits is what its image installs.
+    """
+    tag = f"{product}:lock"
+    subprocess.run(
+        production_image_build_command(
+            product,
+            workspace,
+            docker_path,
+            [tag],
+            extra=("--target", "builder", "--build-arg", "SPLENT_FRESH_LOCK=1"),
+        ),
+        check=True,
+    )
+    return write_lock_from_image(tag, product, docker_path)
+
+
 def pypi_serves(package: str, version: str) -> bool | None:
     """Whether PyPI serves ``package==version``. None when it could not be asked."""
     import requests
@@ -470,6 +550,7 @@ def production_image_build_command(
     docker_path: str,
     tags: Sequence[str],
     context: str | None = None,
+    extra: Sequence[str] = (),
 ) -> list[str]:
     """The ``docker build`` that produces the product's production image.
 
@@ -489,6 +570,7 @@ def production_image_build_command(
     for tag in tags:
         cmd += ["-t", tag]
     cmd += forge_build_args()
+    cmd += list(extra)
     cmd += ["-f", dockerfile, context]
     return cmd
 
@@ -526,6 +608,7 @@ def build_production_image(
     *,
     stage_model: bool = True,
     committed: bool = False,
+    fresh_lock: bool = False,
 ) -> None:
     """Build the production image under ``tags``.
 
@@ -547,9 +630,12 @@ def build_production_image(
         staged = stage_spl_model(workspace, product, docker_path)
         if staged:
             click.echo(f"  Staged the UVL model: {staged}")
+    extra = ("--build-arg", "SPLENT_FRESH_LOCK=1") if fresh_lock else ()
     if not committed:
         subprocess.run(
-            production_image_build_command(product, workspace, docker_path, tags),
+            production_image_build_command(
+                product, workspace, docker_path, tags, extra=extra
+            ),
             check=True,
         )
         return
@@ -557,7 +643,7 @@ def build_production_image(
         export_commit(os.path.join(workspace, product), tree)
         subprocess.run(
             production_image_build_command(
-                product, workspace, docker_path, tags, context=tree
+                product, workspace, docker_path, tags, context=tree, extra=extra
             ),
             check=True,
         )
@@ -1572,6 +1658,8 @@ def write_deploy_artifacts(
     atomic_write(requirements_path, runtime_requirements(workspace), dir_owner=True)
     written.append(f"docker/{REQUIREMENTS_FILE}")
     click.echo(f"✅ Created: {requirements_path}")
+    ensure_lock(docker_path)
+    written.append(f"docker/{LOCK_FILE}")
     unpublished = unpublished_runtime_pins(workspace)
     if unpublished:
         click.secho(
@@ -1742,8 +1830,15 @@ def product_build(no_image, skip_preflight):
                     docker_path,
                     [f"{product}:{bundle.version}", f"{product}:latest"],
                     stage_model=False,
+                    fresh_lock=True,
                 )
                 click.echo(f"✅ Image built: {product}:{bundle.version}")
+                pinned = write_lock_from_image(
+                    f"{product}:{bundle.version}", product, docker_path
+                )
+                click.echo(
+                    f"✅ Pinned {pinned} third-party package(s) in docker/{LOCK_FILE}"
+                )
             except subprocess.CalledProcessError:
                 click.secho("❌ Docker image build failed.", fg="red")
                 raise SystemExit(1)

{splent_cli-1.31.0 → splent_cli-1.32.0}/src/splent_cli/commands/product/product_release.py

@@ -11,11 +11,13 @@ import tempfile
 import click
 from splent_cli.commands.product.product_build import (
     CONTRACTS_SNAPSHOT,
+    LOCK_FILE,
     REQUIREMENTS_FILE,
     SPL_STAGING_DIR,
     build_production_image,
     production_dockerfile,
     unpublished_runtime_pins,
+    resolve_lock,
     unresolved_pins,
     write_deploy_artifacts,
 )
@@ -124,6 +126,7 @@ RELEASE_ARTIFACTS = (
     # before they exist.
     f"{deploy_bundle.BUNDLE_DIR}/",
     f"docker/{REQUIREMENTS_FILE}",
+    f"docker/{LOCK_FILE}",
     CONTRACTS_SNAPSHOT,
     f"docker/{SPL_STAGING_DIR}/",
 )
@@ -216,6 +219,28 @@ def write_release_artifacts(
         # The release about to publish the first image has no tag yet.
         publishes_image=publishes_image,
     )
+    if publishes_image:
+        # Resolved afresh for every release, so each one picks up the
+        # third-party fixes PyPI has, and committed, so a rebuild of the tag
+        # installs exactly what the release did.
+        require_docker()
+        click.echo("  lock     resolving the third-party packages...")
+        try:
+            pinned = resolve_lock(
+                product, workspace, os.path.join(product_path, "docker")
+            )
+        except subprocess.CalledProcessError:
+            click.secho(
+                "  error: the image's build stage did not build, so the "
+                "third-party packages could not be pinned. Nothing was "
+                "committed; the version bump in pyproject.toml is still to "
+                "undo or to release again.",
+                fg="red",
+            )
+            raise SystemExit(1)
+        click.echo(
+            f"  lock     {pinned} third-party package(s) pinned in docker/{LOCK_FILE}"
+        )
     subprocess.run(
         ["git", "add", "--", *bundle.paths],
         cwd=product_path,

{splent_cli-1.31.0 → splent_cli-1.32.0/src/splent_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.31.0
+Version: 1.32.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli