splent-cli 1.31.0__tar.gz → 1.33.0__tar.gz

{splent_cli-1.31.0/src/splent_cli.egg-info → splent_cli-1.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.31.0
+Version: 1.33.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli

{splent_cli-1.31.0 → splent_cli-1.33.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.31.0"
+version = "1.33.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"

{splent_cli-1.31.0 → splent_cli-1.33.0}/src/splent_cli/commands/product/product_build.py

@@ -38,12 +38,34 @@ USER_TUNABLE_MARKER = "user-tunable"
 CONTRACTS_SNAPSHOT = "splent.contracts.json"
 CONTRACTS_FORMAT = 1
 
-# The framework, the CLI and the WSGI server the production image installs,
-# pinned. Written by product:build into docker/, read by the production
-# Dockerfile, versioned with the product, so a clone builds the image a release
-# published.
-REQUIREMENTS_FILE = "requirements.prod.txt"
-GUNICORN_REQUIREMENT = "gunicorn>=23,<24"
+# What the production image installs besides the features, in the product's
+# pyproject.toml beside the feature pins, where pip does not read it: the
+# framework and the CLI as [project] dependencies would replace the editable
+# workspace checkouts development runs on. product:build keeps the framework
+# and the CLI at the versions the product is built with; the production
+# Dockerfile reads the table with tomllib. A bare version means exactly that
+# version, anything else is a pip specifier.
+RUNTIME_TABLE = ("tool", "splent", "runtime")
+RUNTIME_DEFAULTS = {"gunicorn": ">=23,<24"}
+RUNTIME_COMMENT = (
+    "# What the production image installs besides the features. splent\n"
+    "# product:build keeps splent_framework and splent_cli at the versions this\n"
+    "# product is built with; a bare version means exactly that version.\n"
+)
+# Where those pins lived before, in a file of their own. Removed by the build
+# that moves them into pyproject.toml.
+LEGACY_REQUIREMENTS_FILE = "requirements.prod.txt"
+
+# Every third-party package the production image installs, at the version the
+# last build resolved, read back from the image with pip freeze. The
+# Dockerfile applies it as a constraint on every pip install, so two builds of
+# one commit install the same set. Versioned in docker/.
+LOCK_FILE = "requirements.lock"
+LOCK_HEADER = (
+    "# Every third-party package the production image installs, at the version\n"
+    "# the last build resolved. Written by splent product:build and\n"
+    "# product:release from the image itself. Do not edit it.\n"
+)
 
 # Database settings every product names the same way. A template writes <SET>
 # for them, and the CLI fills them in rather than ask: nobody needs to choose
@@ -412,16 +434,112 @@ def runtime_pins(workspace: str) -> dict:
     }
 
 
-def runtime_requirements(workspace: str) -> str:
-    """The text of docker/requirements.prod.txt."""
-    pins = runtime_pins(workspace)
-    return (
-        "# What the production image installs from PyPI besides the features,\n"
-        "# which pyproject.toml pins. Written by splent product:build from the\n"
-        "# framework and the CLI this product was built with. Do not edit it.\n"
-        + "".join(f"{name}=={version}\n" for name, version in pins.items())
-        + f"{GUNICORN_REQUIREMENT}\n"
+def runtime_requirement(name: str, spec: str) -> str:
+    """One entry of [tool.splent.runtime] as a pip requirement."""
+    spec = str(spec).strip()
+    return f"{name}=={spec}" if spec[:1].isdigit() else f"{name}{spec}"
+
+
+def write_runtime_pins(pyproject_path: str, workspace: str) -> dict | None:
+    """Keep [tool.splent.runtime] at the framework and CLI of this build.
+
+    Other entries (gunicorn, anything the product added) are left as they are,
+    and the file is only written when something changes, through the editor
+    that keeps comments and layout. Returns the table when it changed.
+    """
+    from splent_cli.utils.toml_edit import edit_toml
+
+    with open(pyproject_path, encoding="utf-8", newline="") as fh:
+        text = fh.read()
+    data = load_toml(pyproject_path, what="pyproject.toml")
+    splent = data.setdefault("tool", {}).setdefault("splent", {})
+    current = dict(splent.get("runtime") or {})
+    # The framework and the CLI first, where a reader of a new table looks.
+    wanted = dict(runtime_pins(workspace))
+    for name, spec in {**RUNTIME_DEFAULTS, **current}.items():
+        wanted.setdefault(name, spec)
+    if wanted == current:
+        return None
+    splent["runtime"] = wanted
+    result = edit_toml(text, data)
+    header = "[" + ".".join(RUNTIME_TABLE) + "]"
+    lines = result.splitlines(keepends=True)
+    for i, line in enumerate(lines):
+        if line.strip() == header and not (i and lines[i - 1].lstrip().startswith("#")):
+            newline = "\r\n" if line.endswith("\r\n") else "\n"
+            lines[i:i] = [c + newline for c in RUNTIME_COMMENT.splitlines()]
+            break
+    atomic_write(pyproject_path, "".join(lines), newline="")
+    return wanted
+
+
+def _canonical(name: str) -> str:
+    import re
+
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def lock_text(freeze_output: str, product: str) -> str:
+    """docker/requirements.lock from what pip freeze reports in the image.
+
+    SPLENT's own packages (the framework, the CLI, every feature) and the
+    product are left out: their versions are pinned where they are chosen, in
+    pyproject.toml, and a feature installed from its git tag is not something
+    a constraints file can name.
+    """
+    product_name = _canonical(product)
+    kept = []
+    for line in freeze_output.splitlines():
+        line = line.strip()
+        if not line or line.startswith(("#", "-")) or " @ " in line or "==" not in line:
+            continue
+        name = _canonical(line.split("==", 1)[0])
+        if name.startswith("splent") or name == product_name:
+            continue
+        kept.append(line)
+    return LOCK_HEADER + "".join(f"{line}\n" for line in sorted(kept, key=str.lower))
+
+
+def ensure_lock(docker_path: str) -> str:
+    """The lock's path, written with no pin yet when the product has none."""
+    path = os.path.join(docker_path, LOCK_FILE)
+    if not os.path.isfile(path):
+        atomic_write(path, LOCK_HEADER, dir_owner=True)
+    return path
+
+
+def write_lock_from_image(image: str, product: str, docker_path: str) -> int:
+    """Pin in docker/requirements.lock what ``image`` installed. Returns how many."""
+    frozen = subprocess.run(
+        ["docker", "run", "--rm", "--entrypoint", "pip", image, "freeze"],
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout
+    text = lock_text(frozen, product)
+    atomic_write(os.path.join(docker_path, LOCK_FILE), text, dir_owner=True)
+    return sum(1 for line in text.splitlines() if line and not line.startswith("#"))
+
+
+def resolve_lock(product: str, workspace: str, docker_path: str) -> int:
+    """Resolve the third-party packages afresh and pin them in the lock.
+
+    Builds the image's build stage with SPLENT_FRESH_LOCK=1, which leaves the
+    current lock out, and reads back what it installed. product:release runs
+    this before its commit, so the lock it commits is what its image installs.
+    """
+    tag = f"{product}:lock"
+    subprocess.run(
+        production_image_build_command(
+            product,
+            workspace,
+            docker_path,
+            [tag],
+            extra=("--target", "builder", "--build-arg", "SPLENT_FRESH_LOCK=1"),
+        ),
+        check=True,
     )
+    return write_lock_from_image(tag, product, docker_path)
 
 
 def pypi_serves(package: str, version: str) -> bool | None:
@@ -454,6 +572,35 @@ def production_dockerfile(product: str, docker_path: str) -> str:
     return os.path.join(docker_path, f"Dockerfile.{product}.prod")
 
 
+# What a production Dockerfile from an older CLI does that this one cannot
+# feed, each with what it says about it.
+STALE_DOCKERFILE_MARKERS = (
+    (
+        "COPY splent_framework",
+        "copies splent_framework/ from the workspace, which the product's own "
+        "build context does not have",
+    ),
+    (
+        LEGACY_REQUIREMENTS_FILE,
+        f"installs docker/{LEGACY_REQUIREMENTS_FILE}, which [tool.splent.runtime] "
+        "in pyproject.toml replaces",
+    ),
+)
+
+
+def stale_dockerfile(dockerfile: str) -> str | None:
+    """Why the production Dockerfile predates this CLI, or None when it does not."""
+    try:
+        with open(dockerfile, encoding="utf-8") as fh:
+            text = fh.read()
+    except OSError:
+        return None
+    for marker, why in STALE_DOCKERFILE_MARKERS:
+        if marker in text:
+            return why
+    return None
+
+
 def forge_build_args() -> list[str]:
     """``--build-arg`` pairs for the forge settings that are set."""
     args: list[str] = []
@@ -470,6 +617,7 @@ def production_image_build_command(
     docker_path: str,
     tags: Sequence[str],
     context: str | None = None,
+    extra: Sequence[str] = (),
 ) -> list[str]:
     """The ``docker build`` that produces the product's production image.
 
@@ -489,6 +637,7 @@ def production_image_build_command(
     for tag in tags:
         cmd += ["-t", tag]
     cmd += forge_build_args()
+    cmd += list(extra)
     cmd += ["-f", dockerfile, context]
     return cmd
 
@@ -526,6 +675,7 @@ def build_production_image(
     *,
     stage_model: bool = True,
     committed: bool = False,
+    fresh_lock: bool = False,
 ) -> None:
     """Build the production image under ``tags``.
 
@@ -547,9 +697,12 @@ def build_production_image(
         staged = stage_spl_model(workspace, product, docker_path)
         if staged:
             click.echo(f"  Staged the UVL model: {staged}")
+    extra = ("--build-arg", "SPLENT_FRESH_LOCK=1") if fresh_lock else ()
     if not committed:
         subprocess.run(
-            production_image_build_command(product, workspace, docker_path, tags),
+            production_image_build_command(
+                product, workspace, docker_path, tags, extra=extra
+            ),
             check=True,
         )
         return
@@ -557,7 +710,7 @@ def build_production_image(
         export_commit(os.path.join(workspace, product), tree)
         subprocess.run(
             production_image_build_command(
-                product, workspace, docker_path, tags, context=tree
+                product, workspace, docker_path, tags, context=tree, extra=extra
             ),
             check=True,
         )
@@ -1301,8 +1454,8 @@ def write_deploy_artifacts(
 
     * ``deploy/``, the bundle a host runs with docker compose alone (see
       :mod:`splent_cli.services.deploy_bundle`);
-    * ``docker/requirements.prod.txt``, the framework and CLI the image
-      installs from PyPI;
+    * ``[tool.splent.runtime]`` in pyproject.toml, the framework and CLI the
+      image installs from PyPI;
     * ``splent.contracts.json`` and ``docker/spl/``, the refinement metadata
       and the UVL model the image reads.
 
@@ -1568,10 +1721,23 @@ def write_deploy_artifacts(
     # ---------------------------------------------------------
     # 4) What the image installs and reads, pinned
     # ---------------------------------------------------------
-    requirements_path = os.path.join(docker_path, REQUIREMENTS_FILE)
-    atomic_write(requirements_path, runtime_requirements(workspace), dir_owner=True)
-    written.append(f"docker/{REQUIREMENTS_FILE}")
-    click.echo(f"✅ Created: {requirements_path}")
+    pins = write_runtime_pins(pyproject_path, workspace)
+    written.append("pyproject.toml")
+    if pins:
+        click.echo(
+            "✅ Pinned "
+            + ", ".join(f"{name} {spec}" for name, spec in pins.items())
+            + " in pyproject.toml [tool.splent.runtime]"
+        )
+    legacy_requirements = os.path.join(docker_path, LEGACY_REQUIREMENTS_FILE)
+    if os.path.isfile(legacy_requirements):
+        os.remove(legacy_requirements)
+        click.echo(
+            click.style("  removed  ", dim=True)
+            + f"docker/{LEGACY_REQUIREMENTS_FILE}, now [tool.splent.runtime]"
+        )
+    ensure_lock(docker_path)
+    written.append(f"docker/{LOCK_FILE}")
     unpublished = unpublished_runtime_pins(workspace)
     if unpublished:
         click.secho(
@@ -1733,6 +1899,15 @@ def product_build(no_image, skip_preflight):
                 f"   Run 'splent product:sync-template' to generate it.",
                 fg="yellow",
             )
+        elif stale := stale_dockerfile(dockerfile):
+            click.secho(
+                f"\n❌ docker/{os.path.basename(dockerfile)} comes from an older "
+                f"CLI, it {stale}.\n"
+                f"   Run 'splent product:sync-template {product} --docker' and "
+                "build again.",
+                fg="red",
+            )
+            raise SystemExit(1)
         else:
             click.echo(f"\n🐳 Building Docker image: {product}:{bundle.version}...")
             try:
@@ -1742,8 +1917,15 @@ def product_build(no_image, skip_preflight):
                     docker_path,
                     [f"{product}:{bundle.version}", f"{product}:latest"],
                     stage_model=False,
+                    fresh_lock=True,
                 )
                 click.echo(f"✅ Image built: {product}:{bundle.version}")
+                pinned = write_lock_from_image(
+                    f"{product}:{bundle.version}", product, docker_path
+                )
+                click.echo(
+                    f"✅ Pinned {pinned} third-party package(s) in docker/{LOCK_FILE}"
+                )
             except subprocess.CalledProcessError:
                 click.secho("❌ Docker image build failed.", fg="red")
                 raise SystemExit(1)

{splent_cli-1.31.0 → splent_cli-1.33.0}/src/splent_cli/commands/product/product_create.py

@@ -31,6 +31,27 @@ except Exception:
 PRODUCT_NAME_RE = re.compile(r"^[a-z_][a-z0-9_]*$")
 
 
+def _runtime_versions() -> tuple[str, str]:
+    """The framework and CLI versions a new product's image installs.
+
+    The ones product:build pins, so the first build leaves them as they are.
+    Empty when one cannot be read, which installs whatever PyPI serves until
+    that first build pins it.
+    """
+    from splent_cli.commands.product.product_build import (
+        cli_version,
+        framework_version,
+    )
+
+    versions = []
+    for read in (lambda: framework_version(str(context.workspace())), cli_version):
+        try:
+            versions.append(read())
+        except Exception:  # noqa: BLE001 - only the default runtime pins depend on it
+            versions.append("")
+    return versions[0], versions[1]
+
+
 def validate_product_name(name: str) -> None:
     """Refuse a name that cannot be a Python package.
 
@@ -202,6 +223,7 @@ def make_product(name, spl_name, spl_doi, features_file, force):
         except Exception:
             pass
 
+    runtime_framework, runtime_cli = _runtime_versions()
     template_ctx = {
         "product_name": name,
         "pascal_name": pascalcase(name),
@@ -212,6 +234,11 @@ def make_product(name, spl_name, spl_doi, features_file, force):
         "mailhog_port_one": mailhog_port_one,
         "mailhog_port_two": mailhog_port_two,
         "cli_version": _CLI_VERSION,
+        # [tool.splent.runtime]: what the production image installs. The
+        # same versions product:build would write, so a new product's image
+        # builds before its first product:build.
+        "runtime_framework": runtime_framework,
+        "runtime_cli": runtime_cli,
         "network_name": "splent_network",
         "spl_name": spl_name or "",
         "spl_mirror": pin.mirror,

{splent_cli-1.31.0 → splent_cli-1.33.0}/src/splent_cli/commands/product/product_release.py

@@ -11,11 +11,13 @@ import tempfile
 import click
 from splent_cli.commands.product.product_build import (
     CONTRACTS_SNAPSHOT,
-    REQUIREMENTS_FILE,
+    LOCK_FILE,
     SPL_STAGING_DIR,
     build_production_image,
     production_dockerfile,
     unpublished_runtime_pins,
+    resolve_lock,
+    stale_dockerfile,
     unresolved_pins,
     write_deploy_artifacts,
 )
@@ -123,7 +125,7 @@ RELEASE_ARTIFACTS = (
     # Directories end in "/", so git matches directory rules against them
     # before they exist.
     f"{deploy_bundle.BUNDLE_DIR}/",
-    f"docker/{REQUIREMENTS_FILE}",
+    f"docker/{LOCK_FILE}",
     CONTRACTS_SNAPSHOT,
     f"docker/{SPL_STAGING_DIR}/",
 )
@@ -184,6 +186,17 @@ def _guard_deployable(workspace: str, product: str, product_path: str) -> None:
         )
         raise SystemExit(1)
 
+    dockerfile = production_dockerfile(product, os.path.join(product_path, "docker"))
+    stale = stale_dockerfile(dockerfile)
+    if stale:
+        click.secho(
+            f"  Cannot release: docker/{os.path.basename(dockerfile)} comes from "
+            f"an older CLI, it {stale}. Run splent product:sync-template "
+            f"{product} --docker, commit it and release again.",
+            fg="red",
+        )
+        raise SystemExit(1)
+
     ignored = subprocess.run(
         ["git", "check-ignore", "--no-index", *RELEASE_ARTIFACTS],
         capture_output=True,
@@ -216,6 +229,28 @@ def write_release_artifacts(
         # The release about to publish the first image has no tag yet.
         publishes_image=publishes_image,
     )
+    if publishes_image:
+        # Resolved afresh for every release, so each one picks up the
+        # third-party fixes PyPI has, and committed, so a rebuild of the tag
+        # installs exactly what the release did.
+        require_docker()
+        click.echo("  lock     resolving the third-party packages...")
+        try:
+            pinned = resolve_lock(
+                product, workspace, os.path.join(product_path, "docker")
+            )
+        except subprocess.CalledProcessError:
+            click.secho(
+                "  error: the image's build stage did not build, so the "
+                "third-party packages could not be pinned. Nothing was "
+                "committed; the version bump in pyproject.toml is still to "
+                "undo or to release again.",
+                fg="red",
+            )
+            raise SystemExit(1)
+        click.echo(
+            f"  lock     {pinned} third-party package(s) pinned in docker/{LOCK_FILE}"
+        )
     subprocess.run(
         ["git", "add", "--", *bundle.paths],
         cwd=product_path,

{splent_cli-1.31.0 → splent_cli-1.33.0/src/splent_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.31.0
+Version: 1.33.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli