Migrate to uv, fix Dependabot vulnerabilities, upgrade deps

.docker.env

@@ -0,0 +1,12 @@
+MYSQL_HOST=db
+MYSQL_PORT=3306
+MYSQL_DATABASE=bot_dev
+MYSQL_USER=bot
+MYSQL_PASSWORD=not_a_password
+
+MARIADB_DATABASE=bot_dev
+MARIADB_USER=bot
+MARIADB_PASSWORD=not_a_password
+MARIADB_ROOT_PASSWORD=root
+
+DOCKER_DB_PORT=3306

.dockerignore

@@ -7,6 +7,6 @@
 !resources
 !alembic.ini
 !pyproject.toml
-!poetry.lock
+!uv.lock
 !startup.sh
 !.env

.github/workflows/deploy.yaml

@@ -23,23 +23,30 @@ jobs:
       DEPLOYMENT_NAME: ${{ (contains(github.ref, '-rc')) && 'hackster-dev' || 'hackster' }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - name: Derive git version
+        id: git-version
+        run: echo "value=$(git describe --tags --always --dirty)" >> "$GITHUB_OUTPUT"
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           push: true
           context: .
           tags: ${{ env.DOCKER_IMAGE }},${{ env.LATEST_IMAGE }}
+          build-args: |
+            VERSION=${{ steps.git-version.outputs.value }}
       - name: Rollout release
-        uses: makelarisjr/kubectl-action@v1
+        uses: makelarisjr/kubectl-action@6a140d582feb88b20e91ee8e35d15c255865ab32 # v1
         with:
           config: ${{ secrets.KUBE_CONFIG_DATA }}
           command: |

.github/workflows/test.yaml

@@ -18,48 +18,28 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        with:
+          enable-cache: true
 
       - id: setup-python
         name: Set up Python 3.13
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.13
 
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
-        with:
-          version: 2.1.3
-          virtualenvs-create: true
-          virtualenvs-in-project: true
-          installer-parallel: true
-
-      # Only when the context is exactly the same, we will restore the cache.
-      - name: Load cached venv
-        id: restore-poetry-dependencies
-        uses: actions/cache/restore@v4
-        with:
-          path: .venv
-          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
-
-      - name: Create venv and install dependencies
-        if: steps.restore-poetry-dependencies.outputs.cache-hit != 'true'
-        run: poetry install --with dev
-
-      - id: cache-poetry-dependencies
-        name: Cache venv
-        if: steps.restore-poetry-dependencies.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: .venv
-          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
+      - name: Install dependencies
+        run: uv sync --dev
 
       - name: Run tests with pytest and generate coverage report
         run: |
-          ENV_PATH=".test.env" poetry run task test
-          poetry run task coverage xml
+          ENV_PATH=".test.env" uv run task test
+          uv run task coverage xml
 
       - name: Upload coverage reports to CodeCov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.pre-commit-config.yaml

@@ -15,8 +15,8 @@ repos:
     hooks:
       - id: flake8
         name: Flake8
-        description: This hook runs flake8 within this project's poetry environment.
-        entry: poetry run flake8
+        description: This hook runs flake8 within this project's uv environment.
+        entry: uv run flake8
         language: system
         types: [ python ]
         require_serial: true

CONTRIBUTING.md

@@ -43,10 +43,10 @@ Please ensure that the following is fulfilled:
 
 ## Before commits
 
-Install the project git hooks using [poetry]
+Install the project git hooks using [uv]
 
 ```shell
-poetry run task precommit
+uv run task precommit
 ```
 
 Now `pre-commit` will run automatically on `git commit`
@@ -67,11 +67,11 @@ Flake8...................................................................Passed
 Or you can run it manually
 
 ```shell
-poetry run task lint
+uv run task lint
 ```
 
 [flake8]: https://flake8.pycqa.org/en/latest/
 
 [pre-commit]: https://pre-commit.com/
 
-[poetry]: https://python-poetry.org/
+[uv]: https://docs.astral.sh/uv/

Dockerfile

@@ -1,15 +1,43 @@
-FROM ghcr.io/hackthebox/hackster:base as builder-base
-# `production` image used for runtime
-FROM builder-base as production
+ARG PYTHON_VERSION=3.13
 
-RUN apt-get update && \
-    apt-get install -y mariadb-client libmariadb-dev && \
-    rm -rf /var/lib/apt/lists/*
+FROM astral/uv:python${PYTHON_VERSION}-bookworm-slim AS builder
 
-COPY --from=builder-base $APP_PATH $APP_PATH
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
+ENV APP_PATH="/opt/hackster"
+ENV VENV_PATH="$APP_PATH/.venv"
+ENV PATH="$VENV_PATH/bin:$PATH"
+
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y \
+    build-essential \
+    libmariadb-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR $APP_PATH
+COPY ./uv.lock ./pyproject.toml ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM astral/uv:python${PYTHON_VERSION}-bookworm-slim AS runtime
+
+ARG VERSION=unknown
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
+ENV APP_PATH="/opt/hackster"
+ENV VENV_PATH="$APP_PATH/.venv"
+ENV PATH="$VENV_PATH/bin:$PATH"
+
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y \
+    mariadb-client \
+    libmariadb3 \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR $APP_PATH
 
+COPY --from=builder $VENV_PATH $VENV_PATH
+
 COPY alembic ./alembic
 COPY alembic.ini ./alembic.ini
 COPY src ./src
@@ -19,6 +47,7 @@ COPY pyproject.toml ./pyproject.toml
 RUN chmod +x startup.sh
 
 ENV PYTHONPATH=$APP_PATH
+ENV VERSION=$VERSION
 
 EXPOSE 1337
 # Run the start script, it will check for an /app/prestart.sh script (e.g. for migrations)