You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit c2609df
Browse filesBrowse the repository at this point in the historyBrowse files
feat: Create best-in-class Python package template
This commit introduces a complete, production-ready Python package template with a modern, secure, and standardized structure.
Key Features:
* **Dependency Management:** Uses Poetry for standardized package and dependency management.
* **Code Quality:** Implements a comprehensive, self-validating `pre-commit` suite, including Ruff, Mypy, and `hadolint`, to ensure code quality and consistency.
* **Containerization:** Provides an optimized, secure, multi-stage `Dockerfile` that runs as a non-root user. The runtime stage adds the non-root user's local bin to the `PATH` for script accessibility.
* **CI/CD:** Establishes a robust GitHub Actions workflow that includes:
* Linting (via `pre-commit`)
* Testing (across multiple Python versions)
* Docker image vulnerability scanning (via Trivy)
* **Security:** Pins all third-party GitHub Actions to their full commit SHA to mitigate supply chain risks.
* **Efficiency:** Implements a robust caching strategy for Poetry dependencies using `actions/cache` and a local `.venv` to accelerate CI builds.
* **Licensing:** Updates the license to the Prosperity Public License 3.0.0, establishing a dual-licensing model (non-commercial and commercial).
* **Metadata:** Updates the package author to "CoReason, Inc."
This document outlines the CI/CD architecture for this project, including the Docker strategy and security measures.
4
+
5
+
## CI/CD Architecture
6
+
7
+
The CI/CD pipeline is built using GitHub Actions and is divided into two workflows: `ci.yml` and `docker.yml`.
8
+
9
+
-**`ci.yml`**: This workflow is triggered on `push` and `pull_request` events to the `main` and `develop` branches. It consists of two jobs:
10
+
1.**`lint`**: This job runs the `pre-commit` suite to ensure all code adheres to the defined quality and style standards.
11
+
2.**`test`**: This job runs the `pytest` suite across a matrix of Python versions (3.10, 3.11, and 3.12) to ensure the code is working as expected. It depends on the `lint` job, so it will only run if the linting passes.
12
+
13
+
-**`docker.yml`**: This workflow is triggered on `push` events to the `main` and `develop` branches. It builds, scans, and pushes a Docker image to the GitHub Container Registry.
14
+
15
+
## Docker Strategy
16
+
17
+
The `Dockerfile` is a multi-stage build to create a lean and secure production image.
18
+
19
+
-**Stage 1 (Builder)**: This stage installs Poetry, exports the project dependencies to a `requirements.txt` file, and installs them. It also installs the application itself.
20
+
-**Stage 2 (Runtime)**: This stage uses a slim Python base image, creates a non-root user, and copies the installed dependencies and application from the builder stage. This results in a smaller and more secure final image.
21
+
22
+
## Security Measures
23
+
24
+
-**Principle of Least Privilege (PoLP)**: The GitHub Actions workflows are configured with the minimum required permissions.
25
+
-**SHA Pinning**: All third-party GitHub Actions are pinned to their full commit SHA to prevent supply chain attacks.
26
+
-**Vulnerability Scanning**: The `docker.yml` workflow includes a step to scan the Docker image for vulnerabilities using Trivy. The workflow will fail if any `CRITICAL` or `HIGH` severity vulnerabilities are found.
27
+
-**Non-Root User**: The `Dockerfile` creates and runs the application as a non-root user to reduce the attack surface.
0 commit comments