Future code base components? (python 3.12 / pyproject.toml vs setup.py / poetry vs pip-pipenv-twine-... / docker improvements)

.github/workflows/build-publish.yml

@@ -1,43 +1,97 @@
 ---
 
-name: Build and Publish Release via PyPi
+name: Build and Publish Release to PyPI & GitHub
 
 on: push
 
 jobs:
-  build-n-publish:
-    name: Build and publish Python 🐍 distributions 📦 to PyPI and TestPyPI
+  build:
+    name: Build distribution 📦
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@master
-    - name: Update version file ⬆️
+    - name: Checkout repository 🛒
+      uses: actions/checkout@v4
+    - name: Update version in pyproject.toml ⬆️
       uses: brettdorrans/[email protected]
       with:
-        filename: '.VERSION'
-        placeholder: '${VERSION}'
-
-    - name: Set up Python 3.12
+        filename: 'pyproject.toml'
+        placeholder: '1.0.0.dev1'
+    - name: Set up Python 3.12 🐍
       uses: actions/setup-python@v5
       with:
         python-version: "3.12"
+    - name: Install and configure Poetry 📜
+      uses: snok/install-poetry@v1
+      with:
+        virtualenvs-create: false
+    - name: Build & Package project 👷
+      run: poetry build
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+  publish-to-pypi:
+    name: Publish Python 🐍 distribution 📦 to PyPI
+    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/withings-sync
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: ${{ secrets.PYPI_API_TOKEN }}  # LEAVING THIS HERE UNTIL TRUSTED PUBLISHING IS IN PLACE
 
-    - name: Install pypa/build
-      run: >-
-        python -m
-        pip install
-        build
-        --user
+  publish-to-github-release:
+    name: Upload the Python 🐍 distribution to GitHub Release
+    if: startsWith(github.ref, 'refs/tags/')  # only upload to GitHub Release on tag pushes
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Release
+      uses: fnkr/github-action-ghr@v1
+      env:
+        GHR_PATH: dist/
+        GHR_REPLACE: true
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Build a source tarball
-      run: >-
-        python -m
-        build
-        --sdist
-        --outdir dist/ .
 
-    - name: Publish distribution 📦 to PyPI
-      if: startsWith(github.ref, 'refs/tags')
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/withings-sync
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to TestPyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
+        repository-url: https://test.pypi.org/legacy/
+        skip-existing: true

.github/workflows/docker-image.yml

@@ -2,64 +2,55 @@
 
 name: Publish Docker Image
 
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-on:
-  schedule:
-    - cron: '21 5 */5 * *'
-  push:
-    branches: [ master ]
-    # Publish semver tags as releases.
-    tags: [ 'v*.*.*' ]
+on: push
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build-and-push-image:
+    name: Build and publish Docker image 📦 to ghcr 🗃️
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
 
     steps:
-      - name: Checkout repository
+      - name: Checkout repository 🛒 
         uses: actions/checkout@v4
 
-      - name: Update version file ⬆️
+      - name: Update version in pyproject.toml ⬆️
         uses: brettdorrans/[email protected]
         with:
-          filename: '.VERSION'
-          placeholder: '${VERSION}'
+          filename: 'pyproject.toml'
+          placeholder: '1.0.0.dev1'
 
-      - name: Set up QEMU
+      - name: Set up QEMU 👷
         uses: docker/setup-qemu-action@v3
 
-      - name: Set up Docker Buildx
+      - name: Set up Docker Buildx 👷
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to the Container registry
+      - name: Log in to the Container registry 🗃️
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Extract metadata (tags, labels) for Docker 🗂️
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
-      - name: Build and push Docker image 📦 to ghcr
+      - name: Build and push Docker image 📦 to ghcr 🗃️
         uses: docker/build-push-action@v6
         with:
           context: .
-          push: true
+          push: ${{ startsWith(github.ref, 'refs/tags/') }}  # only upload to ghcr on tag pushes
+          provenance: false
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

Dockerfile

@@ -1,17 +1,33 @@
 FROM python:3.12-alpine
 
-# Install python-lxml
-RUN apk add --no-cache --virtual .build-deps \
-    gcc musl-dev \
-    libxslt-dev libxml2-dev && \
-    pip install lxml setuptools && \
-    apk del .build-deps && \
-    apk add --no-cache libxslt libxml2
+ENV PROJECT="withings-sync" \
+    PACKAGE="withings_sync"
 
-RUN mkdir -p /src
-COPY . /src
+RUN apk --no-cache add supercronic
 
-RUN cd /src && \
-    pip install .
+RUN adduser -D $PROJECT
 
-ENTRYPOINT ["withings-sync"]
+ENV PROJECT_DIR="/home/${PROJECT}"
+
+USER $PROJECT
+WORKDIR $PROJECT_DIR
+
+ENV PATH="${PROJECT_DIR}/.poetry/bin:${PATH}" \
+    PATH="${PROJECT_DIR}/.local/bin:${PATH}" \
+    PIP_ROOT_USER_ACTION=ignore \
+    PIP_DISABLE_PIP_VERSION_CHECK=on \
+    POETRY_HOME="${PROJECT_DIR}/.poetry" \
+    POETRY_NO_INTERACTION=1 \
+    POETRY_VIRTUALENVS_IN_PROJECT=1 \
+    POETRY_VIRTUALENVS_CREATE=1 \
+    POETRY_CACHE_DIR="/tmp/poetry_cache"
+
+RUN pip install poetry
+
+COPY --chown=$PROJECT:$PROJECT pyproject.toml poetry.lock README.md $PROJECT_DIR/
+RUN poetry install --without dev --no-root && rm -rf $POETRY_CACHE_DIR
+
+COPY --chown=$PROJECT:$PROJECT $PACKAGE ./$PACKAGE/
+RUN poetry install --without dev
+
+ENTRYPOINT ["poetry", "run", "withings-sync"]