Merge pull request #152 from open-contracting/docker

Docker

Author: jpmckinney

.dockerignore

@@ -0,0 +1,26 @@
+# Dotfiles
+**/.*
+
+# Docker
+**/Dockerfile*
+
+# Requirements
+**/requirements.in
+**/requirements_dev.in
+**/requirements_dev.txt
+
+# Documentation
+docs
+LICENSE
+README.md
+README.rst
+
+# Configuration
+pyproject.toml
+
+# Testing
+**/tests
+pytest.ini
+
+# Generated files
+**/node_modules

.github/workflows/ci.yml

@@ -8,13 +8,14 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           cache: pip
           cache-dependency-path: '**/requirements*.txt'
       - run: pip install -r requirements.txt
       # Check requirements.txt contains production requirements.
       - run: ./manage.py --help
       - run: pip install -r requirements_dev.txt
+      - run: ./manage.py collectstatic --noinput -v2
       - name: Run checks and tests
         env:
           PYTHONWARNINGS: error
@@ -23,5 +24,5 @@ jobs:
           ./manage.py migrate
           ./manage.py makemigrations --check --dry-run
           ./manage.py check --fail-level WARNING
-          coverage run --source=cove_oc4ids,cove_project -m pytest -W error
+          coverage run --source=core,cove_oc4ids -m pytest -W error
       - uses: coverallsapp/github-action@v2

.github/workflows/docker.yml

@@ -0,0 +1,38 @@
+name: Deploy
+on:
+  workflow_run:
+    workflows: ["CI"]
+    branches: [main]
+    types:
+      - completed
+jobs:
+  docker:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # https://github.com/docker/login-action#github-container-registry
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # https://github.com/docker/setup-buildx-action#usage
+      - uses: docker/setup-buildx-action@v3
+      # https://github.com/docker/build-push-action#usage
+      - uses: docker/build-push-action@v6
+        with:
+          push: true
+          file: Dockerfile_django
+          tags: |
+            ghcr.io/${{ github.repository }}-django:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - uses: docker/build-push-action@v6
+        with:
+          push: true
+          file: Dockerfile_static
+          tags: |
+            ghcr.io/${{ github.repository }}-static:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/i18n.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           cache: pip
           cache-dependency-path: '**/requirements*.txt'
       - name: Install translate-toolkit

.github/workflows/lint.yml

@@ -14,7 +14,7 @@ jobs:
           token: ${{ secrets.PAT || github.token }}
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           cache: pip
           cache-dependency-path: '**/requirements*.txt'
       - id: changed-files

.gitignore

@@ -7,3 +7,4 @@ __pycache__
 .coverage
 .ve
 /media
+/static

.pre-commit-config.yaml

@@ -2,7 +2,7 @@ ci:
   autoupdate_schedule: quarterly
   skip: [pip-compile]
 default_language_version:
-    python: python3.10
+    python: python3.11
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.6.3

.python-version

@@ -1 +1 @@
-3.10
+3.11

Dockerfile_django

@@ -0,0 +1,43 @@
+FROM python:3.11 as build-stage
+
+COPY requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir -r /tmp/requirements.txt
+
+WORKDIR /workdir
+
+COPY . .
+
+ENV DJANGO_ENV=production
+
+RUN python manage.py collectstatic --noinput -v2
+
+FROM python:3.11
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      gettext \
+   && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd -r runner && useradd --no-log-init -r -g runner runner
+
+# Must match the settings.DATABASES default value.
+RUN mkdir -p /data/db && chown -R runner:runner /data/db
+# Must match the settings.MEDIA_ROOT default value.
+RUN mkdir -p /data/media && chown -R runner:runner /data/media
+
+COPY requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir -r /tmp/requirements.txt
+
+WORKDIR /workdir
+USER runner:runner
+COPY --chown=runner:runner . .
+
+# Django needs a copy of the staticfiles.json manifest file.
+COPY --from=build-stage --chown=runner:runner /workdir/static/staticfiles.json /workdir/static/staticfiles.json
+
+ENV DJANGO_ENV=production
+ENV WEB_CONCURRENCY=2
+
+RUN python manage.py compilemessages
+
+EXPOSE 8000
+CMD ["gunicorn", "core.wsgi", "--bind", "0.0.0.0:8000", "--worker-tmp-dir", "/dev/shm", "--threads", "2", "--name", "cove"]

Dockerfile_static

@@ -0,0 +1,17 @@
+FROM python:{{ cookiecutter.python_version }} as build-stage
+
+COPY requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir -r /tmp/requirements.txt
+
+WORKDIR /workdir
+COPY . .
+
+ENV DJANGO_ENV=production
+
+RUN python manage.py collectstatic --noinput -v2
+
+FROM nginxinc/nginx-unprivileged:latest as production-stage
+USER root
+COPY --from=build-stage --chown=nginx:root /workdir/static /usr/share/nginx/html/static
+COPY --chown=nginx:root default.conf /etc/nginx/conf.d/default.conf
+USER nginx