Merge branch 'main' of https://github.com/robusta-dev/krr into argyle…

…-recommender
argyle-engineering · Dec 13, 2024 · bcef3f9 · bcef3f9
2 parents b215838 + 5a0c464
commit bcef3f9
Show file tree

Hide file tree

Showing 63 changed files with 4,371 additions and 2,457 deletions.
diff --git a/.github/workflows/build-on-release.yml b/.github/workflows/build-on-release.yml
@@ -8,7 +8,8 @@ jobs:
   build:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        # we build on macos-13 for x86 builds
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
 
     runs-on: ${{ matrix.os }}
 
@@ -18,7 +19,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v2
       with:
-        python-version: '3.9'
+        python-version: '3.11'
 
     - name: Install dependencies
       run: |
@@ -32,7 +33,7 @@ jobs:
         sudo apt-get install -y binutils
 
     - name: Install the Apple certificate and provisioning profile
-      if: matrix.os == 'macos-latest'
+      if: matrix.os == 'macos-latest' || matrix.os == 'macos-13' 
       env:
         BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
         P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
@@ -62,7 +63,7 @@ jobs:
         cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
 
     - name: Set version in code (Unix)
-      if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest'
+      if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13' 
       run: |
         awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
         cat ./robusta_krr/__init__.py
@@ -78,16 +79,26 @@ jobs:
       env:
         GITHUB_REF_NAME: ${{ github.ref_name }}
 
+    - name: Build with PyInstaller
+      if: matrix.os == 'macos-latest' 
+      shell: bash
+      run: |
+        pyinstaller --target-architecture arm64 krr.py
+        mkdir -p ./dist/krr/grapheme/data
+        cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json
+        cp ./intro.txt ./dist/krr/intro.txt
 
     - name: Build with PyInstaller
+      if: matrix.os != 'macos-latest'
       shell: bash
       run: |
         pyinstaller krr.py
         mkdir -p ./dist/krr/grapheme/data
         cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json
+        cp ./intro.txt ./dist/krr/intro.txt
 
     - name: Zip the application (Unix)
-      if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest'
+      if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13'
       run: |
         cd dist
         zip -r krr-${{ matrix.os }}-${{ github.ref_name }}.zip krr
@@ -113,13 +124,13 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload build as artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v4
       with:
         name: krr-${{ matrix.os }}-${{ github.ref_name }}
         path: ./krr-${{ matrix.os }}-${{ github.ref_name }}.zip
 
     - name: Clean up keychain and provisioning profile
-      if: (matrix.os == 'macos-latest') && always()
+      if: (matrix.os == 'macos-latest' || matrix.os == 'macos-13') && always()
       run: |
         security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
         rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
@@ -148,7 +159,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v2
       - name: Download MacOS artifact
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v4
         with:
           name: krr-macos-latest-${{ github.ref_name }}
       - name: Calculate hash
@@ -166,7 +177,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v2
       - name: Download Linux artifact
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v4
         with:
           name: krr-ubuntu-latest-${{ github.ref_name }}
       - name: Calculate hash

diff --git a/.github/workflows/docker-build-on-tag.yml b/.github/workflows/docker-build-on-tag.yml
@@ -13,21 +13,11 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - name: Set up gcloud CLI
-      uses: google-github-actions/setup-gcloud@v0.2.0
+    - name: Login to Docker Hub
+      uses: docker/login-action@v1
       with:
-        service_account_key: ${{ secrets.GCP_SA_KEY }}
-        project_id: genuine-flight-317411
-        export_default_credentials: true
-
-    # Configure Docker to use the gcloud command-line tool as a credential helper for authentication
-    - name: Configure Docker
-      run: |-
-        gcloud auth configure-docker us-central1-docker.pkg.dev
-
-    - name: Verify gcloud configuration
-      run: |-
-        gcloud config get-value project
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v1
@@ -38,6 +28,32 @@ jobs:
         context: .
         platforms: linux/arm64,linux/amd64
         push: true
-        tags: us-central1-docker.pkg.dev/genuine-flight-317411/devel/krr:${{ github.ref_name }}
+        tags: robustadev/krr:${{ github.ref_name }}
         build-args: |
           BUILDKIT_INLINE_CACHE=1
+
+    - name: Set up gcloud CLI
+      uses: google-github-actions/setup-gcloud@v0.2.0
+      with:
+        service_account_key: ${{ secrets.GCP_SA_KEY }}
+        project_id: genuine-flight-317411
+        export_default_credentials: true
+
+    # Configure Docker to use the gcloud command-line tool as a credential helper for authentication	
+    - name: Configure Docker	
+      run: |-	
+        gcloud auth configure-docker us-central1-docker.pkg.dev	
+
+    - name: Verify gcloud configuration	
+      run: |-	
+        gcloud config get-value project
+
+    - name: Release Docker to old repo
+      run: |-
+        docker buildx build \
+        --build-arg BUILDKIT_INLINE_CACHE=1 \
+        --platform linux/arm64,linux/amd64 \
+        --cache-from robustadev/krr:${{ github.ref_name }} \
+        --tag us-central1-docker.pkg.dev/genuine-flight-317411/devel/krr:${{ github.ref_name }} \
+        --push \
+        .
diff --git a/.github/workflows/update-code-version.yml b/.github/workflows/update-code-version.yml
diff --git a/.gitignore b/.gitignore
@@ -132,6 +132,8 @@ dmypy.json
 
 .DS_Store
 robusta_lib
+.idea
+.vscode
 
 *.private-key.pem
 k8s_repo/
diff --git a/.idea/workspace.xml b/.idea/workspace.xml
diff --git a/Dockerfile b/Dockerfile
@@ -1,17 +1,28 @@
 # Use the official Python 3.9 slim image as the base image
-FROM python:3.9-slim as builder
-
-# Set the working directory
-WORKDIR /app
+FROM python:3.12-slim as builder
+ENV LANG=C.UTF-8
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV PATH="/app/venv/bin:$PATH"
 
 # Install system dependencies required for Poetry
 RUN apt-get update && \
     dpkg --add-architecture arm64
 
+# We're installing here libexpat1, to upgrade the package to include a fix to 3 high CVEs. CVE-2024-45491,CVE-2024-45490,CVE-2024-45492
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libexpat1 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Set the working directory
+WORKDIR /app
+
 COPY ./requirements.txt requirements.txt
 
+RUN pip install --no-cache-dir --upgrade pip
 # Install the project dependencies
-RUN pip install -r requirements.txt
+RUN python -m ensurepip --upgrade
+RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy the rest of the application code
 COPY . .