ci: support tagged docker images for master branch

.github/workflows/build-docker-images.yml → .github/workflows/ci-build-docker-images.yml

@@ -3,6 +3,7 @@ name: Create and publish chap Docker image
 on:
   push:
     branches: ["dev", "master"]
+    tags: ["1.*"]
 
 env:
   REGISTRY: ghcr.io
@@ -38,11 +39,33 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ matrix.image_name }}
+      - name: Determine Docker image tag
+        id: tag
+        run: |
+          REF="${GITHUB_REF}"
+          TAG=""
+
+          if [[ "$REF" == "refs/heads/dev" ]]; then
+            TAG="dev"
+          elif [[ "$REF" == "refs/heads/master" ]]; then
+            TAG="latest"
+          elif [[ "$REF" =~ ^refs/tags/1\..* ]]; then
+            git fetch origin master --depth=1
+            TAG_COMMIT=$(git rev-parse "$REF")
+            if git merge-base --is-ancestor "$TAG_COMMIT" origin/master; then
+              TAG="${REF#refs/tags/}"
+            else
+              echo "❌ Tag does not point to a commit on master. Skipping image build."
+              exit 0
+            fi
+          else
+            echo "No valid branch or tag for image publishing"
+            exit 0
+          fi
+
+          # Output the full tag for the Docker build step
+          echo "TAGS=${{ env.REGISTRY }}/${{ matrix.image_name }}:$TAG" >> "$GITHUB_OUTPUT"
+        shell: bash
 
       - name: Build and push Docker image (amd64)
         id: push
@@ -52,8 +75,7 @@ jobs:
           file: ${{ matrix.dockerfile }}
           push: true
           platforms: linux/amd64
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.tag.outputs.TAGS }}
 
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v2

.github/workflows/push-to-pypi.yml → .github/workflows/release-push-to-pypi.yml

@@ -1,10 +1,9 @@
 name: Upload to PyPI
 
 on:
-  # run after completed bump version
   workflow_run:
-    workflows: [ "Bump version" ]
-    branches: [ master ]
+    workflows: ["Bump version"]
+    branches: [master]
     types:
       - completed
 
@@ -13,27 +12,31 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     permissions:
-        id-token: write
-    # only run if bumpversion was successful
+      id-token: write
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
 
+    strategy:
+      matrix:
+        python-version: ["3.12"]
+
     steps:
       - uses: actions/checkout@v3
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v3
         with:
-          python-version: '3.10'
+          python-version: ${{ matrix.python-version }}
+
       - name: Install uv
         uses: astral-sh/setup-uv@v3
-      - name: Set up Python ${{ matrix.python-version }}
-        run: uv python install ${{ matrix.python-version }}
+
       - name: Install the project
         run: uv sync --dev
+
       - name: Build package
         run: |
           source .venv/bin/activate
           python -m build
+
       - name: Publish package
         uses: pypa/gh-action-pypi-publish@release/v1
-      #  with:
-      #    password: ${{ secrets.PYPI_API_TOKEN }}

Dockerfile.inla

@@ -1,42 +1,38 @@
-# installs chap with support for some external models
 FROM ivargr/r_inla
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
-RUN apt-get update
-RUN apt-get install -y python3
-RUN apt-get install -y python3-pip
-RUN apt-get install -y libncurses-dev
-RUN apt-get install -y libreadline-dev
-RUN apt-get install -y libbz2-dev
+# Enable bytecode compilation and safe volume handling
+ENV UV_COMPILE_BYTECODE=1
+ENV UV_LINK_MODE=copy
 
+# Set working directory
+WORKDIR /app
 
-# Set the working directory in the container
-
-# Install the Python dependencies
+# Install all system packages in a single layer
 RUN apt-get update && \
-    apt-get upgrade -y && \
-    apt-get install -y git
-
-# Install pyenv
-RUN sudo apt-get install libffi-dev
-RUN git clone --depth=1 https://github.com/pyenv/pyenv.git .pyenv
-
-ENV PYENV_ROOT="/.pyenv"
-ENV PATH="$PYENV_ROOT/shims:$PYENV_ROOT/bin:$PATH"
-RUN pyenv install 3.11.3
-# RUN pyenv global 3.11.3
-
-WORKDIR /app
+    apt-get install -y --no-install-recommends \
+    git \
+    libncurses-dev \
+    libreadline-dev \
+    libbz2-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+# First install only the dependencies using the lockfile (no source code yet)
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync --frozen --no-install-project --no-dev
+
+# Copy source files
 COPY ./chap_core ./chap_core
 COPY ./config ./config
-COPY ./pyproject.toml ./pyproject.toml
-COPY ./README.md ./README.md
-
-RUN git clone https://github.com/pyenv/pyenv.git /pyenv
-ENV PYENV_ROOT /pyenv
+COPY ./pyproject.toml .
+COPY ./uv.lock .
+COPY ./README.md .
 
-# get uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
-RUN uv sync
+# Now install the project (with dependencies already cached)
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev
 
-# RUN pip install --upgrade pip
-# RUN uv pip install --system -e .
+# Final environment path setup
+ENV PATH="/app/.venv/bin:$PATH"

pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "chap_core"
-version = "1.0.4"
+version = "1.0.9"
 description = "Climate Health Analysis Platform (CHAP)"
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.12"
 
 authors = [{ name = "Sandvelab", email = "knutdrand@gmail.com" }]
 license = { text = "AGPLv3 license" }
@@ -113,4 +113,3 @@ norecursedirs = [
     ".mypy_cache",
 ]
 ignore = ['tests/test_meteostat_wrapper']
-