mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
b9b06a7351
Trivy raised DS-0026 ("No HEALTHCHECK defined") against Dockerfile.test
on every run of the security workflow. The test image is a one-shot
pytest runner — there's no service to probe, so any HEALTHCHECK we
invented would be cargo-cult noise that fires once and means nothing.
HEALTHCHECK NONE is the documented Docker directive to explicitly opt
out of any inherited HEALTHCHECK and is the way Trivy itself expects
projects to signal "this image is intentionally not a long-running
service." Adding it closes code-scanning alert #813 cleanly.
Note: the perl-base CVE-2026-8376 alert (#811) is left open for now
and dismissed in the GitHub UI as "Won't fix - no upstream patch"
because Debian Trixie has not yet shipped a fixed perl-base; the
patched build will land automatically on the next base-image refresh.
68 lines
2.4 KiB
Text
68 lines
2.4 KiB
Text
# Test image for running backend and frontend tests
|
|
# syntax=docker/dockerfile:1.7
|
|
FROM python:3.13-slim AS backend-test
|
|
|
|
WORKDIR /app
|
|
|
|
# Install system dependencies for testing
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Python dependencies including test dependencies.
|
|
# BuildKit cache mount makes subsequent builds re-use the pip download
|
|
# cache so the second build only does install work — the slow ~60-90s
|
|
# fetch step from the first build becomes ~5s. Requires DOCKER_BUILDKIT=1
|
|
# (already set in test_docker.sh).
|
|
COPY requirements.txt ./
|
|
COPY requirements-dev.txt ./
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
pip install -r requirements.txt -r requirements-dev.txt
|
|
|
|
# Copy backend code
|
|
COPY backend/ ./backend/
|
|
COPY pyproject.toml ./
|
|
|
|
# Embedded GCode viewer assets — required so the @app.get("/gcode-viewer/...")
|
|
# packaging-regression test in tests/integration/test_gcode_viewer.py actually
|
|
# runs instead of pytest-skipping with "index.html not present". Path matches
|
|
# the production Dockerfile (static_dir.parent / "gcode_viewer" = /app/gcode_viewer/).
|
|
COPY gcode_viewer/ ./gcode_viewer/
|
|
|
|
# Create necessary directories
|
|
RUN mkdir -p /app/data /app/logs /app/archive
|
|
|
|
# Environment variables for testing
|
|
ENV PYTHONUNBUFFERED=1
|
|
ENV DATA_DIR=/app/data
|
|
ENV TESTING=1
|
|
|
|
# Test image runs pytest and exits — there is no long-running service
|
|
# to probe. HEALTHCHECK NONE is the documented Docker opt-out and
|
|
# silences Trivy DS-0026 without adding meaningless probe logic.
|
|
HEALTHCHECK NONE
|
|
|
|
# Default command runs pytest (excluding docker integration tests).
|
|
# -v dropped: 5300+ "PASSED foo::bar" lines per worker eat noticeable
|
|
# stdout I/O time and clutter test_docker.sh output. --tb=short still
|
|
# gives full failure tracebacks when something breaks.
|
|
# -n auto adapts to the host's vCPU count instead of hard-coding 30 —
|
|
# on a 2-vCPU CI / VM runner, -n 30 spawns 30 Python processes fighting
|
|
# for 2 cores, which is mostly IPC + import-thrash overhead.
|
|
CMD ["pytest", "backend/tests/", "--tb=short", "-p", "no:cacheprovider", "-n", "auto"]
|
|
|
|
# -------------------------------------------
|
|
# Frontend test stage
|
|
FROM node:22-bookworm-slim AS frontend-test
|
|
|
|
WORKDIR /app/frontend
|
|
|
|
# Copy package files and install
|
|
COPY frontend/package*.json ./
|
|
RUN npm ci
|
|
|
|
# Copy frontend source
|
|
COPY frontend/ ./
|
|
|
|
# Default command runs tests
|
|
CMD ["npm", "test", "--", "--run"]
|