Adapt packaging and image build for free-threaded containers

.dockerignore

@@ -1,6 +1,7 @@
 # Ignore build and dependency directories
 dist
 build
+*.egg-info
 sbcli*
 
 # Ignore logs
@@ -14,9 +15,23 @@ sbcli*
 # these can carry outdated, vulnerable copies of pip/setuptools/wheel
 # that trip up the Trivy image scan)
 .tox
+.venv
+venv
 .mypy_cache
 .ruff_cache
 .pytest_cache
+__pycache__
+
+# Ignore the test suite and the tooling that only ever runs on a developer
+# machine or a CI runner — keeping them out of the context means editing them
+# does not invalidate the image's source layer.
+tests
+.github
+.agents
+.claude
+docs
+assets
+tox.ini
 
 # Ignore Docker-related files
 Dockerfile
@@ -33,5 +48,3 @@ Thumbs.db
 
 # git folder
 .git
-
-# Ignore generated sbcli files

.github/workflows/docker-image-2.yml

@@ -19,14 +19,19 @@ on:
         default: false
         type: boolean
 
+env:
+  IMAGE_NAME: simplyblock/simplyblock
+  ECR_IMAGE_NAME: public.ecr.aws/simply-block/simplyblock
+  QUAY_IMAGE_NAME: quay.io/simplyblock-io/simplyblock
+
 jobs:
 
   build:
 
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@v7
 
     - name: Set docker image tag
       id: get_info
@@ -38,7 +43,14 @@ jobs:
           echo "TAG=$(echo ${GITHUB_REF#refs/*/} | sed 's/\//-/g')" >> $GITHUB_ENV
         fi
         echo "BRANCH=$([ -z '${{ github.event.pull_request.head.sha }}' ] && echo ${GITHUB_REF#refs/*/} || echo $GITHUB_HEAD_REF)" >> $GITHUB_ENV
-        echo "SHA=$([ -z '${{ github.event.pull_request.head.sha }}' ] && echo $GITHUB_SHA || echo '${{ github.event.pull_request.head.sha }}')" >> $GITHUB_ENV
+        SHA=$([ -z '${{ github.event.pull_request.head.sha }}' ] && echo $GITHUB_SHA || echo '${{ github.event.pull_request.head.sha }}')
+        echo "SHA=$SHA" >> $GITHUB_ENV
+        echo "SHORT_SHA=$(echo $SHA | head -c 8)" >> $GITHUB_ENV
+
+    # ISO year and week, so the OS-package layers are rebuilt from scratch once
+    # a week and an upstream security fix reaches the image within seven days.
+    - name: Set base layer cache key
+      run: echo "CACHE_KEY=$(date -u +%G-W%V)" >> $GITHUB_ENV
 
     - name: Login to Quay.io
       uses: docker/login-action@v3
@@ -73,20 +85,44 @@ jobs:
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
 
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Extract metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          name=${{ env.IMAGE_NAME }},enable=${{ inputs.push_to_docker }}
+          name=${{ env.ECR_IMAGE_NAME }},enable=${{ inputs.push_to_ecr }}
+          name=${{ env.QUAY_IMAGE_NAME }},enable=${{ inputs.push_to_quay }}
+        tags: |
+          type=raw,value=${{ env.TAG }}
+          type=raw,value=${{ env.TAG }}-${{ env.SHORT_SHA }}
+
+    # One build, fanned out to every selected registry — the image is identical
+    # across them, so building it once per registry only burns runner time.
     - name: Build & Push
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: docker/Dockerfile
+        platforms: linux/amd64,linux/arm64
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: CACHE_KEY=${{ env.CACHE_KEY }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Report published tags
       run: |
-        SHORT_SHA=$(echo ${{ env.SHA }} | head -c 8)
-        docker buildx ls
-        docker buildx create --name mybuilder --bootstrap --use
-         if [ "${{ inputs.push_to_docker }}" == "true" ]; then
-          docker buildx build --platform linux/amd64,linux/arm64 -t simplyblock/simplyblock:$TAG -t simplyblock/simplyblock:$TAG-$SHORT_SHA -f docker/Dockerfile . --push
-          echo "::notice title=Docker.com::simplyblock/simplyblock:$TAG"
+        if [ "${{ inputs.push_to_docker }}" == "true" ]; then
+          echo "::notice title=Docker.com::${{ env.IMAGE_NAME }}:${{ env.TAG }}"
         fi
         if [ "${{ inputs.push_to_ecr }}" == "true" ]; then
-          docker buildx build --platform linux/amd64,linux/arm64 -t public.ecr.aws/simply-block/simplyblock:$TAG -t public.ecr.aws/simply-block/simplyblock:$TAG-$SHORT_SHA -f docker/Dockerfile . --push
-          echo "::notice title=AWS-ECR::public.ecr.aws/simply-block/simplyblock:$TAG"
+          echo "::notice title=AWS-ECR::${{ env.ECR_IMAGE_NAME }}:${{ env.TAG }}"
         fi
         if [ "${{ inputs.push_to_quay }}" == "true" ]; then
-          docker buildx build --platform linux/amd64,linux/arm64 -t quay.io/simplyblock-io/simplyblock:$TAG -f docker/Dockerfile . --push
-          echo "::notice title=Quay.io::quay.io/simplyblock-io/simplyblock:$TAG"
+          echo "::notice title=Quay.io::${{ env.QUAY_IMAGE_NAME }}:${{ env.TAG }}"
         fi

.github/workflows/docker-image-quay.yml

@@ -3,12 +3,15 @@ name: Push to Quay.io
 on:
   workflow_dispatch:
 
+env:
+  QUAY_IMAGE_NAME: quay.io/simplyblock-io/simplyblock
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set docker image tag
         id: get_info
@@ -20,7 +23,13 @@ jobs:
             echo "TAG=$(echo ${GITHUB_REF#refs/*/} | sed 's/\//-/g')" >> $GITHUB_ENV
           fi
 
-      - name: Login to Docker Hub
+      # ISO year and week, so the OS-package layers are rebuilt from scratch
+      # once a week and an upstream security fix reaches the image within
+      # seven days.
+      - name: Set base layer cache key
+        run: echo "CACHE_KEY=$(date -u +%G-W%V)" >> $GITHUB_ENV
+
+      - name: Login to Quay.io
         uses: docker/login-action@v3
         with:
           username:  ${{ secrets.QUAY_USERNAME }}
@@ -30,11 +39,28 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.QUAY_IMAGE_NAME }}
+          tags: type=raw,value=${{ env.TAG }}
+
       - name: Build & Push
-        run: |
-          SHORT_SHA=$(echo ${{ env.SHA }} | head -c 8)
-          docker buildx ls
-          docker buildx create --name mybuilder --bootstrap --use
-          docker buildx build --platform linux/amd64,linux/arm64 -t quay.io/simplyblock-io/simplyblock:$TAG -f docker/Dockerfile . --push
-
-          echo "::notice title=quay.io/simplyblock-io/simplyblock:$TAG"
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: CACHE_KEY=${{ env.CACHE_KEY }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Report published tags
+        run: echo "::notice title=Quay.io::${{ env.QUAY_IMAGE_NAME }}:${{ env.TAG }}"

.github/workflows/docker-image.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - '**'
 
+env:
+  IMAGE_NAME: simplyblock/simplyblock
+  ECR_IMAGE_NAME: public.ecr.aws/simply-block/simplyblock
 
 jobs:
 
@@ -14,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@v7
 
     - name: Set docker image tag
       id: get_info
@@ -26,7 +29,14 @@ jobs:
           echo "TAG=$(echo ${GITHUB_REF#refs/*/} | sed 's/\//-/g')" >> $GITHUB_ENV
         fi
         echo "BRANCH=$([ -z '${{ github.event.pull_request.head.sha }}' ] && echo ${GITHUB_REF#refs/*/} || echo $GITHUB_HEAD_REF)" >> $GITHUB_ENV
-        echo "SHA=$([ -z '${{ github.event.pull_request.head.sha }}' ] && echo $GITHUB_SHA || echo '${{ github.event.pull_request.head.sha }}')" >> $GITHUB_ENV
+        SHA=$([ -z '${{ github.event.pull_request.head.sha }}' ] && echo $GITHUB_SHA || echo '${{ github.event.pull_request.head.sha }}')
+        echo "SHA=$SHA" >> $GITHUB_ENV
+        echo "SHORT_SHA=$(echo $SHA | head -c 8)" >> $GITHUB_ENV
+
+    # ISO year and week, so the OS-package layers are rebuilt from scratch once
+    # a week and an upstream security fix reaches the image within seven days.
+    - name: Set base layer cache key
+      run: echo "CACHE_KEY=$(date -u +%G-W%V)" >> $GITHUB_ENV
 
     - name: Login to Docker Hub
       uses: docker/login-action@v3
@@ -50,13 +60,34 @@ jobs:
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
 
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Extract metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          ${{ env.IMAGE_NAME }}
+          ${{ env.ECR_IMAGE_NAME }}
+        tags: |
+          type=raw,value=${{ env.TAG }}
+          type=raw,value=${{ env.TAG }}-${{ env.SHORT_SHA }}
+
     - name: Build & Push
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: docker/Dockerfile
+        platforms: linux/amd64,linux/arm64
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: CACHE_KEY=${{ env.CACHE_KEY }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Report published tags
       run: |
-        SHORT_SHA=$(echo ${{ env.SHA }} | head -c 8)
-        docker buildx ls
-        docker buildx create --name mybuilder --bootstrap --use
-        docker buildx build --platform linux/amd64,linux/arm64 -t simplyblock/simplyblock:$TAG -t public.ecr.aws/simply-block/simplyblock:$TAG  -f docker/Dockerfile . --push
-        docker buildx build --platform linux/amd64,linux/arm64 -t simplyblock/simplyblock:$TAG-$SHORT_SHA -t public.ecr.aws/simply-block/simplyblock:$TAG-$SHORT_SHA -f docker/Dockerfile . --push
-
-        echo "::notice title=Docker.com::simplyblock/simplyblock:$TAG"
-        echo "::notice title=AWS-ECR::public.ecr.aws/simply-block/simplyblock:$TAG"
+        echo "::notice title=Docker.com::${{ env.IMAGE_NAME }}:${{ env.TAG }}"
+        echo "::notice title=AWS-ECR::${{ env.ECR_IMAGE_NAME }}:${{ env.TAG }}"

.github/workflows/python-checks.yml

@@ -26,7 +26,7 @@ jobs:
         cache: 'pip'
 
     - name: Install tox
-      run: pip install tox
+      run: pip install tox tox-uv
 
     - name: Checking cli.py status
       run: |
@@ -39,6 +39,23 @@ jobs:
         fi
 
 
+  lock:
+    name: Lockfile up to date
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v7
+
+    - name: Install uv
+      run: pip install uv
+
+    # Fails if uv.lock no longer matches pyproject.toml. The image build uses
+    # `uv sync --locked`, so a stale lock breaks the build rather than silently
+    # resolving something new -- this reports it on the PR instead.
+    - name: Check uv.lock
+      run: uv lock --check
+
+
   lint:
     name: Linter
     runs-on: ubuntu-latest
@@ -58,6 +75,14 @@ jobs:
     - name: Execute linter
       run: ruff check
 
+    # ruff's target version comes from requires-python (>=3.9); this asserts the
+    # sources also parse on the interpreter the image actually runs.
+    - name: Check sources parse on the image interpreter
+      run: |
+        pip install uv
+        uv run --python 3.14t --no-project -- \
+          python -m compileall -q simplyblock_core simplyblock_web simplyblock_cli
+
 
   types:
     name: Type checker
@@ -72,11 +97,8 @@ jobs:
         python-version: '3.9'
         cache: 'pip'
 
-    - name: Install type checker
-      run: pip install mypy 
+    - name: Install tox
+      run: pip install tox tox-uv
 
     - name: Execute type checker
-      run: |
-        pip install -r requirements.txt
-        pip install -r type-requirements.txt
-        mypy simplyblock_web simplyblock_cli simplyblock_core
+      run: tox run -e types