From db8784a67584d3de97269ba620bcd8929fdf87a2 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Thu, 8 Oct 2026 15:50:52 +0200 Subject: [PATCH 1/4] fix: install python template dev tools as a dependency group --- templates/python/pyproject.toml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/templates/python/pyproject.toml b/templates/python/pyproject.toml index 4909037..fda9f31 100644 --- a/templates/python/pyproject.toml +++ b/templates/python/pyproject.toml @@ -7,7 +7,9 @@ dependencies = [ "uvicorn[standard]>=0.30.0", ] -[project.optional-dependencies] +# A dependency group, not an optional extra: `uv sync` installs the `dev` group by +# default (and `--no-dev` skips it), but installs extras only with `--extra`. +[dependency-groups] dev = [ "ruff>=0.9.0", "pytest>=8.0", From 7f8665e9b1988acf053304e2baccc3395526ba30 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Thu, 8 Oct 2026 15:50:52 +0200 Subject: [PATCH 2/4] fix: keep python template venv outside the bind mount --- templates/python/Dockerfile | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/templates/python/Dockerfile b/templates/python/Dockerfile index c7a8b2f..8d23dd6 100644 --- a/templates/python/Dockerfile +++ b/templates/python/Dockerfile @@ -11,8 +11,13 @@ FROM python:3.12-slim-bookworm AS base # with pip; this project keeps uv because it has a uv.lock. COPY --from=ghcr.io/astral-sh/uv:0.12.8 /uv /uvx /bin/ +# The venv lives outside /app so the docker compose bind mount of ./:/app does +# not hide it, and its bin directory is on PATH so the workflows can call +# `pytest`, `ruff` and `basedpyright` directly. ENV PYTHONDONTWRITEBYTECODE=1 \ - PYTHONUNBUFFERED=1 + PYTHONUNBUFFERED=1 \ + UV_PROJECT_ENVIRONMENT=/opt/venv \ + PATH="/opt/venv/bin:$PATH" # Non-root user matching the k8s securityContext (runAsUser/runAsGroup: 1000). RUN groupadd --gid 1000 app \ @@ -23,11 +28,12 @@ RUN apt-get update \ && rm -rf /var/lib/apt/lists/* WORKDIR /app -RUN chown app:app /app +RUN mkdir /opt/venv \ + && chown app:app /app /opt/venv USER app -# Copy project files as the app user so /app/.venv (created by `uv sync` below) +# Copy project files as the app user so /opt/venv (created by `uv sync` below) # is owned by UID 1000 from the start. COPY --chown=app:app pyproject.toml uv.lock ./ COPY --chown=app:app src/ ./src/ From a8a95e0567af656fd3d92790f3c99a412701dad9 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Thu, 8 Oct 2026 15:50:52 +0200 Subject: [PATCH 3/4] docs: add python template fixes to CHANGELOG --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e33c7ea..cce356e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ Changelog", this file is a reverse-chronological list of merged pull requests. ## Open PR's +- [PR-XXX](https://github.com/itk-dev/devops_itkdev-docker/pull/XXX) - 2026-10-08 - + Python template: install dev tools as a `[dependency-groups]` group so + `uv sync` picks them up, and keep the venv in `/opt/venv` on `PATH` so the + `./:/app` bind mount does not hide it - [PR-155](https://github.com/itk-dev/devops_itkdev-docker/pull/155) - 2026-10-05 - Python template: select the services to lint and test by the label `dk.itkdev.language: python` instead of `dk.itkdev.python: "true"` From 7707c530d470ee7963ee42110db3b51f3f8595a7 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Thu, 8 Oct 2026 15:54:36 +0200 Subject: [PATCH 4/4] docs: set PR number in CHANGELOG --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cce356e..a0618cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ Changelog", this file is a reverse-chronological list of merged pull requests. ## Open PR's -- [PR-XXX](https://github.com/itk-dev/devops_itkdev-docker/pull/XXX) - 2026-10-08 - +- [PR-156](https://github.com/itk-dev/devops_itkdev-docker/pull/156) - 2026-10-08 - Python template: install dev tools as a `[dependency-groups]` group so `uv sync` picks them up, and keep the venv in `/opt/venv` on `PATH` so the `./:/app` bind mount does not hide it