chore: patch dependencies / ci: switch to uv

.github/workflows/image_build.yaml

@@ -16,25 +16,25 @@ jobs:
       packages: write
     steps:
       - name: checkout repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: container registry auth
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: generate tags, label
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=semver,pattern={{ version }}
             type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
       - name: setup buildx (w/ docker-container driver)
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - name: image build and push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           push: true

.github/workflows/main.yaml

@@ -14,19 +14,14 @@ jobs:
       matrix:
         python-version: ["3.13"]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements/ci.txt
       - name: Test with pytest
-        run: |
-          pytest --cov --cov-branch --cov-report=xml
+        run: uv run --frozen --group ci pytest --cov --cov-branch --cov-report=xml
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/pr.yaml

@@ -9,25 +9,20 @@ jobs:
       matrix:
         python-version: ["3.13"]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Setup UV and set Python ${{ matrix.python-version }}
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements/ci.txt
       - name: Test with pytest
-        run: |
-          pytest
+        run: uv run --frozen --group ci pytest
   black:
     name: Python Style
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Run black
-        uses: psf/black@af0ba72a73598c76189d6dd1b21d8532255d5942 # v25
+        uses: psf/black@782e5605c86aab56be6f905da10dcd3e463fd9c2 # 25.12.0
         with:
           options: ". --check --verbose"
   pylint:
@@ -37,24 +32,20 @@ jobs:
       matrix:
         python-version: ["3.13"]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Setup UV and set Python ${{ matrix.python-version }}
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements/ci.txt
       - name: Run pylint
         run: |
-          pylint $(git ls-files '*.py' | grep -v dnspython)
+          uv run --frozen --group ci pylint $(git ls-files '*.py' | grep -v dnspython)
   eslint:
     name: JS Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2
       - name: Setup Bun and Run ESLint
         run: |
           bun init -y
@@ -64,8 +55,8 @@ jobs:
     name: CSS Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2
       - name: Run stylelint
         run: |
           bun init -y
@@ -75,7 +66,7 @@ jobs:
     name: 'Github Actions YAML Lint'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Download actionlint
         run: |
           VERSION="1.7.7"

Dockerfile

@@ -1,30 +1,44 @@
-FROM python:3.13-slim
+FROM ghcr.io/astral-sh/uv:python3.13-trixie-slim
 
 ARG VERSION
 
-WORKDIR /app
+RUN groupadd --system --gid 999 nonroot \
+	&& useradd --system --gid 999 --uid 999 --create-home nonroot
+
+# Recommended uv options
+# Enable bytecode compilation
+ENV UV_COMPILE_BYTECODE=1
+# Copy from the cache instead of linking since it's a mounted volume
+ENV UV_LINK_MODE=copy
+# Ensure installed tools can be executed out of the box
+ENV UV_TOOL_BIN_DIR=/usr/local/bin
+# use uv to install deps
+RUN --mount=type=cache,target=/root/.cache/uv \
+	--mount=type=bind,source=uv.lock,target=uv.lock \
+	--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+	uv sync --locked --no-install-project --no-dev --group prod
+# reset entrypoint from uv
+ENTRYPOINT []
 
 # Copy the necessary files and directories into the container
+WORKDIR /app
 COPY static/ ./static/
 COPY lib/examples/ ./lib/examples/
 COPY templates/ ./templates/
 COPY zoneforge/ ./zoneforge/
-COPY requirements/  ./requirements/
-COPY app.py ./
-
-# create non-root user
-RUN useradd -m -u 1000 appuser
-RUN chown -R appuser:appuser /app
-USER appuser
+COPY app.py pyproject.toml uv.lock ./
 
-# Upgrade pip and install Python dependencies
-RUN pip3 install --upgrade pip && pip install --no-cache-dir -r requirements/prod.txt
+# install Python dependencies
+RUN --mount=type=cache,target=/root/.cache/uv \
+	uv sync --locked --no-dev --group prod
 
+RUN chown -R nonroot:nonroot /app
+USER nonroot
 ENV CONTAINER="true"
 ENV VERSION=$VERSION
 ENV PORT=5000
 ENV GUNICORN_WORKERS=4
 ENV GUNICORN_CMD_ARGS="--bind 0.0.0.0:${PORT} --workers ${GUNICORN_WORKERS}"
-ENV PATH="${PATH}:/home/appuser/.local/bin"
+ENV PATH="/app/.venv/bin:$PATH"
 EXPOSE ${PORT}/tcp
-CMD ["gunicorn", "app:production"]
+CMD ["gunicorn", "app:production"]

README.md

@@ -56,6 +56,15 @@ docker run -d --rm \
 
 Local installation should work as well. Check the Dockerfile for the latest targeted Python version.
 
+## With UV
+```bash
+git clone https://github.com/holysoles/zoneforge.git
+cd zoneforge
+uv run --no-dev --group prod gunicorn app:production --bind 0.0.0.0:5000 --workers 4
+```
+
+## With pip
+
 ```bash
 git clone https://github.com/holysoles/zoneforge.git
 cd zoneforge
@@ -160,7 +169,17 @@ For each domain that a given DNS server is authorative for:
 
 Contributions are welcome. Please follow [conventional commit syntax](https://www.conventionalcommits.org/en/v1.0.0/).
 
-Install requirements for a dev environment with `pip install -r requirements/dev.txt`.
+uv is recommended to use for downloading dependencies and managing your virtual environment.
+
+```bash
+uv run black .
+uv run pylint $(git ls-files '*.py' | grep -v dnspython)
+uv run pytest
+```
+
+## With pip
+
+Install requirements for a dev environment with: `pip install -r requirements/dev.txt`.
 
 Please note that linting and unit tests are run against Pull Requests. It is recommended you test at least the Python related jobs before committing:
 
@@ -170,7 +189,7 @@ pylint $(git ls-files '*.py' | grep -v dnspython)
 pytest
 ```
 
-For GitHub Actions, [pin-github-action](https://github.com/mheap/pin-github-action) is used to update tag refs to commit hashes
+For GitHub Actions, [pin-github-action](https://github.com/mheap/pin-github-action) is used to resolve tag refs to commit hashes
 
 # Credits
 

pyproject.toml

@@ -0,0 +1,32 @@
+[project]
+name = "zoneforge"
+version = "1.2.4"
+description = "Web Frontend and REST API for DNS Zonefile Management"
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = [
+	"dnspython>=2.8.0,<3.0.0",
+	"Flask>=3.1.1,<4.0.0",
+	"flask_minify>=0.50,<1.0.0",
+	"flask-restx>=1.3.2,<2.0.0",
+	"gunicorn>=23.0.0,<24.0.0",
+	"Flask-SQLAlchemy>=3.1.1,<4.0.0",
+	"bcrypt>=4.3.0,<5.0.0",
+	"PyJWT>=2.10.1,<3.0.0"
+]
+
+[dependency-groups]
+prod = [
+	"gunicorn>=23.0.0,<24.0.0"
+]
+ci = [
+	"pytest>=8.4.2,<9.0.0",
+	"pylint>=3.3.8,<4.0.0",
+	"pytest-cov>=7.0.0,<8.0.0",
+	"pytest-mock>=3.15.1,<4.0.0",
+	"trio>=0.31.0,<1.0.0"
+]
+dev = [
+	{include-group = "ci"},
+	"black>=25.9.0,<26.0.0"
+]