Update readme sh

.github/workflows/deploy.yml

@@ -0,0 +1,60 @@
+name: Deploy Workflow
+run-name: Deploy to ${{ inputs.env }} - ${{ inputs.tag }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        type: string
+        description: Tag to deploy
+        required: true
+      env:
+        type: choice
+        description: Environment to be deployed
+        required: true
+        options:
+          - dev
+          - staging
+          - perf
+          - prod
+          - client-sandbox
+
+env:
+  SERVICE_NAME: language_model_gateway
+  SERVICE_NAMESPACE: language_model_gateway-${{ inputs.env }}
+
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: main
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Checkout icanbwell/cie.gha-deploy
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: refs/tags/v0.0.33
+          repository: icanbwell/cie.gha-deploy
+          token: ${{ secrets.BWELL_DEV_PAT }}
+          path: .github/actions/cie.gha-deploy
+
+      - name: Deploy
+        uses: ./.github/actions/cie.gha-deploy
+        with:
+          token: ${{ secrets.BWELL_DEV_PAT }}
+          service-name: $SERVICE_NAME
+          service-namespace: $SERVICE_NAMESPACE
+          env: '${{ inputs.env }}-ue1'
+          helm-chart-version: '1.1.8'
+          image-tag: ${{ github.event.inputs.tag }}
+
+      - name: 'Cleanup build folder'
+        if: always()
+        run: |
+          ls -la ./
+          sudo rm -rf ${{ github.workspace }}/*
+          ls -la ./

.github/workflows/docker-publish.yml

@@ -7,7 +7,7 @@ on:
 
 env:
   IMAGE_NAME: language_model_gateway
-  REPOSITORY_URL: imranq2
+  REPOSITORY_URL: icanbwell
 
 jobs:
   push:
@@ -36,6 +36,8 @@ jobs:
 
       - name: Install QEMU
         uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64,linux/arm64
 
       - name: Create builder
         run: |
@@ -51,6 +53,7 @@ jobs:
         run: |
           docker buildx build \
             --platform linux/amd64,linux/arm64 \
+            --target production \
             -t $REPOSITORY_URL/$IMAGE_NAME:$TAG \
             -t $REPOSITORY_URL/$IMAGE_NAME:latest \
             --push \

.pre-commit-config.yaml

@@ -1,36 +1,106 @@
-exclude: (^.idea/|^notebooks/)
+exclude: (^.idea/|^docsrc|^docs)
+
 repos:
+  # Pre-commit hooks for basic checks
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
+      # File and formatting checks
       - id: end-of-file-fixer
         types: [ python ]
+      - id: trailing-whitespace
+        types: [ python ]
+
+      # Conflict and security checks
+      - id: check-case-conflict
+        types: [ python ]
+      - id: check-docstring-first
+        types: [ python ]
+
+      # Security scans
+      - id: detect-aws-credentials
+        types: [ python ]
+        args: [ '--allow-missing-credentials' ]
+      - id: detect-private-key
+        types: [ python ]
+
+      # Dependency and import checks
+      - id: check-ast
+      - id: check-added-large-files
+      - id: check-json
+      - id: check-toml
+      - id: check-yaml
+
+  # Local hooks for Ruff (using local installation)
   - repo: local
     hooks:
       - id: ruff
-        name: ruff
-        language: system
-        types: [ python ]
+        name: Ruff
         entry: ruff
-        require_serial: true
-        args: [ 'check', '--fix']
-      - id: autoflake
-        name: autoflake
         language: system
         types: [ python ]
-        entry: autoflake
+        args: [ check, --fix, --show-fixes, --target-version=py312 ]
         require_serial: true
-        args: [ '--in-place', '--remove-all-unused-imports', '--ignore-init-module-imports']
-      - id: black
-        name: black
+
+      - id: ruff-format
+        name: Ruff Format
+        entry: ruff
         language: system
-        types: [python]
+        types: [ python ]
+        args: [ format ]
         require_serial: true
-        entry: black
+
+      # MyPy for type checking
       - id: mypy
         name: mypy
         language: system
         types: [ python ]
         entry: mypy
         require_serial: true
-        args: [ --strict, --python-version=3.12, --show-error-codes, --allow-untyped-decorators ]
+        args: [
+          --strict,
+          --python-version=3.12,
+          --show-error-codes,
+          --allow-untyped-decorators,
+          --ignore-missing-imports
+        ]
+
+      # Bandit for security scanning
+      - id: bandit
+        name: bandit
+        language: system
+        types: [ python ]
+        entry: bandit
+        require_serial: true
+        args: [
+          '-q',
+          '--skip', 'B101,B104,B105,B106',
+          '-r',
+          '--severity-level', 'medium'
+        ]
+
+  # Pygrep hooks for additional checks
+  - repo: https://github.com/pre-commit/pygrep-hooks
+    rev: v1.10.0
+    hooks:
+      - id: python-use-type-annotations
+      - id: python-check-blanket-noqa
+      - id: python-check-blanket-type-ignore
+      - id: python-check-mock-methods
+      - id: python-no-eval
+      - id: python-no-log-warn
+
+  # Optional: Secret scanning
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.4.0
+    hooks:
+      - id: detect-secrets
+        args: [ 'scan' ]
+        exclude: >
+          (?x)^(
+            tests/.*|
+            docker-compose\.yml|
+            .helm/.*|
+            docker-compose-openwebui\.yml|
+            docker-compose-openwebui-auth\.yml
+          )$

Dockerfile

@@ -48,18 +48,18 @@ RUN python -c "import sys; print(sys.platform, sys.version, sys.maxsize > 2**32)
 RUN pip debug --verbose
 RUN pip list -v
 
-# Stage 2: Final runtime image for the application
-# This stage creates a minimal image with only the runtime dependencies and the application code.
-FROM public.ecr.aws/docker/library/python:3.12-alpine3.20
+
+# Stage 2: Development image with hot reload
+# This stage is optimized for local development with hot reload capability
+FROM public.ecr.aws/docker/library/python:3.12-alpine3.20 AS development
 
 # Set terminal width (COLUMNS) and height (LINES)
 ENV COLUMNS=300
 
 # Define an argument to control whether to run pipenv lock (not used in this stage)
 ARG GITHUB_TOKEN
 
-# Install runtime dependencies required by the application (e.g., for shapely, grpcio, scipy, google-crc32 and numpy)
-# You can use auditwheel to check any package and identify the native library dependencies
+# Install runtime dependencies required by the application
 RUN apk add --no-cache curl libstdc++ libffi git graphviz graphviz-dev
 
 # Install pipenv to manage and run the application
@@ -76,31 +76,108 @@ RUN mkdir -p ${PROMETHEUS_MULTIPROC_DIR}
 # Set the working directory for the project
 WORKDIR ${PROJECT_DIR}
 
-# Copy the Pipfile and Pipfile.lock files into the runtime image
+# Copy the Pipfile and Pipfile.lock files into the development image
 COPY Pipfile* ${PROJECT_DIR}
 
-# Copy installed Python packages from the previous stage
+# Copy installed Python packages from the first stage
 COPY --from=python_packages /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
 COPY --from=python_packages /usr/local/bin /usr/local/bin
 
-# Copy the application code into the runtime image
+# Copy the application code into the development image
 COPY ./language_model_gateway ${PROJECT_DIR}/language_model_gateway
 COPY ./setup.cfg ${PROJECT_DIR}/
 
-# Copy the Pipfile.lock from the previous stage in case it was locked
+# Copy the Pipfile.lock from the first stage
 COPY --from=python_packages ${PROJECT_DIR}/Pipfile.lock ${PROJECT_DIR}/Pipfile.lock
+COPY --from=python_packages ${PROJECT_DIR}/Pipfile.lock /tmp/Pipfile.lock
+
+# Create directories and list their contents (for debugging and verification)
+RUN mkdir -p /usr/local/lib/python3.12/site-packages && ls -halt /usr/local/lib/python3.12/site-packages
+RUN mkdir -p /usr/local/bin && ls -halt /usr/local/bin
+
+# Create the folder where we will store generated images
+RUN mkdir -p ${PROJECT_DIR}/image_generation
+
+# Install the dependencies using pipenv in the development environment
+RUN pipenv sync --dev --system --extra-pip-args="--prefer-binary"
+
+# Expose port 5000 for the application
+EXPOSE 5000
+
+# Switch to the root user to perform user management tasks
+USER root
+
+# verify the installed version of the dot command for graphviz
+RUN dot -V
+
+# Create a restricted user (appuser) and group (appgroup) for running the application
+RUN addgroup -S appgroup && adduser -S -h /etc/appuser appuser -G appgroup
+
+# Ensure that the appuser owns the application files and directories
+RUN chown -R appuser:appgroup ${PROJECT_DIR} /usr/local/lib/python3.12/site-packages /usr/local/bin ${PROMETHEUS_MULTIPROC_DIR}
+
+# Switch to the restricted user to enhance security
+USER appuser
+
+# Development CMD with hot reload enabled
+CMD ["sh", "-c", "\
+    ddtrace-run uvicorn language_model_gateway.gateway.api:app \
+        --host 0.0.0.0 \
+        --port 5000 \
+        --reload \
+        --log-level $(echo ${LOG_LEVEL:-info} | tr '[:upper:]' '[:lower:]') \
+    "]
+
+# Stage 3: Production deployment image
+# This stage is optimized for deployment with multiple workers
+FROM public.ecr.aws/docker/library/python:3.12-alpine3.20 AS production
+
+# Set terminal width (COLUMNS) and height (LINES)
+ENV COLUMNS=300
+
+# Define an argument to control whether to run pipenv lock (not used in this stage)
+ARG GITHUB_TOKEN
+
+# Install runtime dependencies required by the application
+RUN apk add --no-cache curl libstdc++ libffi git graphviz graphviz-dev
+
+# Install pipenv to manage and run the application
+RUN pip install --no-cache-dir pipenv
+
+# Set environment variables for project configuration
+ENV PROJECT_DIR=/usr/src/language_model_gateway
+ENV PROMETHEUS_MULTIPROC_DIR=/tmp/prometheus
+ENV PIP_ROOT_USER_ACTION=ignore
+
+# Create the directory for Prometheus metrics
+RUN mkdir -p ${PROMETHEUS_MULTIPROC_DIR}
+
+# Set the working directory for the project
+WORKDIR ${PROJECT_DIR}
+
+# Copy the Pipfile and Pipfile.lock files into the development image
+COPY Pipfile* ${PROJECT_DIR}
 
-# Copy Pipfile.lock to a temporary directory so it can be retrieved if needed
+# Copy installed Python packages from the first stage
+COPY --from=python_packages /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=python_packages /usr/local/bin /usr/local/bin
+
+# Copy the application code into the development image
+COPY ./language_model_gateway ${PROJECT_DIR}/language_model_gateway
+COPY ./setup.cfg ${PROJECT_DIR}/
+
+# Copy the Pipfile.lock from the first stage
+COPY --from=python_packages ${PROJECT_DIR}/Pipfile.lock ${PROJECT_DIR}/Pipfile.lock
 COPY --from=python_packages ${PROJECT_DIR}/Pipfile.lock /tmp/Pipfile.lock
 
 # Create directories and list their contents (for debugging and verification)
 RUN mkdir -p /usr/local/lib/python3.12/site-packages && ls -halt /usr/local/lib/python3.12/site-packages
 RUN mkdir -p /usr/local/bin && ls -halt /usr/local/bin
 
-# create the folder where we will store generated images
+# Create the folder where we will store generated images
 RUN mkdir -p ${PROJECT_DIR}/image_generation
 
-# Install the dependencies using pipenv in the final runtime environment
+# Install the dependencies using pipenv in the development environment
 RUN pipenv sync --dev --system --extra-pip-args="--prefer-binary"
 
 # Expose port 5000 for the application
@@ -124,13 +201,13 @@ USER appuser
 # The number of workers can be controlled using the NUM_WORKERS environment variable
 # Otherwise the number of workers for uvicorn (using the multiprocessing worker) is  chosen based on these guidelines:
 # (https://sentry.io/answers/number-of-uvicorn-workers-needed-in-production/)
-# basically (cores * threads + 1)
+# basically (cores _threads + 1)
 CMD ["sh", "-c", "\
     # Get CPU info \
     CORE_COUNT=$(nproc) && \
     THREAD_COUNT=$(nproc --all) && \
     \
-    # Calculate workers using formula: (cores * threads + 1) \
+    # Calculate workers using formula: (cores_ threads + 1) \
     WORKER_COUNT=$((CORE_COUNT * THREAD_COUNT + 1)) && \
     FINAL_WORKERS=${NUM_WORKERS:-$WORKER_COUNT} && \
     \
@@ -143,4 +220,4 @@ CMD ["sh", "-c", "\
         --port 5000 \
         --workers $FINAL_WORKERS \
         --log-level $(echo ${LOG_LEVEL:-info} | tr '[:upper:]' '[:lower:]') \
-    "]
+    "]