Skip to content

ci: add uv.lock for reproducible Docker builds #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
krishna3554 merged 1 commit into from
Aug 27, 2026
Merged

ci: add uv.lock for reproducible Docker builds #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,10 @@ ENV PYTHONDONTWRITEBYTECODE=1 \

WORKDIR /app

COPY services/dma-api/pyproject.toml ./pyproject.toml
COPY services/dma-api/pyproject.toml services/dma-api/uv.lock ./
COPY services/dma-api/src ./src

RUN pip install --no-cache-dir .
RUN pip install --no-cache-dir uv && uv pip install --locked --no-cache .

@devin-ai-integration devin-ai-integration Bot Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Lockfile ignored and unknown flag fails the build

The Docker build runs uv pip install --locked --no-cache ., but uv pip install never reads uv.lock, so dependencies are re-resolved from pyproject.toml and reproducibility is not gained. --locked is also not a valid uv pip install option, so uv rejects it and the build fails.

Prompt for agents 
The Dockerfile line `RUN pip install --no-cache-dir uv && uv pip install --locked --no-cache .` does not achieve the intended reproducible build. Two problems: (1) `uv pip install` (uv's pip-compatible interface) does not consume the project lockfile uv.lock at all — uv.lock is only used by uv's project commands such as `uv sync`, `uv run`, and `uv export`. So installing `.` re-resolves dependencies from pyproject.toml and the lockfile has no effect. (2) `--locked` is not a recognized option of `uv pip install` (it is a project-command flag), which will cause uv to error out and fail the Docker build. To actually install the pinned dependency tree from uv.lock, consider exporting the lock to a requirements file and installing that, e.g. `uv export --locked --no-dev --format requirements-txt -o requirements.txt` then `uv pip install --system -r requirements.txt`, followed by installing the local package without dependencies (`uv pip install --system --no-deps .`); or restructure to use `uv sync --locked` with the project environment. Verify the exact uv subcommands/flags against the uv version being installed.
Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


RUN useradd --create-home --uid 10001 dma \
&& mkdir /data \
Expand Down
Loading
Loading