Merge pull request #38 from proconnect-gouv/deps-update

Update dependencies

.github/workflows/build-docker.yml

@@ -17,14 +17,14 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -36,14 +36,14 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Login to Github Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ github.token }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           target: production
@@ -59,7 +59,7 @@ jobs:
     needs:
       - build-and-push
     steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@main
+      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
         id: notify
         with:
           deployment_repo_path: "${{ github.repository }}"

.github/workflows/ci-tests.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.event_name == 'pull_request' # Makes sense only for pull requests
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
             fetch-depth: 0
       - name: show
@@ -39,7 +39,7 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
             fetch-depth: 0
       - name: Check that the CHANGELOG has been modified in the current branch
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Check CHANGELOG max line length
         run: |
           max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -65,11 +65,11 @@ jobs:
         working-directory: src/satosa
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: '3.11'
+          python-version: '3.14'
       - name: Install development dependencies
         run: |
           # Python's xmlsec requirement
@@ -89,11 +89,11 @@ jobs:
         working-directory: src/satosa
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: '3.11'
+          python-version: '3.14'
       - name: Install development dependencies
         run: |
           # Python's xmlsec requirement
@@ -110,7 +110,7 @@ jobs:
       image: ghcr.io/helmfile/helmfile:v1.2.0
     steps:
       -
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
         id: app-token
         with:
           app-id: ${{ secrets.APP_ID }}
@@ -119,7 +119,7 @@ jobs:
           repositories: secrets
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           submodules: recursive
           token: ${{ steps.app-token.outputs.token }}

CHANGELOG.md

@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+- upgrade dependencies: Python 3.14.3, gunicorn 25.1.0…
+
 ## [1.0.11] - 2025-11-24
 - remove setuptools, wheel and pip from production Docker image
 

Dockerfile

@@ -1,13 +1,17 @@
 # ---- base image to inherit from ----
-FROM python:3.11.12-slim-bookworm AS common
+FROM python:3.14.3-slim-trixie AS common
 
 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
-RUN apt-get update && \
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
     apt-get -y upgrade && \
     apt-get install -qy --no-install-recommends xmlsec1 && \
     rm -rf /var/lib/apt/lists/*
 
+# Silence pip warnings about running as root in a container
+ENV PIP_ROOT_USER_ACTION=ignore
+
 # We want the most up-to-date stable pip release
 RUN pip install --upgrade pip
 
@@ -37,6 +41,10 @@ CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 # ---- Development image ----
 FROM common AS development
 
+# Install curl (for healthchecks)
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && apt-get install -qy curl
+
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
 RUN pip install playwright

docker-compose.yml

@@ -40,6 +40,13 @@ services:
       - ./docker/files/usr/local/etc/gunicorn/satosa.py:/usr/local/etc/gunicorn/satosa.py
     depends_on:
       - redis
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "http://localhost:8000/ping"]
+      interval: 60s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+      start_interval: 1s
 
   oidc-test-client:
     build: docker/oidc-test-client

docker/oidc-test-client/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11
+FROM python:3.14
 
 COPY . /app
 

src/helm/helmfile.yaml.gotmpl

@@ -30,6 +30,8 @@ releases:
       - auth:
           password: pass
         architecture: standalone
+        image:
+          repository: bitnamilegacy/redis
 
   - name: extra
     installed: {{ ne .Environment.Name "dev" | toYaml }}

src/satosa/pyproject.toml

@@ -11,23 +11,24 @@ version = "0.1.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
-    "Intended Audience :: Developers",
+    "Intended Audience :: End Users/Desktop",
+    "Intended Audience :: System Administrators",
     "License :: OSI Approved :: MIT License",
     "Natural Language :: English",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.14",
 ]
-description = "An application to handle contacts and teams."
+description = "A gateway from RENATER's FER to ProConnect's OIDC provider, built on top of SATOSA."
 keywords = ["OIDC", "SAML", "Shibboleth", "FER", "RENATER"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.14"
 dependencies = [
     "SATOSA==8.5.1",
-    "gunicorn==23.0.0",
-    "redis==5.0.4",
-    "JSON-log-formatter==1.0",
-    "WhiteNoise==6.7.0",
+    "gunicorn==25.1.0",
+    "redis==7.2.1",
+    "JSON-log-formatter==1.1.1",
+    "WhiteNoise==6.12.0",
 ]
 
 [project.urls]
@@ -40,18 +41,15 @@ dependencies = [
 dev = [
     "pylint==3.1.0",
     "pytest-cov==4.1.0",
-    "pytest==8.0.2",
-    "ruff==0.2.2",
-    "pytest-playwright==0.4.4",
+    "pytest==9.0.2",
+    "ruff==0.15.4",
+    "pytest-playwright==0.7.2",
 ]
 
 [tool.setuptools]
 packages = { find = { where = ["."], exclude = ["tests"] } }
 zip-safe = true
 
-[tool.distutils.bdist_wheel]
-universal = true
-
 [tool.ruff]
 exclude = [
     ".git",

src/satosa/setup.py

@@ -1,7 +0,0 @@
-#!/usr/bin/env python
-"""Setup file for the oidc2fer module. All configuration stands in the setup.cfg file."""
-# coding: utf-8
-
-from setuptools import setup
-
-setup()

start-kind.sh

@@ -26,7 +26,8 @@ fi
 # https://github.com/kubernetes-sigs/kind/issues/2875
 # https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
 # See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
-cat <<EOF | kind create cluster --config=-
+kind --name=oidc2fer delete cluster || true
+cat <<EOF | kind --name=oidc2fer create cluster --config=-
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
@@ -35,7 +36,6 @@ containerdConfigPatches:
     config_path = "/etc/containerd/certs.d"
 nodes:
 - role: control-plane
-  image: kindest/node:v1.27.3
   kubeadmConfigPatches:
   - |
     kind: InitConfiguration
@@ -50,9 +50,7 @@ nodes:
     hostPort: 443
     protocol: TCP
 - role: worker
-  image: kindest/node:v1.27.3
 - role: worker
-  image: kindest/node:v1.27.3
 EOF
 
 # 3. Add the registry config to the nodes
@@ -64,7 +62,7 @@ EOF
 # We want a consistent name that works from both ends, so we tell containerd to
 # alias localhost:${reg_port} to the registry container when pulling images
 REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
-for node in $(kind get nodes); do
+for node in $(kind --name=oidc2fer get nodes); do
 	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
 	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
 [host."http://${reg_name}:5000"]
@@ -91,6 +89,17 @@ data:
     help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
 EOF
 
+# Patch the CoreDNS configmap to rewrite requests for *.127.0.0.1.nip.io to the Ingress Controller service
+kubectl -n kube-system get configmap coredns -o yaml |
+  yq '.data.Corefile |= (
+        trim
+        | split("\n")
+        | .[-1] = "    rewrite name regex .*\\.127\\.0\\.0\\.1\\.nip\\.io ingress-nginx-controller.ingress-nginx.svc.cluster.local answer auto\n"
+          + .[-1]
+        | join("\n")
+      )' |
+  kubectl replace -f -
+
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
 kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'