diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 7b45922..28c7079 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -17,14 +17,14 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Docker meta id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ghcr.io/${{ github.repository }} tags: | @@ -36,14 +36,14 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} - name: Login to Github Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ github.token }} - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . target: production @@ -59,7 +59,7 @@ jobs: needs: - build-and-push steps: - - uses: numerique-gouv/action-argocd-webhook-notification@main + - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main id: notify with: deployment_repo_path: "${{ github.repository }}" diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml index 8e81bf8..a004600 100644 --- a/.github/workflows/ci-tests.yml +++ b/.github/workflows/ci-tests.yml @@ -16,7 +16,7 @@ jobs: if: github.event_name == 'pull_request' # Makes sense only for pull requests steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 - name: show @@ -39,7 +39,7 @@ jobs: github.event_name == 'pull_request' steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 - name: Check that the CHANGELOG has been modified in the current branch @@ -49,7 +49,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check CHANGELOG max line length run: | max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L) @@ -65,11 +65,11 @@ jobs: working-directory: src/satosa steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install Python - uses: actions/setup-python@v3 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: - python-version: '3.11' + python-version: '3.14' - name: Install development dependencies run: | # Python's xmlsec requirement @@ -89,11 +89,11 @@ jobs: working-directory: src/satosa steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install Python - uses: actions/setup-python@v3 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: - python-version: '3.11' + python-version: '3.14' - name: Install development dependencies run: | # Python's xmlsec requirement @@ -110,7 +110,7 @@ jobs: image: ghcr.io/helmfile/helmfile:v1.2.0 steps: - - uses: actions/create-github-app-token@v1 + uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 id: app-token with: app-id: ${{ secrets.APP_ID }} @@ -119,7 +119,7 @@ jobs: repositories: secrets - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: submodules: recursive token: ${{ steps.app-token.outputs.token }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 10c4b05..2a74424 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] +- upgrade dependencies: Python 3.14.3, gunicorn 25.1.0… + ## [1.0.11] - 2025-11-24 - remove setuptools, wheel and pip from production Docker image diff --git a/Dockerfile b/Dockerfile index dba7d2f..81a6e1d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,13 +1,17 @@ # ---- base image to inherit from ---- -FROM python:3.11.12-slim-bookworm AS common +FROM python:3.14.3-slim-trixie AS common # Install xmlsec1 dependencies required for xmlsec (for SAML) # Needs to be kept before the `pip install` -RUN apt-get update && \ +RUN export DEBIAN_FRONTEND=noninteractive && \ + apt-get update && \ apt-get -y upgrade && \ apt-get install -qy --no-install-recommends xmlsec1 && \ rm -rf /var/lib/apt/lists/* +# Silence pip warnings about running as root in a container +ENV PIP_ROOT_USER_ACTION=ignore + # We want the most up-to-date stable pip release RUN pip install --upgrade pip @@ -37,6 +41,10 @@ CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"] # ---- Development image ---- FROM common AS development +# Install curl (for healthchecks) +RUN export DEBIAN_FRONTEND=noninteractive && \ + apt-get update && apt-get install -qy curl + # Playwright browsers ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers RUN pip install playwright diff --git a/docker-compose.yml b/docker-compose.yml index a4c9c97..46075ce 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -40,6 +40,13 @@ services: - ./docker/files/usr/local/etc/gunicorn/satosa.py:/usr/local/etc/gunicorn/satosa.py depends_on: - redis + healthcheck: + test: ["CMD", "curl", "--fail", "http://localhost:8000/ping"] + interval: 60s + timeout: 5s + retries: 3 + start_period: 30s + start_interval: 1s oidc-test-client: build: docker/oidc-test-client diff --git a/docker/oidc-test-client/Dockerfile b/docker/oidc-test-client/Dockerfile index 6a4b619..71b9360 100644 --- a/docker/oidc-test-client/Dockerfile +++ b/docker/oidc-test-client/Dockerfile @@ -1,4 +1,4 @@ -FROM python:3.11 +FROM python:3.14 COPY . /app diff --git a/src/helm/helmfile.yaml.gotmpl b/src/helm/helmfile.yaml.gotmpl index a27f74e..1fa97ed 100644 --- a/src/helm/helmfile.yaml.gotmpl +++ b/src/helm/helmfile.yaml.gotmpl @@ -30,6 +30,8 @@ releases: - auth: password: pass architecture: standalone + image: + repository: bitnamilegacy/redis - name: extra installed: {{ ne .Environment.Name "dev" | toYaml }} diff --git a/src/satosa/pyproject.toml b/src/satosa/pyproject.toml index 593c0a0..df37567 100644 --- a/src/satosa/pyproject.toml +++ b/src/satosa/pyproject.toml @@ -11,23 +11,24 @@ version = "0.1.0" authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }] classifiers = [ "Development Status :: 5 - Production/Stable", - "Intended Audience :: Developers", + "Intended Audience :: End Users/Desktop", + "Intended Audience :: System Administrators", "License :: OSI Approved :: MIT License", "Natural Language :: English", "Programming Language :: Python :: 3", - "Programming Language :: Python :: 3.11", + "Programming Language :: Python :: 3.14", ] -description = "An application to handle contacts and teams." +description = "A gateway from RENATER's FER to ProConnect's OIDC provider, built on top of SATOSA." keywords = ["OIDC", "SAML", "Shibboleth", "FER", "RENATER"] license = { file = "LICENSE" } readme = "README.md" -requires-python = ">=3.11" +requires-python = ">=3.14" dependencies = [ "SATOSA==8.5.1", - "gunicorn==23.0.0", - "redis==5.0.4", - "JSON-log-formatter==1.0", - "WhiteNoise==6.7.0", + "gunicorn==25.1.0", + "redis==7.2.1", + "JSON-log-formatter==1.1.1", + "WhiteNoise==6.12.0", ] [project.urls] @@ -40,18 +41,15 @@ dependencies = [ dev = [ "pylint==3.1.0", "pytest-cov==4.1.0", - "pytest==8.0.2", - "ruff==0.2.2", - "pytest-playwright==0.4.4", + "pytest==9.0.2", + "ruff==0.15.4", + "pytest-playwright==0.7.2", ] [tool.setuptools] packages = { find = { where = ["."], exclude = ["tests"] } } zip-safe = true -[tool.distutils.bdist_wheel] -universal = true - [tool.ruff] exclude = [ ".git", diff --git a/src/satosa/setup.py b/src/satosa/setup.py deleted file mode 100644 index 23be12a..0000000 --- a/src/satosa/setup.py +++ /dev/null @@ -1,7 +0,0 @@ -#!/usr/bin/env python -"""Setup file for the oidc2fer module. All configuration stands in the setup.cfg file.""" -# coding: utf-8 - -from setuptools import setup - -setup() diff --git a/start-kind.sh b/start-kind.sh index 237325a..335080e 100755 --- a/start-kind.sh +++ b/start-kind.sh @@ -26,7 +26,8 @@ fi # https://github.com/kubernetes-sigs/kind/issues/2875 # https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration # See: https://github.com/containerd/containerd/blob/main/docs/hosts.md -cat <