CI: Clean Docker and ensure ruff check

.dockerignore

@@ -1,7 +1,152 @@
-*.org
-*.tex
-*.pdf
-json/
-sam/
+# -----------------------------------------------------------------------------
+# Python
+# -----------------------------------------------------------------------------
 __pycache__/
-_minted-main/
+*.py[cod]
+*$py.class
+*.pyo
+*.pyd
+
+# C extensions
+*.so
+
+# -----------------------------------------------------------------------------
+# Virtual environments
+# -----------------------------------------------------------------------------
+.venv/
+venv/
+env/
+ENV/
+
+# -----------------------------------------------------------------------------
+# Build / packaging
+# -----------------------------------------------------------------------------
+build/
+dist/
+downloads/
+develop-eggs/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+*.egg
+pip-wheel-metadata/
+
+# -----------------------------------------------------------------------------
+# Installer logs
+# -----------------------------------------------------------------------------
+pip-log.txt
+pip-delete-this-directory.txt
+
+# -----------------------------------------------------------------------------
+# Testing / coverage
+# -----------------------------------------------------------------------------
+.tox/
+.nox/
+.pytest_cache/
+.coverage
+.coverage.*
+.cache/
+coverage.xml
+*.cover
+*.py,cover
+htmlcov/
+
+# -----------------------------------------------------------------------------
+# Type checkers
+# -----------------------------------------------------------------------------
+.mypy_cache/
+.pyre/
+.pytype/
+.dmypy.json
+
+# -----------------------------------------------------------------------------
+# Linting
+# -----------------------------------------------------------------------------
+.ruff_cache/
+.pylint.d/
+
+# -----------------------------------------------------------------------------
+# Jupyter
+# -----------------------------------------------------------------------------
+.ipynb_checkpoints/
+
+# -----------------------------------------------------------------------------
+# IDEs
+# -----------------------------------------------------------------------------
+.vscode/
+.idea/
+*.iml
+
+# -----------------------------------------------------------------------------
+# Operating systems
+# -----------------------------------------------------------------------------
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# -----------------------------------------------------------------------------
+# Git
+# -----------------------------------------------------------------------------
+.git/
+.gitignore
+.gitattributes
+
+# -----------------------------------------------------------------------------
+# Environment files
+# -----------------------------------------------------------------------------
+.env
+.env.*
+*.env
+
+# -----------------------------------------------------------------------------
+# Logs
+# -----------------------------------------------------------------------------
+*.log
+logs/
+
+# -----------------------------------------------------------------------------
+# Temporary files
+# -----------------------------------------------------------------------------
+tmp/
+temp/
+*.tmp
+*.swp
+*.swo
+*~
+
+# -----------------------------------------------------------------------------
+# Documentation
+# -----------------------------------------------------------------------------
+docs/_build/
+
+# -----------------------------------------------------------------------------
+# mkdocs / sphinx
+# -----------------------------------------------------------------------------
+site/
+
+# -----------------------------------------------------------------------------
+# Local databases
+# -----------------------------------------------------------------------------
+*.sqlite
+*.sqlite3
+*.db
+
+# -----------------------------------------------------------------------------
+# Docker
+# -----------------------------------------------------------------------------
+Dockerfile*
+docker-compose*.yml
+docker-compose*.yaml
+
+# -----------------------------------------------------------------------------
+# Misc
+# -----------------------------------------------------------------------------
+.cache-loader/
+.pybuilder/

.github/workflows/semantictranslator-main-aws-image.yml

@@ -1,43 +1,65 @@
 name: semantictranslator-main-aws-image
 
 on:
+  pull_request:
+    branches:
+      - main
+    types: [opened, synchronize, reopened]
   push:
     branches:
       - main
   workflow_dispatch:
 
 jobs:
+  ruff:
+    name: Ruff Check
+    runs-on: "ubuntu-latest"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Ruff
+        uses: astral-sh/ruff-action@v3
+
+      - name: Run Ruff check
+        run: ruff check .
+
+      - name: Run Ruff format
+        run: ruff format --check .
+
   build:
-    runs-on: 'ubuntu-latest'
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    needs: ruff
+    runs-on: "ubuntu-latest"
 
     steps:
-    - uses: actions/checkout@v2
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
-
-    - name: Log in to registry
-      uses: docker/login-action@v1
-      with:
-        registry: ${{vars.ACR_DOKCERHUB}}
-        username: ${{secrets.ACRUSERNAME_DOKCERHUB}}
-        password: ${{secrets.ACRUSERPASSWORD_DOKCERHUB}}
-
-    - name: Build and push container image to registry
-      uses: docker/build-push-action@v3
-      with:
-        context: .
-        push: true
-        tags: ${{vars.ACR_DOKCERHUB}}/${{secrets.ACRUSERNAME_DOKCERHUB}}/variamos_semantictranslator:main
-        file: ./Dockerfile
-
-    - name: Deploy changes into the server
-      uses: appleboy/ssh-action@master
-      with:
-        host: ${{ secrets.AWS_HOST }}
-        username: ${{ secrets.AWS_USERNAME }}
-        key: ${{ secrets.VARIAMOS_AWS_PEM }}
-        script: |
-          echo "Executing command on remote server..."
-          sudo docker compose --env-file .env.aws.develop -f docker-compose-aws-develop-nginx.yml pull
-          sudo docker compose --env-file .env.aws.develop -f docker-compose-aws-develop-nginx.yml up -d
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{vars.ACR_DOKCERHUB}}
+          username: ${{secrets.ACRUSERNAME_DOKCERHUB}}
+          password: ${{secrets.ACRUSERPASSWORD_DOKCERHUB}}
+
+      - name: Build and push container image to registry
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{vars.ACR_DOKCERHUB}}/${{secrets.ACRUSERNAME_DOKCERHUB}}/variamos_semantictranslator:main
+          file: ./Dockerfile
+
+      - name: Deploy changes into the server
+        uses: appleboy/ssh-action@master
+        with:
+          host: ${{ secrets.AWS_HOST }}
+          username: ${{ secrets.AWS_USERNAME }}
+          key: ${{ secrets.VARIAMOS_AWS_PEM }}
+          script: |
+            echo "Executing command on remote server..."
+            sudo docker compose --env-file .env.aws.develop -f docker-compose-aws-develop-nginx.yml pull
+            sudo docker compose --env-file .env.aws.develop -f docker-compose-aws-develop-nginx.yml up -d

Dockerfile

@@ -1,22 +1,39 @@
-FROM minizinc/minizinc
+# Use the official slim Python image
+FROM python:3.12-slim
 
-WORKDIR /usr/src/app
+# Prevent Python from writing .pyc files and buffer logs
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
 
-RUN apt-get update && \
-    apt-get upgrade -y && \
-    apt-get install software-properties-common python3 python3-pip nginx -y && \
-    apt-add-repository ppa:swi-prolog/stable && \
-    apt-get update && \
-    apt-get install swi-prolog python3.12-venv -y && \
-    python3 -m venv venv
+# Install required packages
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+    wget \
+    unzip \
+    ca-certificates \
+    minizinc \
+    swi-prolog \
+    # Clean up
+    && rm -rf /var/lib/apt/lists/*
 
-ENV PATH="./venv/bin:$PATH"
+# Set the working directory
+WORKDIR /app
 
+# Create a non-root user
+RUN useradd --create-home --shell /bin/bash appuser
+
+# Install Python dependencies
 COPY requirements.txt .
-RUN pip install --upgrade pip && \
-    pip install -r requirements.txt
+RUN pip install --no-cache-dir -r requirements.txt
 
+# Copy the application (excluding ignored files in .dockerignore)
 COPY . .
 
+# Give ownership to the non-root user
+RUN chown -R appuser:appuser /app
+
+# Switch to non-root user
+USER appuser
+
 EXPOSE 5000
-CMD ["./venv/bin/gunicorn", "--bind=0.0.0.0:5000", "--workers=4", "--timeout=0", "app:app"]
+CMD ["gunicorn", "--bind=0.0.0.0:5000", "--workers=4", "--timeout=0", "app:app"]

app.py

@@ -43,7 +43,7 @@ def get_solvers() -> Response:
                     "description": solver.description,
                 }
                 for solver in SOLVERS
-            ]   
+            ]
         }
     )
 

pyproject.toml

@@ -0,0 +1,22 @@
+[tool.ruff]
+line-length = 100
+target-version = "py313"
+
+exclude = [
+    "old_request_handler/**",
+]
+
+[tool.ruff.lint]
+select = [
+    "E",   # pycodestyle errors
+    "F",   # pyflakes
+    "I",   # import sorting
+    "B",   # bugbear
+    "UP",  # pyupgrade
+]
+
+ignore = []
+
+[tool.ruff.format]
+quote-style = "double"
+indent-style = "space"

requirements-dev.in

@@ -0,0 +1,4 @@
+-r requirements.txt
+
+pip-tools
+ruff