Migrate to ruff

Author: Will-Hellinger

.devcontainer/Dockerfile

@@ -1 +1,9 @@
 node_modules/
+.github/
+.mypy_cache/
+.pytest_cache/
+__pycache__/
+*.pyc
+.venv/
+.scannerwork/
+.ruff_cache/

.devcontainer/devcontainer.json

@@ -27,11 +27,11 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-      - name: Lint with pylint
+          python -m pip install uv
+          if [ -f requirements.txt ]; then uv pip install -r requirements.txt --system; fi
+      - name: Lint with ruff
         run: |
-          pylint packet/routes packet
+          ruff check packet
 
   typecheck:
     runs-on: ubuntu-latest
@@ -50,8 +50,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install uv
+          if [ -f requirements.txt ]; then uv pip install -r requirements.txt --system; fi
       - name: Typecheck with mypy
         run: |
           # Disabled error codes to discard errors from imports

.devcontainer/docker-compose.yaml

@@ -105,6 +105,7 @@ ENV/
 
 # vscode
 .vscode
+.devcontainer
 
 # SonarQube
 .scannerwork

.dockerignore

@@ -1,4 +1,4 @@
-FROM docker.io/python:3.9-slim-trixie
+FROM ghcr.io/astral-sh/uv:python3.9-bookworm-slim
 
 RUN ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
 RUN apt-get -yq update && \
@@ -14,7 +14,7 @@ RUN mkdir /opt/packet
 WORKDIR /opt/packet
 
 COPY requirements.txt /opt/packet/
-RUN pip install -r requirements.txt
+RUN uv pip install -r requirements.txt --system
 
 COPY package.json /opt/packet/
 COPY yarn.lock /opt/packet/
@@ -32,4 +32,9 @@ RUN gulp production && \
 # Set version for apm
 RUN echo "export DD_VERSION=\"$(python3 packet/git.py)\"" >> /tmp/version
 
+RUN groupadd -r packet && useradd --no-log-init -r -g packet packet && \
+    chown -R packet:packet /opt/packet
+
+USER packet
+
 CMD ["/bin/bash", "-c", "source /tmp/version && ddtrace-run gunicorn packet:app --bind=0.0.0.0:8080 --access-logfile=- --timeout=600"]

.github/workflows/python-app.yml

@@ -1,4 +1,4 @@
-FROM docker.io/python:3.9-slim-trixie
+FROM ghcr.io/astral-sh/uv:python3.9-bookworm-slim
 
 RUN ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
 RUN apt-get -yq update && \
@@ -14,7 +14,7 @@ RUN mkdir /opt/packet
 WORKDIR /opt/packet
 
 COPY requirements.txt /opt/packet/
-RUN pip install -r requirements.txt
+RUN uv pip install -r requirements.txt --system
 
 COPY package.json /opt/packet/
 COPY yarn.lock /opt/packet/
@@ -29,6 +29,11 @@ RUN gulp production && \
     apt-get -yq autoremove && \
     apt-get -yq clean all
 
+RUN groupadd -r packet && useradd --no-log-init -r -g packet packet && \
+    chown -R packet:packet /opt/packet
+
+USER packet
+
 EXPOSE 8000
 
 CMD ["/bin/bash", "-c", "python3 wsgi.py"]

.gitignore

@@ -133,12 +133,12 @@ All DB commands are from the `Flask-Migrate` library and are used to configure D
 docs [here](https://flask-migrate.readthedocs.io/en/latest/) for details. 
 
 ## Code standards
-This project is configured to use Pylint and mypy. Commits will be pylinted and typechecked by GitHub actions and if the
+This project is configured to use ruff and mypy. Commits will be ruffed and typechecked by GitHub actions and if the
 score drops your build will fail blocking you from merging. To make your life easier just run it before making a PR.
 
-To run pylint and mypy use these commands:
+To run ruff and mypy use these commands:
 ```bash
-pylint packet/routes packet
+ruff check packet
 mypy --disable-error-code import --disable-error-code name-defined --disallow-untyped-defs --exclude routes packet
 ```