Get CI running again, and install locked dependencies

.bandit.yaml

@@ -1,4 +1,4 @@
 skips: ['B404', 'B603']
 
 assert_used:
-  skips: ['tests/*/test_*.py']
+  skips: ['*tests/*/test_*.py']

.github/workflows/ci.yaml

@@ -12,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
       - name: Setup Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
       - name: PreCommit
-        uses: pre-commit/action@v2.0.3
-        with:
-          extra_args: --all-files
+        run: |
+          pip install pre-commit
+          pre-commit run --all-files --show-diff-on-failure
 
   Test:
     name: PyTest
@@ -32,18 +32,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
       - name: Setup Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v7
         with:
-          python-version: "3.10"
+          python-version: "3.14"
       - name: Install Dependencies And Test
         shell: bash
         run: |
           chmod +x ./tests/ci_test.sh
           ./tests/ci_test.sh
       - name: Upload to codecov.io
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@v7
         with:
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -59,16 +59,16 @@ jobs:
       TEST_TAG: remote:test
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
         # can't get git tag if without ${{ github.sha }}
         with:
           ref: ${{ github.sha }}
 
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v4
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v4
 
       - name: Prepare docker tag name with git tag
         if: ${{ github.ref_type  == 'tag' }}
@@ -81,13 +81,13 @@ jobs:
 
       - name: Login to Docker Hub
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-        uses: docker/login-action@v1
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
 
       - name: Build and export to Docker
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v7
         with:
           context: .
           load: true
@@ -110,7 +110,7 @@ jobs:
 
       - name: Push Image
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v7
         env:
           CR_URL: ${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
         with:

.pre-commit-config.yaml

@@ -24,13 +24,13 @@ repos:
           )
 
   - repo: https://github.com/PyCQA/isort
-    rev: 5.10.1
+    rev: 5.12.0
     hooks:
       - id: isort
         args: ["--profile", "black", "-p", "config"]
 
   - repo: https://github.com/psf/black
-    rev: 21.12b0
+    rev: 22.12.0
     hooks:
       - id: black
         args: ["--line-length", "88", "--target-version", "py310"]
@@ -55,9 +55,11 @@ repos:
           - flake8-print
           - flake8-pytest-style
           - flake8-tidy-imports
+          # flake8-logging-format imports pkg_resources, which setuptools 81+ lacks.
+          - setuptools<81
 
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.1
+    rev: 1.7.10
     hooks:
       - id: bandit
         args: ["-l", "-v", "-c", ".bandit.yaml"]

Dockerfile

@@ -7,8 +7,9 @@ LABEL org.opencontainers.image.authors="livid@v2ex.com"
 # - ttf-dejavu: a font for the text in SVG
 RUN apk add --no-cache cairo libmagic ttf-dejavu
 
-COPY ./requirements.txt /app/requirements.txt
-RUN pip3 install --no-cache-dir -r /app/requirements.txt
+# Exact versions, checked by hash. `make lock` refreshes them.
+COPY ./requirements.lock /app/requirements.lock
+RUN pip3 install --no-cache-dir --require-hashes -r /app/requirements.lock
 
 COPY . /app
 

Makefile

@@ -4,6 +4,19 @@ ENV_FILE ?= remote.env
 # Directory holding the files the config points to, e.g. `ipip.datx`.
 DATA_DIR ?= /opt/data
 
+# The image installs exactly what `requirements.lock` lists, checked by hash.
+# This re-resolves `requirements.txt` to the newest versions, in the image's own
+# Python so the lock matches what the image can install. Test the image built from
+# a new lock before shipping it.
+lock:
+	docker run --rm -e CUSTOM_COMPILE_COMMAND="make lock" \
+		-v $(CURDIR)/requirements.txt:/src/requirements.txt:ro -w /src \
+		$(shell awk '/^FROM/ {print $$2; exit}' Dockerfile) sh -c \
+		'pip install -q --root-user-action=ignore --disable-pip-version-check pip-tools >&2 \
+		&& pip-compile -q --generate-hashes --strip-extras -o - requirements.txt' \
+		> requirements.lock.new
+	mv requirements.lock.new requirements.lock
+
 build-image:
 	docker build -t remote:latest .
 

README.md

@@ -30,6 +30,10 @@ When developing on macOS, you can install those packages with Homebrew:
 brew install exiftool jhead libmagic libheif cairo
 ```
 
+## Dependencies
+
+`requirements.txt` lists what the project needs. `requirements.lock` holds the exact versions, with hashes, that the Docker image installs. See the `lock` target in the [Makefile](./Makefile) for how to refresh it.
+
 ## Endpoints
 
 ### images/prepare_jpeg