Merge pull request #113 from kazmer97/fix/uv-pull

fix/uv pull

Author: rstrahan

.gitlab-ci.yml

@@ -26,17 +26,16 @@ stages:
 developer_tests:
   stage: developer_tests
   rules:
-    - when: always  # Run on all branches
-  
+    - when: always # Run on all branches
+
   before_script:
     - python --version
     - apt-get update -y
     - apt-get install make curl git -y
     # Fetch main branch for comparison in typecheck-pr
     - git fetch origin main:main || echo "Could not fetch main branch"
     # Install uv
-    - curl -LsSf https://astral.sh/uv/install.sh | sh
-    - export PATH="$HOME/.cargo/bin:$PATH"
+    - pip install uv
     # Create virtual environment
     - uv venv .venv
     - source .venv/bin/activate
@@ -54,7 +53,7 @@ developer_tests:
     - make lint-cicd
     - make typecheck-cicd
     - make test-cicd -C lib/idp_common_pkg
-  
+
   artifacts:
     paths:
       - lib/idp_common_pkg/test-reports/coverage.xml
@@ -93,8 +92,8 @@ integration_tests:
   #   AWS_CREDS_TARGET_ROLE: ${AWS_CREDS_TARGET_ROLE}
   #   AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION}
   #   IDP_ACCOUNT_ID: ${IDP_ACCOUNT_ID}
-  
- # Add rules to only run on develop branch
+
+  # Add rules to only run on develop branch
   rules:
     - if: $CI_COMMIT_BRANCH == "develop"
       when: on_success
@@ -121,11 +120,12 @@ integration_tests:
   script:
     - aws --version
     - aws sts get-caller-identity --no-cli-pager
-    
+
     # Set environment variables for Python script
     - export IDP_ACCOUNT_ID=${IDP_ACCOUNT_ID:-020432867916}
     - export AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION:-us-east-1}
     - export IDP_PIPELINE_NAME=idp-sdlc-deploy-pipeline
-    
+
     # Run integration test deployment
-    - python3 scripts/integration_test_deployment.py
+    - python3 scripts/integration_test_deployment.py
+

Dockerfile.optimized

@@ -4,11 +4,20 @@
 # checkov:skip=CKV_DOCKER_3: "The Dockerfile uses the official AWS Lambda Python base image (public.ecr.aws/lambda/python:3.12-arm64), which already configures the appropriate non-root user for Lambda execution"
 # checkov:skip=CKV_DOCKER_2: "The Dockerfile.optimized is specifically designed for AWS Lambda container images, which don't use Docker HEALTHCHECK instructions."
 
+# Use specific version to avoid network issues
+FROM ghcr.io/astral-sh/uv:0.9.6 AS uv
 
+# Builder stage - bundle dependencies into Lambda task root
 FROM public.ecr.aws/lambda/python:3.12-arm64 AS builder
 
-# Copy uv from official distroless image
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+# Enable bytecode compilation to improve cold-start performance
+ENV UV_COMPILE_BYTECODE=1
+
+# Disable installer metadata to create a deterministic layer
+ENV UV_NO_INSTALLER_METADATA=1
+
+# Enable copy mode to support bind mount caching
+ENV UV_LINK_MODE=copy
 
 # Build argument for function path
 ARG FUNCTION_PATH
@@ -22,26 +31,25 @@ COPY lib/idp_common_pkg /tmp/idp_common_pkg
 COPY ${FUNCTION_PATH}/requirements.txt* /build/
 
 # Install all dependencies including idp_common_pkg in one step
-RUN --mount=type=cache,target=/root/.cache/uv \
-    if [ -f /build/requirements.txt ]; then \
-        sed 's|^\.\./\.\.\(/\.\.\)\?/lib/idp_common_pkg|/tmp/idp_common_pkg|' /build/requirements.txt > /tmp/requirements.txt && \
-        uv pip install --python python3.12 --target /opt/python -r /tmp/requirements.txt && \
-        rm /tmp/requirements.txt; \
-    fi && \
-    rm -rf /tmp/idp_common_pkg
+# Using mount from uv stage instead of COPY to avoid layer bloat
+RUN --mount=from=uv,source=/uv,target=/bin/uv \
+  --mount=type=cache,target=/root/.cache/uv \
+  if [ -f /build/requirements.txt ]; then \
+  sed 's|^\.\./\.\.\(/\.\.\)\?/lib/idp_common_pkg|/tmp/idp_common_pkg|' /build/requirements.txt > /tmp/requirements.txt && \
+  uv pip install --python python3.12 --target "${LAMBDA_TASK_ROOT}" -r /tmp/requirements.txt && \
+  rm /tmp/requirements.txt; \
+  fi && \
+  rm -rf /tmp/idp_common_pkg
 
 # Final stage - minimal runtime
 FROM public.ecr.aws/lambda/python:3.12-arm64
 
-# Copy only the installed packages
-COPY --from=builder /opt/python /opt/python
+# Copy the runtime dependencies from the builder stage
+COPY --from=builder ${LAMBDA_TASK_ROOT} ${LAMBDA_TASK_ROOT}
 
 # Copy function code
 ARG FUNCTION_PATH
 COPY ${FUNCTION_PATH}/*.py ${LAMBDA_TASK_ROOT}/
 
-# Set Python path
-ENV PYTHONPATH=/opt/python:${LAMBDA_TASK_ROOT}
-
 # Set handler
-CMD ["index.handler"]
+CMD ["index.handler"]