feat: 优化开发容器配置和开发环境 #57
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| version: '3.8' | ||
|
|
||
| services: | ||
| # 主开发容器应用 | ||
| app: | ||
| image: ghcr.io/prulloac/base:bookworm | ||
| container_name: dev_code_review_app | ||
| restart: unless-stopped | ||
| command: sleep infinity | ||
| volumes: | ||
| - ..:/workspaces:cached | ||
| - uv_cache:/root/.cache/uv | ||
| working_dir: /workspaces | ||
| networks: | ||
| - dev_network | ||
| environment: | ||
| - MONGODB_HOST=mongodb | ||
| - MONGODB_PORT=27017 | ||
| - MONGODB_USER=admin | ||
| - MONGODB_PASSWORD=password | ||
|
Comment on lines
+17
to
+20
There was a problem hiding this comment. Use secrets or environment files for MongoDB credentials. Hard-coded credentials ( Consider using a + env_file:
+ - .env
environment:
- MONGODB_HOST=mongodb
- MONGODB_PORT=27017
- - MONGODB_USER=admin
- - MONGODB_PASSWORD=password
+ - MONGODB_USER=${MONGODB_USER}
+ - MONGODB_PASSWORD=${MONGODB_PASSWORD}
- UV_LINK_MODE=copyAnd for the MongoDB service: environment:
- MONGO_INITDB_ROOT_USERNAME: admin
- MONGO_INITDB_ROOT_PASSWORD: password
+ MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USER}
+ MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD}
MONGO_INITDB_DATABASE: code_review_gptThen create a Also applies to: 33-36 🤖 Prompt for AI Agents |
||
| - UV_LINK_MODE=copy | ||
| depends_on: | ||
| - mongodb | ||
| ports: | ||
| - "3000:3000" | ||
| - "8000:8000" | ||
|
|
||
| # MongoDB 服务 | ||
| mongodb: | ||
| image: mongo:6.0 | ||
|
There was a problem hiding this comment. 🧩 Analysis chainVerify MongoDB version compatibility. MongoDB 6.0 is being used. Ensure this version is compatible with your application requirements and has no known security vulnerabilities. 🌐 Web query: 💡 Result: Latest stable MongoDB (on‑premises): 8.2.1 (current production release). [1][5] Known security issues with MongoDB 6.0 (summary):
If you want, I can list all 6.0 CVEs with affected/patched subversions and upgrade recommendations for your deployment. Upgrade MongoDB from 6.0 — version is EOL and has known security vulnerabilities. MongoDB 6.0 reached End-of-Life on July 31, 2025 and is no longer fully supported. Multiple security vulnerabilities affecting 6.0 were disclosed in 2025, including privilege escalation and denial-of-service issues. Upgrade to the latest 6.0 patch or to 8.2.x, or apply MongoDB's security patches. The latest stable version is MongoDB 8.2.1. 🤖 Prompt for AI Agents |
||
| container_name: dev_code_review_mongodb | ||
| restart: unless-stopped | ||
| environment: | ||
| MONGO_INITDB_ROOT_USERNAME: admin | ||
| MONGO_INITDB_ROOT_PASSWORD: password | ||
| MONGO_INITDB_DATABASE: code_review_gpt | ||
| ports: | ||
| - "27017:27017" | ||
| volumes: | ||
| - mongodb_dev_data:/data/db | ||
| networks: | ||
| - dev_network | ||
|
|
||
| volumes: | ||
| mongodb_dev_data: | ||
| uv_cache: | ||
|
|
||
| networks: | ||
| dev_network: | ||
| driver: bridge | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| [project] | ||
| name = "code-review-gpt-gitlab" | ||
| version = "1.0.0" | ||
| description = "Code Review GPT GitLab Backend" | ||
| requires-python = ">=3.11" | ||
|
|
||
| dependencies = [ | ||
| "Django==4.1.13", | ||
| "djangorestframework==3.14.0", | ||
| "django-cors-headers==4.3.1", | ||
| "requests==2.31.0", | ||
| "requests-toolbelt==1.0.0", | ||
| "retrying==1.3.4", | ||
| "openai==1.59.7", | ||
| "unionllm==0.1.23", | ||
| "litellm==1.58.2", | ||
| "python-gitlab==3.15.0", | ||
| "python-dateutil==2.8.2", | ||
| "gunicorn==21.2.0", | ||
| "gevent==23.9.1", | ||
| "python-dotenv==1.0.0", | ||
| "psutil==5.9.8", | ||
| ] | ||
|
|
||
| [dependency-groups] | ||
| dev = [ | ||
| "black>=23.0.0", | ||
| "flake8>=6.0.0", | ||
| "pytest>=7.0.0", | ||
| "pytest-django>=4.5.0", | ||
| ] | ||
|
Comment on lines
+1
to
+31
There was a problem hiding this comment. 🧩 Analysis chainVerify dependency versions for security vulnerabilities and latest releases. Several dependencies are pinned to specific versions that may be outdated or have known security vulnerabilities. Given the project involves Django and OpenAI integrations, it's critical to ensure these are secure. Run the following script to check for security advisories and available updates: 🏁 Script executed: #!/bin/bash
# Check for security vulnerabilities in Python dependencies
echo "=== Checking for security advisories ==="
for pkg in "Django" "djangorestframework" "django-cors-headers" "requests" "openai" "python-gitlab" "gunicorn" "gevent"; do
echo "--- $pkg ---"
gh api graphql -f query="
{
securityVulnerabilities(first: 5, ecosystem: PIP, package: \"$pkg\") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}"
done
echo ""
echo "=== Checking latest versions on PyPI ==="
for pkg in "Django" "djangorestframework" "django-cors-headers" "requests" "openai" "litellm" "python-gitlab" "gunicorn"; do
echo -n "$pkg: "
curl -s "https://pypi.org/pypi/$pkg/json" | jq -r '.info.version'
doneLength of output: 4857 Update dependencies to address critical and high-severity security vulnerabilities. Verification found multiple security issues:
Recommended versions: Django ≥4.2.26, Gunicorn ≥22.0.0, requests ≥2.32.5, djangorestframework ≥3.16.1 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Inefficient uv installation on every container creation.
Installing
uvvia a shell script inpostCreateCommandruns on every container creation, which is inefficient. Theuvtool should be installed once during the Docker image build process.Move the uv installation to the
Dockerfileor a build script so it's baked into the image, then simplify thepostCreateCommand:Ensure your Docker image (referenced by
docker-compose.yml) installsuvduring the build:🤖 Prompt for AI Agents