Dependency cooldowns

.github/workflows/lint-check.yml

@@ -19,7 +19,9 @@ jobs:
         python-version: '3.x'
 
     - name: Install autopep8
-      run: pip install autopep8
+      run: |
+        python -m pip install --upgrade pip
+        pip install --uploaded-prior-to=P7D autopep8
 
     - name: Run lint-check.sh
       run: bash lint-check.sh

.github/workflows/test.yml

@@ -32,7 +32,8 @@ jobs:
       - name: Install dependencies
         run: |
           curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-          pip install tox
+          python -m pip install --upgrade pip
+          pip install --uploaded-prior-to=P7D tox
 
       - name: Run tox - models
         run: tox -c libraries/models/

.gitignore

@@ -26,4 +26,8 @@ tools/deployment-cli-tools/tests/resources/migration
 tools/deployment-cli-tools/tests/resources/migration.bak
 /.venv
 .history
-Tiltfile
+Tiltfile
+# yarn 4 local install metadata
+**/.yarn/install-state.gz
+**/.yarn/cache
+**/.pnp.*

.yarnrc.yml

@@ -0,0 +1,11 @@
+# Yarn settings shared by every JavaScript project in this repo.
+# The cloudharness-frontend-build base image sets the same values as YARN_* environment
+# variables, so container builds and developer machines behave identically.
+
+# Keep the classic node_modules layout: vite, eslint and jest resolve through it.
+nodeLinker: node-modules
+
+# Supply chain cooldown: ignore package versions published less than 7 days ago,
+# mirroring the pip --uploaded-prior-to=P7D quarantine window. Yarn's own default is 1 day.
+# Exempt a package with npmPreapprovedPackages.
+npmMinimalAgeGate: "7d"

application-templates/django-fastapi/Dockerfile

@@ -8,7 +8,7 @@ ENV APP_DIR=/app
 WORKDIR ${APP_DIR}
 COPY frontend/package.json ${APP_DIR}
 COPY frontend/yarn.lock ${APP_DIR}
-RUN yarn install --frozen-lockfile --timeout 60000
+RUN yarn install --immutable
 
 COPY frontend ${APP_DIR}
 RUN yarn build
@@ -22,10 +22,10 @@ RUN mkdir -p ${APP_DIR}/static/www
 
 COPY backend/requirements.txt ${APP_DIR}
 RUN --mount=type=cache,target=/root/.cache python -m pip install --upgrade pip &&\
-    pip3 install --no-cache-dir -r requirements.txt --prefer-binary
+    pip3 install --uploaded-prior-to=P7D --no-cache-dir -r requirements.txt --prefer-binary
 
 COPY backend/requirements.txt backend/setup.py ${APP_DIR}
-RUN python3 -m pip install -e .
+RUN python3 -m pip install --uploaded-prior-to=P7D -e .
 
 COPY backend ${APP_DIR}
 RUN python3 manage.py collectstatic --noinput

application-templates/django-fastapi/dev-setup.sh

@@ -29,23 +29,23 @@ pip install --upgrade pip || pip_upgrade_error
 # Install pip dependencies from cloudharness-base-debian image
 
 if $INSTALL_PYTEST; then
-    pip install pytest || install_error pytest
+    pip install --uploaded-prior-to=P7D pytest || install_error pytest
 fi
 
-pip install -r "$CH_DIRECTORY/libraries/models/requirements.txt" || install_error "models requirements"
-pip install -r "$CH_DIRECTORY/libraries/cloudharness-common/requirements.txt" || install_error "cloudharness-common requirements"
-pip install -r "$CH_DIRECTORY/libraries/client/cloudharness_cli/requirements.txt" || install_error "cloudharness_cli requirements"
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/libraries/models/requirements.txt" || install_error "models requirements"
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/libraries/cloudharness-common/requirements.txt" || install_error "cloudharness-common requirements"
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/libraries/client/cloudharness_cli/requirements.txt" || install_error "cloudharness_cli requirements"
 
-pip install -e "$CH_DIRECTORY/libraries/models" || install_error models
-pip install -e "$CH_DIRECTORY/libraries/cloudharness-common" || install_error cloudharness-common
-pip install -e "$CH_DIRECTORY/libraries/client/cloudharness_cli" || install_error cloudharness_cli
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/libraries/models" || install_error models
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/libraries/cloudharness-common" || install_error cloudharness-common
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/libraries/client/cloudharness_cli" || install_error cloudharness_cli
 
 # Install pip dependencies from cloudharness-django image
 
-pip install -r "$CH_DIRECTORY/infrastructure/common-images/cloudharness-django/libraries/fastapi/requirements.txt" || install_error "cloudharness-django fastapi requirements"
-pip install -e "$CH_DIRECTORY/infrastructure/common-images/cloudharness-django/libraries/cloudharness-django" || install_error cloudharness-django
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/infrastructure/common-images/cloudharness-django/libraries/fastapi/requirements.txt" || install_error "cloudharness-django fastapi requirements"
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/infrastructure/common-images/cloudharness-django/libraries/cloudharness-django" || install_error cloudharness-django
 
 # Install application
 
-pip install -r "$CURRENT_DIRECTORY/backend/requirements.txt" || install_error "$APP_NAME dependencies"
-pip install -e "$CURRENT_DIRECTORY/backend" || install_error "$APP_NAME"
+pip install --uploaded-prior-to=P7D -r "$CURRENT_DIRECTORY/backend/requirements.txt" || install_error "$APP_NAME dependencies"
+pip install --uploaded-prior-to=P7D -e "$CURRENT_DIRECTORY/backend" || install_error "$APP_NAME"

application-templates/django-ninja/Dockerfile

@@ -8,7 +8,7 @@ ARG APP_DIR=/app
 WORKDIR ${APP_DIR}
 COPY frontend/package.json .
 COPY frontend/yarn.lock .
-RUN yarn install --timeout 60000
+RUN yarn install --immutable
 
 COPY frontend .
 RUN yarn build
@@ -22,10 +22,10 @@ RUN mkdir -p ${APP_DIR}/static/www
 
 COPY backend/requirements.txt ${APP_DIR}
 RUN --mount=type=cache,target=/root/.cache python -m pip install --upgrade pip &&\
-    pip3 install --no-cache-dir -r requirements.txt --prefer-binary
+    pip3 install --uploaded-prior-to=P7D --no-cache-dir -r requirements.txt --prefer-binary
 
 COPY backend/requirements.txt backend/setup.py ${APP_DIR}
-RUN python3 -m pip install -e .
+RUN python3 -m pip install --uploaded-prior-to=P7D -e .
 
 COPY backend ${APP_DIR}
 RUN python3 manage.py collectstatic --noinput

application-templates/django-ninja/dev-setup.sh

@@ -29,22 +29,22 @@ pip install --upgrade pip || pip_upgrade_error
 # Install pip dependencies from cloudharness-base-debian image
 
 if $INSTALL_PYTEST; then
-    pip install pytest || install_error pytest
+    pip install --uploaded-prior-to=P7D pytest || install_error pytest
 fi
 
-pip install -r "$CH_DIRECTORY/libraries/models/requirements.txt" || install_error "models requirements"
-pip install -r "$CH_DIRECTORY/libraries/cloudharness-common/requirements.txt" || install_error "cloudharness-common requirements"
-pip install -r "$CH_DIRECTORY/libraries/client/cloudharness_cli/requirements.txt" || install_error "cloudharness_cli requirements"
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/libraries/models/requirements.txt" || install_error "models requirements"
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/libraries/cloudharness-common/requirements.txt" || install_error "cloudharness-common requirements"
+pip install --uploaded-prior-to=P7D -r "$CH_DIRECTORY/libraries/client/cloudharness_cli/requirements.txt" || install_error "cloudharness_cli requirements"
 
-pip install -e "$CH_DIRECTORY/libraries/models" || install_error models
-pip install -e "$CH_DIRECTORY/libraries/cloudharness-common" || install_error cloudharness-common
-pip install -e "$CH_DIRECTORY/libraries/client/cloudharness_cli" || install_error cloudharness_cli
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/libraries/models" || install_error models
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/libraries/cloudharness-common" || install_error cloudharness-common
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/libraries/client/cloudharness_cli" || install_error cloudharness_cli
 
 # Install pip dependencies from cloudharness-django image
 
-pip install -e "$CH_DIRECTORY/infrastructure/common-images/cloudharness-django/libraries/cloudharness-django" || install_error cloudharness-django
+pip install --uploaded-prior-to=P7D -e "$CH_DIRECTORY/infrastructure/common-images/cloudharness-django/libraries/cloudharness-django" || install_error cloudharness-django
 
 # Install application
 
-pip install -r "$CURRENT_DIRECTORY/backend/requirements.txt" || install_error "$APP_NAME dependencies"
-pip install -e "$CURRENT_DIRECTORY/backend" || install_error "$APP_NAME"
+pip install --uploaded-prior-to=P7D -r "$CURRENT_DIRECTORY/backend/requirements.txt" || install_error "$APP_NAME dependencies"
+pip install --uploaded-prior-to=P7D -e "$CURRENT_DIRECTORY/backend" || install_error "$APP_NAME"

application-templates/flask-server/backend/Dockerfile

@@ -9,10 +9,10 @@ ENV PORT=8080
 COPY requirements.txt /usr/src/app/
 
 RUN --mount=type=cache,target=/root/.cache python -m pip install --upgrade pip &&\
-    pip3 install --no-cache-dir -r requirements.txt
+    pip3 install --uploaded-prior-to=P7D --no-cache-dir -r requirements.txt
 
 COPY . /usr/src/app
 
-RUN pip3 install -e .
+RUN pip3 install --uploaded-prior-to=P7D -e .
 
 ENTRYPOINT gunicorn --workers=$WORKERS --bind=0.0.0.0:$PORT $MODULE_NAME.__main__:app

application-templates/webapp/Dockerfile

@@ -8,7 +8,7 @@ ENV APP_DIR=/app
 WORKDIR ${APP_DIR}
 COPY frontend/package.json ${APP_DIR}
 COPY frontend/yarn.lock ${APP_DIR}
-RUN yarn install --frozen-lockfile --timeout 60000
+RUN yarn install --immutable
 
 COPY frontend ${APP_DIR}
 RUN yarn build
@@ -23,12 +23,12 @@ ENV PORT=8080
 COPY backend/requirements.txt /usr/src/app/
 
 RUN --mount=type=cache,target=/root/.cache python -m pip install --upgrade pip &&\
-    pip3 install -r requirements.txt  --prefer-binary
+    pip3 install --uploaded-prior-to=P7D -r requirements.txt  --prefer-binary
 
 COPY backend/ /usr/src/app
 
 COPY --from=frontend app/dist/ /usr/src/app/www
 
-RUN pip3 install -e .
+RUN pip3 install --uploaded-prior-to=P7D -e .
 
 CMD gunicorn --workers=$WORKERS --bind=0.0.0.0:$PORT $MODULE_NAME.__main__:app --timeout 180

application-templates/webapp/frontend/package.json

@@ -1,5 +1,6 @@
 {
   "name": "__APP_NAME__",
+  "packageManager": "yarn@4.18.0",
   "scripts": {
     "dev": "vite",
     "start": "DOMAIN=http://localhost:5000 vite",

applications/common/server/Dockerfile

@@ -8,12 +8,12 @@ ENV WORKERS=2
 ENV PORT=8080
 RUN apt update && apt install -y postgresql
 
-COPY ./requirements.txt /usr/src/app/
+COPY ./pylock.toml /usr/src/app/
 
-RUN pip3 install --no-cache-dir -r requirements.txt
+RUN pip3 install --no-cache-dir -r pylock.toml
 
 COPY . /usr/src/app
 
 ENV FLASK_ENV=production
 ENV APP_SETTINGS=common.config.ProductionConfig
-RUN pip3 install -e /usr/src/app
+RUN pip3 install --uploaded-prior-to=P7D -e /usr/src/app