Upstream: Embed PDF in answers, Tooling & Dep upgrades, Bugfixes

.github/workflows/ci.yaml

@@ -54,11 +54,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Cache pip dependencies
-        uses: actions/cache@v4
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
         with:
-          path: backend/.cache/pip
-          key: ${{ runner.os }}-pip-dependencies-${{ hashFiles('backend/requirements.txt') }}
+          version: "0.10.7"
+          enable-cache: true
+          cache-dependency-glob: backend/uv.lock
 
       - name: Install mc
         # Install mc so that we can create the community-solutions bucket in minio
@@ -73,10 +74,10 @@ jobs:
         run: |
           apt update && apt install -y --no-install-recommends poppler-utils
 
-      - name: Install pip dependencies
+      - name: Install Python dependencies
         run: |
-          pip3 install -r backend/requirements.txt
-          pip3 install tblib
+          cd backend
+          uv sync --locked
 
       - name: Make/copy files
         # Make/copy files (same as Dockerfile definition) to make resources availabe to tests
@@ -100,7 +101,7 @@ jobs:
           SIP_S3_FILES_USE_SSL: false
         run: |
           cd backend
-          python3 manage.py test --parallel # parallel speeds up by approx 4x.
+          uv run manage.py test --parallel # parallel speeds up by approx 4x.
 
   typecheck-lint:
     name: Frontend Typecheck & Lint

.gitignore

@@ -8,6 +8,8 @@ __pycache__
 temp-gen
 data
 .envrc
+.env
 shell.nix
 .direnv
 keys
+mise.local.toml

.pre-commit-config.yaml

@@ -0,0 +1,4 @@
+# Any repo-wide pre-commit hooks go here.
+# Otherwise, backend- and frontend-specific hooks are in their
+# respective configs in each directory.
+repos: []

Dockerfile

@@ -14,23 +14,28 @@ ARG git_commit="<none>"
 
 FROM eu.gcr.io/vseth-public/base:echo AS backend
 LABEL maintainer='cat@vis.ethz.ch'
-
 WORKDIR /app
 
-RUN mkdir intermediate_pdf_storage && chown app-user:app-user intermediate_pdf_storage
-
-COPY ./backend/requirements.txt ./requirements.txt
-RUN apt-get update -y
-RUN apt-get install -y --no-install-recommends \
-     python3 python3-pip \
-     python3-setuptools python3-cryptography \
-     smbclient poppler-utils \
-     pgbouncer
-RUN	pip3 install -r requirements.txt
+# install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    smbclient poppler-utils \
+    pgbouncer
+# slightly minimize docker image
 RUN	rm -rf /var/lib/apt/lists/*
 
-COPY ./backend/ ./
+# install python dependencies
+COPY --from=astral/uv:0.10 /uv /bin/
+COPY ./backend/pyproject.toml ./backend/uv.lock ./backend/.python-version ./
+
+# Temporarily switch to non-root user to install deps and temp write dirs, since
+# cinit will run the final process as app-user and won't be able to access
+# files created by root. Easiser than chowning files after creation.
+USER app-user
+RUN uv sync --locked --no-dev
+RUN mkdir intermediate_pdf_storage
+USER root
 
+COPY ./backend/ ./
 COPY ./frontend/public/exam10.pdf ./exam10.pdf
 COPY ./frontend/public/static ./static
 
@@ -40,13 +45,14 @@ ENV PYTHONUNBUFFERED True
 COPY ./pgbouncer ./pgbouncer
 COPY cinit.yml /etc/cinit.d/community-solutions.yml
 
+# -------------------------------
 
 FROM node:20-alpine AS frontend-base
 
 WORKDIR /usr/src/app
 COPY ./frontend/package.json \
-  ./frontend/yarn.lock \
-  ./frontend/index.html .
+    ./frontend/yarn.lock \
+    ./frontend/index.html ./
 
 RUN yarn --ignore-engines
 
@@ -56,34 +62,41 @@ ARG git_branch
 ARG git_commit
 
 COPY ./frontend/tsconfig.json \
-  ./frontend/postcss.config.cjs \
-  ./frontend/vite.config.ts \
-  ./frontend/eslint.config.mjs \
-  ./frontend/.env.production \
-  ./frontend/.prettierrc.json .
+    ./frontend/postcss.config.cjs \
+    ./frontend/vite.config.ts \
+    ./frontend/eslint.config.mjs \
+    ./frontend/.env.production \
+    ./frontend/.prettierrc.json ./
 COPY ./frontend/public ./public
 COPY ./frontend/src ./src
 ENV VITE_GIT_BRANCH=${git_branch}
 ENV VITE_GIT_COMMIT=${git_commit}
 RUN yarn run build
 
+# -------------------------------
+
 FROM backend AS combined
 
 COPY --from=frontend-build /usr/src/app/build/manifest.json \
-  /usr/src/app/build/favicon.ico .
+    /usr/src/app/build/favicon.ico ./
 COPY --from=frontend-build /usr/src/app/build/index.html ./templates/index.html
 COPY --from=frontend-build /usr/src/app/build/static ./static
 
+# Bundle Django/app package static assets (e.g. Django Ninja docs UI files)
+# into STATIC_ROOT for production serving.
+RUN uv run manage.py collectstatic --noinput
+
 EXPOSE 80
 
+# -------------------------------
 
 # Development-only stages
 # Backend
 FROM backend AS backend-hotreload
 
 ENV IS_DEBUG true
-CMD python3 manage.py migrate \
-     && python3 manage.py runserver 0:8081
+CMD uv run manage.py migrate \
+    && uv run manage.py runserver 0:8081
 
 # Frontend
 FROM frontend-base AS frontend-dev
@@ -96,4 +109,3 @@ CMD ["yarn", "start-docker"]
 
 # Production build as final result
 FROM combined
-