chore(debugger): migrate to uv (#847)

* chore(debugger): migrate to uv

* fix(ci): working-directory is under `with`

* chore(ci): make separate sanity job for debugger

- ruff and mypy checks to be resolved in later PR

Author: goldfish088

.github/workflows/pre-merge.yml

@@ -5,7 +5,7 @@ on:
     types: [opened, reopened, synchronize, edited]
 
 jobs:
-  sanity:
+  sanity-client:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -22,3 +22,20 @@ jobs:
         working-directory: ./client
         run: npm run build
 
+  sanity-debugger:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9
+        with:
+          working-directory: debugger
+      - name: Install debugger dependencies
+        working-directory: debugger
+        run: uv sync --locked --all-extras --dev
+      # - run: uv format --check
+      #   working-directory: debugger
+      # - run: uv run mypy src/
+      #   working-directory: debugger
+
+

debugger/Dockerfile.prod

@@ -1,19 +1,42 @@
-from python:3.13.3-bookworm
+# adapted from https://github.com/astral-sh/uv-docker-example/blob/main/Dockerfile
+from ghcr.io/astral-sh/uv:python3.13-trixie-slim
+
+run groupadd --system --gid 999 nonroot \
+ && useradd --system --gid 999 --uid 999 --create-home nonroot
 
 workdir /app
 
+env PYTHONUNBUFFERED=1
+env UV_COMPILE_BYTECODE=1
+env UV_LINK_MODE=copy
+env UV_NO_DEV=1
+env UV_TOOL_BIN_DIR=/usr/local/bin
+
+
 run apt-get update -y
 run apt-get install -y gdb libprotobuf32 libnl-3-200 libnl-route-3-200 flex bison protobuf-compiler libnl-genl-3-dev libnl-3-dev libnl-route-3-dev git
 
-copy requirements.txt .
-run pip3 install -r requirements.txt --root-user-action=ignore
+run --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync --locked --no-install-project
+
+copy . /app
+run --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked
+
+env PATH="/app/.venv/bin:$PATH"
+
+entrypoint []
+
+user nonroot
 
-copy . .
 workdir /app/src/debugger
 # run git clone https://github.com/google/nsjail.git
 # workdir /app/src/debugger/nsjail
 # run make && cp nsjail /usr/local/bin
 workdir /app
 
 expose 8000
-cmd ["python3", "src/serve.py"]
+cmd ["python", "src/serve.py"]
+

debugger/pyproject.toml

@@ -1,18 +1,24 @@
 [build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"
+requires = ["uv_build>=0.12.3,<0.13"]
+build-backend = "uv_build"
 
 [project]
 name = "debugger"
 version = "0.1.0"
 requires-python = ">=3.13,<3.14"
+dependencies = [
+  "aiofiles >=25, <26",
+  "python-socketio >=5.16, <5.17",
+  "uvicorn==0.52.0",
+  "pydantic >=2, <3",
+  "orjson >=3, <4",
+  "pyroscope-io >=1, <2"
+]
 
-[project.scripts]
-check = "pyproject_commands:check"
+[dependency-groups]
+dev = [
+  "pytest >=9.1, <9.2",
+  "mypy >=2.3, <2.4",
+  "ruff==0.16.2"
+]
 
-[tool.hatch.build.targets.wheel]
-packages = []
-only-include = ["pyproject_commands.py"]
-
-[tool.mypy]
-check_untyped_defs = true