Refactor Docker CI workflow for improved structure

Author: 1minds3t

.github/workflows/docker-ci-ghcr.yml

@@ -1,59 +1,47 @@
-name: CI - Build and Push to GHCR
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      force_build:
-        description: 'Force build and push'
-        required: false
-        default: 'false'
-        type: boolean
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
-jobs:
-  build-and-push-ghcr:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      
-      - name: Extract metadata (tags, labels)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
-      
-      - name: Build and push to GHCR
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+# Start from a Python base image
+FROM python:3.10-slim
+
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    redis-server \
+    libmagic1 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create a non-root user and group
+RUN addgroup --system omnipkg && adduser --system --ingroup omnipkg omnipkg
+
+# Set the working directory
+WORKDIR /home/omnipkg
+
+# Copy project files (including src/) BEFORE installing
+COPY --chown=omnipkg:omnipkg pyproject.toml poetry.lock* ./
+COPY --chown=omnipkg:omnipkg src/ ./src/
+COPY --chown=omnipkg:omnipkg README.md ./
+
+# Install Python dependencies
+RUN pip install --no-cache-dir .
+
+# Copy the entrypoint script
+COPY --chown=omnipkg:omnipkg docker-entrypoint.sh ./
+RUN chmod +x /home/omnipkg/docker-entrypoint.sh
+
+# Create directories for omnipkg data BEFORE switching user
+RUN mkdir -p /home/omnipkg/.omnipkg && \
+    chown -R omnipkg:omnipkg /home/omnipkg
+
+# NOW switch to non-root user
+USER omnipkg
+
+# Expose Redis port (in case external access needed)
+EXPOSE 6379
+
+# Expose the application port
+EXPOSE 8000
+
+# Specify the entrypoint script
+ENTRYPOINT ["/home/omnipkg/docker-entrypoint.sh"]