Feat/deployment script

.containerignore

@@ -0,0 +1,21 @@
+config.yaml
+run.py
+.git
+.venv
+.env
+.ruff_cache
+.pytest_cache
+frontend
+.github
+docs
+Makefile
+.pre-commit-config.yaml
+LICENSE
+.gitignore
+.containerignore
+.gitmodules
+podman-compose.yaml
+__pycache__
+*.py[codz]
+**/__pycache__
+**/*.py[codz]

.env.example

@@ -14,8 +14,8 @@ SECRET_KEY=django-insecure-my-local-dev-secret-key
 # --- Infrastructure (REQUIRED) ---
 # Use a single URL for database and Redis connections.
 # Format: driver://user:password@host:port/dbname
-DATABASE__URL=postgres://admin:test@127.0.0.1:5432/coursereview
-REDIS__URL=redis://localhost:6379/0
+DATABASE__URL=postgres://admin:test@db:5432/coursereview
+REDIS__URL=redis://cache:6379/0
 
 # --- External Services Secrets (REQUIRED) ---
 TURNSTILE_SECRET_KEY=dummy0

.github/workflows/bot.yaml

@@ -36,7 +36,7 @@ on:
   public:
   pull_request:
     branches:
-      - '*'
+      - "*"
     types: [opened, reopened]
   pull_request_review:
     types: [edited, dismissed, submitted]
@@ -46,7 +46,7 @@ on:
     types: [assigned, opened, synchronize, reopened]
   push:
     branches:
-      - '*'
+      - "*"
   registry_package:
     types: [published]
   release:

.github/workflows/build-image.yml

@@ -0,0 +1,54 @@
+name: Publish container image
+
+on:
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ghcr.io/tech-ji/coursereview
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=sha-
+            type=ref,event=tag
+          labels: |
+            org.opencontainers.image.source=https://github.com/Tech-JI/CourseReview
+            org.opencontainers.image.description=CourseReview Django application
+
+      - name: Build and push image
+        id: push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ./Containerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Show digest
+        run: |
+          echo "Digest: ${{ steps.push.outputs.digest }}"

.github/workflows/pytest.yml

@@ -1,13 +1,10 @@
-# This workflow will install Python dependencies, run tests with a single version of Python
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python
-
-name: Python application
+name: pytest
 
 on:
   push:
-    branches: [ "dev", "main" ]
+    branches: ["dev", "main"]
   pull_request:
-    branches: [ "dev", "main" ]
+    branches: ["dev", "main"]
 
 permissions:
   contents: read
@@ -17,40 +14,65 @@
     runs-on: ubuntu-latest
 
     services:
-        postgres:
-          image: postgres:18
-          env:
-            POSTGRES_DB: coursereview
-            POSTGRES_USER: admin
-            POSTGRES_PASSWORD: test
-          ports:
-            - 5432:5432
-          options: >-
-            --health-cmd pg_isready
-            --health-interval 10s
-            --health-timeout 5s
-            --health-retries 5
+      db:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_DB: coursereview
+          POSTGRES_USER: admin
+          POSTGRES_PASSWORD: test
+        ports:
+          - "5432:5432"
+        options: >-
+          --health-cmd "pg_isready -U admin -d coursereview"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+      cache:
+        image: valkey/valkey:9-alpine
+        ports:
+          - "6379:6379"
+        options: >-
+          --health-cmd "valkey-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      SECRET_KEY: 02247f40-a769-4c49-9178-4c038048e7ad
+      DATABASE__URL: postgres://admin:test@db:5432/coursereview
+      REDIS__URL: redis://cache:6379/0
+
+      TURNSTILE_SECRET_KEY: dummy0
+
+      QUEST__SIGNUP__API_KEY: dummy1
+      QUEST__SIGNUP__URL: https://wj.sjtu.edu.cn/q/dummy0
+      QUEST__SIGNUP__QUESTIONID: "10000000"
+
+      QUEST__LOGIN__API_KEY: dummy2
+      QUEST__LOGIN__URL: https://wj.sjtu.edu.cn/q/dummy1
+      QUEST__LOGIN__QUESTIONID: "10000001"
+
+      QUEST__RESET__API_KEY: dummy3
+      QUEST__RESET__URL: https://wj.sjtu.edu.cn/q/dummy2
+      QUEST__RESET__QUESTIONID: "10000002"
 
     steps:
-    - uses: actions/checkout@v6
-
-    - name: Install python
-      uses: actions/setup-python@v6
-      with:
-          python-version-file: "pyproject.toml"
-
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        enable-cache: true
-        version: "0.10.7"
-
-    - name: Install the project
-      run: uv sync --group dev
-
-    - name: Test with pytest
-      env:
-        DATABASE__URL: postgres://admin:test@localhost:5432/coursereview
-        SECRET_KEY: 02247f40-a769-4c49-9178-4c038048e7ad
-      run: |
-        uv run pytest
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version-file: pyproject.toml
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --frozen --group dev
+
+      - name: Run pytest
+        run: python run.py test

.pre-commit-config.yaml

@@ -1,15 +1,28 @@
-repos:
+default_language_version:
+  python: 3.14
 
+repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
       - id: check-added-large-files
+      - id: check-ast
+      - id: check-builtin-literals
+      - id: check-case-conflict
+      - id: check-illegal-windows-names
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: check-yaml
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: no-commit-to-branch
+      - id: pretty-format-json
+      - id: requirements-txt-fixer
+      - id: trailing-whitespace
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.5
+    rev: v0.15.2
     hooks:
       - id: ruff-check
         types_or: [python, pyi]

Containerfile

@@ -0,0 +1,20 @@
+FROM ghcr.io/astral-sh/uv:python3.14-trixie-slim AS builder
+
+WORKDIR /app
+
+COPY . /app
+
+RUN UV_PROJECT_ENVIRONMENT=/usr/local \
+    uv sync --project=/app --frozen --compile-bytecode --no-dev --no-editable --no-managed-python
+
+FROM gcr.io/distroless/base-debian13:nonroot
+
+COPY --from=builder /usr/local /usr/local
+
+COPY --from=builder /app /app
+
+WORKDIR /app
+
+USER nonroot
+
+ENTRYPOINT ["python", "scripts/entrypoint.py"]

apps/auth/utils.py

@@ -46,7 +46,7 @@ def get_survey_details(action: str) -> dict[str, Any] | None:
 
     try:
         question_id = int(action_details.get("QUESTIONID"))
-    except (ValueError, TypeError):
+    except ValueError, TypeError:
         logger.error(
             "Could not parse 'QUESTIONID' for action '%s'. Check your settings.", action
         )

apps/auth/views.py

@@ -240,7 +240,7 @@ def verify_callback_api(request):
         otp_data = json.loads(otp_data_raw.decode("utf-8"))
         expected_temp_token = otp_data.get("temp_token")
         initiated_at = otp_data.get("initiated_at")
-    except (json.JSONDecodeError, AttributeError):
+    except json.JSONDecodeError, AttributeError:
         logger.error("Invalid OTP data format in verify_callback_api")
         return Response({"error": "Invalid OTP data format"}, status=401)
 
@@ -268,7 +268,7 @@ def verify_callback_api(request):
                 status=401,
             )
 
-    except (ValueError, TypeError):
+    except ValueError, TypeError:
         logger.error("Error parsing submission timestamp")
         return Response({"error": "Invalid submission timestamp"}, status=401)
 

apps/web/views.py

@@ -134,7 +134,7 @@ def _filter_by_score(self, queryset):
                 try:
                     threshold = int(param_value)
                     queryset = queryset.filter(**{f"{field_name}__gte": threshold})
-                except (ValueError, TypeError):
+                except ValueError, TypeError:
                     pass
         return queryset