Skip to content

feat(python): Replace custom Python build by managed pre-built one#11421

Open
heliocastro wants to merge 3 commits into
oss-review-toolkit:mainfrom
cariad-tech:feat/python_build
Open

feat(python): Replace custom Python build by managed pre-built one#11421
heliocastro wants to merge 3 commits into
oss-review-toolkit:mainfrom
cariad-tech:feat/python_build

Conversation

@heliocastro

Copy link
Copy Markdown
Contributor

To prevent unnecessary Python builds caused by pyenv and to reduce the time and overhead during the Docker build process, it's preferable to use a pre-built managed Python environment.

To avoid any breaking changes, we will utilize a similar approach to the previous method, using a managed Python version with a virtual environment by default. This approach will remain transparent to users while achieving the same results.

@heliocastro heliocastro self-assigned this Feb 11, 2026
@heliocastro heliocastro requested a review from a team as a code owner February 11, 2026 16:59
Comment thread .github/workflows/docker-build.yml Fixed
Comment thread Dockerfile
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
/tmp/gleam.tar.gz \
--bundle /tmp/gleam.sigstore \
--certificate-identity-regexp "^https://github.com/gleam-lang/gleam/.*@refs/tags/v${GLEAM_VERSION}$" \

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 5: containerImage not pinned by hash
Click Remediation section below to solve this issue
Comment thread Dockerfile
Comment on lines +150 to +152
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
&& uv --version \
&& uv venv -p ${PYTHON_VERSION} ${UV_PYTHON_INSTALL_DIR}/ort-venv

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 6: downloadThenRun not pinned by hash
Click Remediation section below to solve this issue
To prevent unnecessary Python builds caused by pyenv and to reduce the
time and overhead during the Docker build process, it's preferable to
use a pre-built managed Python environment.

To avoid any breaking changes, we will utilize a similar approach to the
previous method, using a managed Python version with a virtual environment
by default. This approach will remain transparent to users while achieving
the same results.

Signed-off-by: Helio Chissini de Castro <helio.chissini.de.castro@cariad.technology>
@codecov

codecov Bot commented Feb 11, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.76%. Comparing base (38fba04) to head (845eb4b).

Additional details and impacted files
@@            Coverage Diff            @@
##               main   #11421   +/-   ##
=========================================
  Coverage     57.76%   57.76%           
+ Complexity     1713     1711    -2     
=========================================
  Files           347      347           
  Lines         12902    12902           
  Branches       1236     1236           
=========================================
  Hits           7453     7453           
  Misses         5000     5000           
  Partials        449      449           
Flag Coverage Δ
funTest-external-tools 14.14% <ø> (ø)
funTest-no-external-tools 30.92% <ø> (-0.10%) ⬇️
test-ubuntu-24.04 42.48% <ø> (ø)
test-windows-2025 42.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Helio Chissini de Castro <helio.chissini.de.castro@cariad.technology>
@heliocastro

Copy link
Copy Markdown
Contributor Author

@sschuberth I did not pinned Uv per se, as we don't use APi from Uv, only kept pinned same Python, i'm waiting for the tests, but sounds good to go to review

@nnobelis

Copy link
Copy Markdown
Member

BTW @heliocastro, can we close #10127 ? Is it still needed ?

@heliocastro

heliocastro commented Feb 12, 2026

Copy link
Copy Markdown
Contributor Author

@nnobelis Different case, but we don't have data on people using conan2 in a relevant way, so I will close that one. If someone raises this as a problem in the future, we can revisit it.

Comment thread Dockerfile
Comment on lines +184 to +185
&& [ "$(arch)" = "aarch64" ] && conan_arch="aarch64" || conan_arch="x86_64" \
&& curl -L https://github.com/conan-io/conan/releases/download/$CONAN2_VERSION/conan-$CONAN2_VERSION-linux-${conan_arch}.tgz | tar -xvz \

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've split this out as two commits for clarity: #11472

Comment thread Dockerfile
ENV UV_PYTHON_INSTALL_DIR=/opt/python
ENV UV_INSTALL_DIR=${UV_PYTHON_INSTALL_DIR}/bin
ENV PATH=$PATH:${UV_INSTALL_DIR}:${UV_PYTHON_INSTALL_DIR}/ort-venv/bin
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still wondering: Why do yo install uv here instead of downloading the pre-compiled Python distributions directly as described at https://gregoryszorc.com/docs/python-build-standalone/main/running.html#obtaining-distributions?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Three reasons in one.

  • keep the same vendo behavior did before by pyenv
  • Install uv as is not available in docker
  • Have the update of python patch versions been manager directly

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants