build: add uv.lock for reproducible Docker builds

Dockerfile

@@ -5,16 +5,15 @@ WORKDIR /build
 
 RUN apk add --no-cache gcc musl-dev libffi-dev
 
-COPY requirements.txt .
-RUN python -m venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
-RUN --mount=type=cache,target=/root/.cache/pip \
-    pip install --no-compile -r requirements.txt \
-    && find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null; \
-       find /opt/venv -type f -name "*.pyc" -delete 2>/dev/null; \
-       find /opt/venv -type f -name "*.pyo" -delete 2>/dev/null; \
-       find /opt/venv -type d -name "tests" -exec rm -rf {} + 2>/dev/null; \
-       find /opt/venv -type d -name "test" -exec rm -rf {} + 2>/dev/null; true
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /bin/uv
+
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project \
+    && find .venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null; \
+       find .venv -type f -name "*.pyc" -delete 2>/dev/null; \
+       find .venv -type f -name "*.pyo" -delete 2>/dev/null; \
+       find .venv -type d -name "tests" -exec rm -rf {} + 2>/dev/null; \
+       find .venv -type d -name "test" -exec rm -rf {} + 2>/dev/null; true
 
 # -- Runtime stage --
 FROM python:3.14-alpine
@@ -27,17 +26,17 @@ LABEL org.opencontainers.image.licenses="GPL-3.0"
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
-    PATH="/opt/venv/bin:$PATH"
+    PATH="/app/.venv/bin:$PATH"
 
 RUN apk add --no-cache su-exec
 
-COPY --from=builder /opt/venv /opt/venv
-
 RUN adduser -D -u 1000 cashpilot \
     && mkdir -p /data && chown cashpilot:root /data
 
 WORKDIR /app
 
+COPY --from=builder /build/.venv ./.venv
+
 COPY --chown=cashpilot:root app/ ./app/
 COPY --chown=cashpilot:root services/ ./services/
 COPY entrypoint.sh /entrypoint.sh

Dockerfile.worker

@@ -5,16 +5,15 @@ WORKDIR /build
 
 RUN apk add --no-cache gcc musl-dev libffi-dev
 
-COPY requirements-worker.txt .
-RUN python -m venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
-RUN --mount=type=cache,target=/root/.cache/pip \
-    pip install --no-compile -r requirements-worker.txt \
-    && find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null; \
-       find /opt/venv -type f -name "*.pyc" -delete 2>/dev/null; \
-       find /opt/venv -type f -name "*.pyo" -delete 2>/dev/null; \
-       find /opt/venv -type d -name "tests" -exec rm -rf {} + 2>/dev/null; \
-       find /opt/venv -type d -name "test" -exec rm -rf {} + 2>/dev/null; true
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /bin/uv
+
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project \
+    && find .venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null; \
+       find .venv -type f -name "*.pyc" -delete 2>/dev/null; \
+       find .venv -type f -name "*.pyo" -delete 2>/dev/null; \
+       find .venv -type d -name "tests" -exec rm -rf {} + 2>/dev/null; \
+       find .venv -type d -name "test" -exec rm -rf {} + 2>/dev/null; true
 
 # -- Runtime stage --
 FROM python:3.14-alpine
@@ -27,17 +26,17 @@ LABEL org.opencontainers.image.licenses="GPL-3.0"
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
-    PATH="/opt/venv/bin:$PATH"
+    PATH="/app/.venv/bin:$PATH"
 
 RUN apk add --no-cache su-exec
 
-COPY --from=builder /opt/venv /opt/venv
-
 RUN adduser -D -u 1000 cashpilot \
     && mkdir -p /data && chown cashpilot:root /data
 
 WORKDIR /app
 
+COPY --from=builder /build/.venv ./.venv
+
 COPY --chown=cashpilot:root app/__init__.py ./app/
 COPY --chown=cashpilot:root app/constants.py ./app/
 COPY --chown=cashpilot:root app/fleet_key.py ./app/

pyproject.toml

@@ -17,6 +17,23 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
     "Topic :: System :: Systems Administration",
 ]
+dependencies = [
+    "fastapi>=0.136.1",
+    "uvicorn>=0.47.0",
+    "uvloop>=0.22.1",
+    "httptools>=0.6",
+    "jinja2>=3.1.6",
+    "pyyaml>=6.0.3",
+    "aiosqlite>=0.22.1",
+    "httpx>=0.28.1",
+    "apscheduler>=3.11.2",
+    "python-multipart>=0.0.29",
+    "cryptography>=47.0.0",
+    "bcrypt>=5.0.0",
+    "itsdangerous>=2.2",
+    "prometheus_client>=0.22.0",
+    "docker>=7.1.0",
+]
 
 [project.urls]
 Homepage = "https://github.com/GeiserX/CashPilot"

requirements-worker.txt

@@ -1,3 +1,6 @@
+# NOTE: pyproject.toml + uv.lock are now the primary source of truth for dependencies.
+# Docker builds use `uv sync --frozen` from the lockfile.
+# This file is kept for backward compatibility with local development.
 fastapi>=0.136.1
 uvicorn>=0.47.0
 uvloop>=0.22.1

requirements.txt

@@ -1,3 +1,6 @@
+# NOTE: pyproject.toml + uv.lock are now the primary source of truth for dependencies.
+# Docker builds use `uv sync --frozen` from the lockfile.
+# This file is kept for backward compatibility with local development.
 fastapi>=0.136.1
 uvicorn>=0.47.0
 uvloop>=0.22.1