build(runtime): harden embedding image policy

This commit is contained in:
Doster-d 2026-07-20 23:38:56 +03:00
parent e8d96e116e
commit ca2f6a673a
2 changed files with 3 additions and 1 deletions

View file

@ -11,7 +11,8 @@ RUN python -m venv /home/nonroot/venv \
&& /home/nonroot/venv/bin/pip install --no-cache-dir -r requirements.txt
FROM dependencies AS quality
ENV PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache
ENV VIRTUAL_ENV=/home/nonroot/venv \
PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache
COPY requirements-test.txt Dockerfile README.md server.py /home/nonroot/app/
COPY tests /home/nonroot/app/tests
RUN /home/nonroot/venv/bin/pip install --no-cache-dir -r requirements-test.txt \

View file

@ -64,6 +64,7 @@ def test_quality_evidence_is_reproducible_and_taxonomy_aware_TASK_8c19d6a7() ->
assert pinned_tools["ruff"] == "0.15.19"
assert pinned_tools["ty"] == "0.0.53"
assert "AS quality" in dockerfile
assert "VIRTUAL_ENV=/home/nonroot/venv" in dockerfile
assert "PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache" in dockerfile
assert "python -m pytest -p no:cacheprovider tests" in dockerfile
assert "ruff check server.py tests" in dockerfile