refactor: switch to uv with lockfile, decouple PyPI and optimize Docker builds (#914)

kaya-david · web-flow · commit cd74c23c086c · 2026-01-20T16:09:03.000+01:00
Documentation * doc: update README.md * doc: update installation docs * doc: update CHANGELOG.md Build & Dependencies * build: replace pip with uv pip * build: add uv.lock * chore: cap major versions for production dependencies * fix: CVE-2025-69223 Docker * feat: adapt Dockerfile for uv-based installation * feat: optimize Docker build using uv caching * feat: simplify Dockerfile * refactor: small Dockerfile improvements * fix: remove LOGPREP_VERSION build argument CI / CD * feat: adapt CI/CD workflow files * feat: update actions/checkout to v6
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -22,8 +22,8 @@ class Component:
     @define(kw_only=True)
     class Config(BaseClass.Config):
         # Configuration parameters with validators
-    
-    @define(kw_only=True) 
+
+    @define(kw_only=True)
     class Metrics(BaseClass.Metrics):
         # Prometheus metrics with CounterMetric/HistogramMetric
 ```
@@ -52,13 +52,13 @@ Each processor has `processor.py` and `rule.py`:
 
 ### Setup
 ```bash
-pip install -e .[dev]  # Install with dev dependencies
+uv sync --frozen --extra dev  # Install with dev dependencies
 pre-commit install     # Enable hooks
 ```
 
 ### Testing
 ```bash
-pytest ./tests --cov=logprep --cov-report=xml -vvv
+uv run pytest ./tests --cov=logprep --cov-report=xml -vvv
 ```
 
 ### Hybrid Python/Rust
diff --git a/.github/workflows/check-examples.yml b/.github/workflows/check-examples.yml
@@ -10,7 +10,7 @@ jobs:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Set up Docker Compose
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -17,22 +17,23 @@ jobs:
       matrix:
         python-version: ["3.11"]
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - name: Install uv and set the Python version
+        uses: astral-sh/setup-uv@v7
         with:
-          python-version: ${{ matrix.python-version }}
-          cache: "pip"
-      - name: Install dependencies
+          enable-cache: true
+      - name: Install pandoc
         run: |
-          sudo apt-get update && sudo apt-get -y install pandoc
-          pip install --upgrade pip wheel
-          pip install .[doc]
-      - name: build docs
+          sudo apt-get update
+          sudo apt-get -y install pandoc
+      - name: Install uv and sync deps
+        run: |
+          uv sync --frozen --extra doc
+      - name: Build docs
         run: |
           cd doc
-          sphinx-apidoc -fT -o source/module_reference ../logprep
-          make clean html
+          uv run sphinx-apidoc -fT -o source/module_reference ../logprep
+          uv run make clean html
   documentation-preview:
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
@@ -13,43 +13,38 @@ jobs:
       matrix:
         python-version: ["3.11"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: azure/setup-helm@v4.2.0
         with:
           version: "latest"
         id: install
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Install uv and set the Python version
+        uses: astral-sh/setup-uv@v7
         with:
           python-version: ${{ matrix.python-version }}
-          cache: "pip"
+          enable-cache: true
       - name: Get changed python files
         id: changed-files
         uses: tj-actions/changed-files@v46
         with:
           files: |
             ${{ inputs.path }}
       - name: Install dependencies
-        run: |
-          pip install --upgrade pip wheel
-          pip install .[dev]
+        run: uv sync --frozen --extra dev
       - name: check black formatting
-        run: |
-          black --check --diff --config ./pyproject.toml .
+        run: uv run black --check --diff --config ./pyproject.toml .
       - name: lint helm charts
-        run: |
-          helm lint --strict ./charts/logprep
+        run: helm lint --strict ./charts/logprep
       - name: lint changed and added files
         if: steps.changed-files.outputs.all_changed_files
-        run: |
-          pylint ${{ steps.changed-files.outputs.all_changed_files }}
+        run: uv run pylint ${{ steps.changed-files.outputs.all_changed_files }}
       - name: mypy type checking
         if: steps.changed-files.outputs.all_changed_files
-        run: mypy ${{ steps.changed-files.outputs.all_changed_files }}
+        run: uv run mypy --follow-imports=skip ${{ steps.changed-files.outputs.all_changed_files }}
       - name: Run tests and collect coverage
-        run: pytest tests/unit --cov=logprep --cov-report=xml
+        run: uv run pytest tests/unit --cov=logprep --cov-report=xml
       - name: Upload coverage reports to Codecov with GitHub Action
         uses: codecov/codecov-action@v5
         with:
diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
@@ -18,7 +18,7 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Set up SSH
@@ -75,7 +75,6 @@ jobs:
           context: .
           push: true
           build-args: |
-            LOGPREP_VERSION=${{ inputs.build-version }}
             PYTHON_VERSION=${{ matrix.python-version }}
           tags: ${{ steps.image-tag.outputs.tags }}
           platforms: "linux/arm64,linux/amd64"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           ref: main
diff --git a/.github/workflows/publish-latest-dev-release-to-github.yml b/.github/workflows/publish-latest-dev-release-to-github.yml
@@ -9,7 +9,7 @@ jobs:
     name: create and publish
     if: github.event.pull_request.merged == true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Initialize Python
         uses: actions/setup-python@v1
         with:
diff --git a/.github/workflows/publish-release-to-pypi.yml b/.github/workflows/publish-release-to-pypi.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build Logprep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Initialize Python
         uses: actions/setup-python@v1
         with:
diff --git a/.github/workflows/push-mirror.yml b/.github/workflows/push-mirror.yml
@@ -1,18 +1,14 @@
 name: Push mirror
-
 on:
   push:
-    branches: [ '**' ]
-
+    branches: ['**']
 jobs:
   push:
     runs-on: ubuntu-latest
-
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-
       - name: mirror-repository
         uses: ppcad/mirror-action@v0.4.5
         with:
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
@@ -5,7 +5,7 @@ jobs:
   rust:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Perform tests for rust modules
         run: cargo test
   python:
@@ -16,23 +16,19 @@ jobs:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
         test-type: ["unit", "acceptance"]
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - name: Install uv and set the Python version
+        uses: astral-sh/setup-uv@v7
         with:
           python-version: ${{ matrix.python-version }}
-          cache: "pip"
       - name: Install helm
         uses: azure/setup-helm@v4.2.0
         with:
           version: "latest"
         id: install
       - name: Install dependencies
-        run: |
-          pip install --upgrade pip wheel
-          pip install .[dev]
+        run: uv sync --frozen --extra dev
       - name: Perform ${{ matrix.test-type }} test
         env:
           PYTEST_ADDOPTS: "--color=yes"
-        run: |
-          pytest -vv tests/${{ matrix.test-type }}
+        run: uv run pytest -vv tests/${{ matrix.test-type }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,10 @@
 ### Breaking
 
 ### Features
+* add uv as dependency management, including uv.lock
 
 ### Improvements
+* simplify Dockerfile and remove docker build support for `LOGPREP_VERSION`
 
 ### Bugfix
 
diff --git a/Dockerfile b/Dockerfile
@@ -1,43 +1,53 @@
+# syntax=docker/dockerfile:1.7
+
 ARG PYTHON_VERSION=3.11
 
-FROM registry-1.docker.io/library/python:${PYTHON_VERSION} AS base
-ARG LOGPREP_VERSION=latest
+FROM registry-1.docker.io/library/python:${PYTHON_VERSION} AS build
 
-# remove setuptools as installed by the python image
-# setuptools is not needed at runtime and is vulnerable by CVE-2024-6345
-RUN pip3 uninstall \
-    --disable-pip-version-check \
-    --no-cache-dir \
-    --yes \
-    'setuptools' \
-    'wheel'
+RUN apt-get update && \
+    rm -rf /var/lib/apt/lists/*
 
-FROM base AS prebuild
+RUN python -m venv --upgrade-deps /opt/venv
 
 # Install the Rust toolchain
 RUN curl https://sh.rustup.rs -sSf | bash -s -- -y
-FROM prebuild AS build
-ADD . /logprep
+ENV PATH="/opt/venv/bin:/root/.cargo/bin:${PATH}"
+
+# Install uv into the venv
+RUN pip install --disable-pip-version-check --no-cache-dir uv
+
+# [jaraco.context <6.1.0] CVE: GHSA-58pv-8j8x-9vj2
+#     The setuptools build backend includes jaraco.context as vendored code.
+RUN pip uninstall -y setuptools
+
 WORKDIR /logprep
 
-# Use a python virtual environment
-RUN python -m venv --upgrade-deps /opt/venv
-ENV PATH="/opt/venv/bin:/root/.cargo/bin:${PATH}"
+ENV UV_COMPILE_BYTECODE=1
 
+# Omit development dependencies
+ENV UV_NO_DEV=1
 
-RUN if [ "$LOGPREP_VERSION" = "dev" ]; then pip install --disable-pip-version-check . ;\
-    elif [ "$LOGPREP_VERSION" = "latest" ]; then pip install --disable-pip-version-check git+https://github.com/fkie-cad/Logprep.git@latest ; \
-    else pip install --disable-pip-version-check "logprep==$LOGPREP_VERSION" ; fi; \
-    /opt/venv/bin/logprep --version
+# Copy from the cache instead of linking since it's a mounted volume
+ENV UV_LINK_MODE=copy
 
-# geoip2 4.8.0 lists a vulnerable setuptools version as a dependency. setuptools is unneeded at runtime, so it is uninstalled.
-# More recent (currently unreleased) versions of geoip2 removed setuptools from dependencies.
-RUN pip uninstall -y setuptools
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
 
+# Install deps using only the lockfile + pyproject.toml first (best layer caching)
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=/logprep/uv.lock,readonly \
+    --mount=type=bind,source=pyproject.toml,target=/logprep/pyproject.toml,readonly \
+    uv sync --no-install-project --no-editable --frozen
+
+# Then copy the rest of the project
+COPY . /logprep/
+
+# Use pyproject.toml to install logprep, non-editable \
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --no-editable --frozen && \
+    logprep --version
 
 FROM registry-1.docker.io/library/python:${PYTHON_VERSION}-slim AS prod
-ARG http_proxy
-ARG https_proxy
+
 # remove setuptools as installed by the python image
 # setuptools is not needed at runtime and is vulnerable by CVE-2024-6345
 RUN pip3 uninstall \
@@ -46,12 +56,15 @@ RUN pip3 uninstall \
     --yes \
     'setuptools' \
     'wheel'
+
 RUN apt-get update && apt-get -y upgrade && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /opt/venv /opt/venv
 RUN useradd -s /bin/sh -m -c "logprep user" logprep
 USER logprep
+
 # Make sure we use the virtualenv:
 ENV PATH="/opt/venv/bin:${PATH}"
 WORKDIR /home/logprep
diff --git a/Makefile b/Makefile
@@ -1,7 +1,7 @@
 # Install all packages
 install-packages:
-	pip install -e .[dev]
+    uv sync --frozen --extra dev
 
 # Test all pytests
 test:
-	pytest ./tests --cov=logprep --cov-report=xml -vvv
+	uv run pytest ./tests --cov=logprep --cov-report=xml -vvv
diff --git a/README.md b/README.md
@@ -187,7 +187,7 @@ be built locally via:
 
 ```
 sudo apt install pandoc
-pip install -e .[doc]
+uv sync --frozen --extra doc
 cd ./doc/
 make html
 ```
diff --git a/doc/README.md b/doc/README.md
@@ -1,4 +1,4 @@
 ## needed setup to generate documentation
 
 * install pandoc with `apt-get install pandoc`
-* install requirements with `pip install .[doc]` in project root
+* install requirements with `uv sync --frozen --extra doc` in project root
diff --git a/doc/source/examples/minikube.rst b/doc/source/examples/minikube.rst
@@ -181,7 +181,7 @@ Then build the logprep image with the following command:
 .. code-block:: bash
     :caption: Build this image using the Dockerfile in the root of the repository
 
-    docker buildx build -t local/logprep:latest --build-arg PYTHON_VERSION=3.11 --build-arg LOGPREP_VERSION=dev .
+    docker buildx build -t local/logprep:latest --build-arg PYTHON_VERSION=3.11  .
 
 Then install the opensiem example using the local logprep image:
 
diff --git a/doc/source/installation.rst b/doc/source/installation.rst
diff --git a/examples/compose/docker-compose.yml b/examples/compose/docker-compose.yml
diff --git a/examples/k8s/values-dev.yaml b/examples/k8s/values-dev.yaml
diff --git a/pyproject.toml b/pyproject.toml
diff --git a/uv.lock b/uv.lock
