Maintainability upgrades and fixes

.dockerignore

@@ -1 +1,9 @@
 node_modules/
+.github/
+.mypy_cache/
+.pytest_cache/
+__pycache__/
+*.pyc
+.venv/
+.scannerwork/
+.ruff_cache/

.github/workflows/format-app.yml

@@ -0,0 +1,33 @@
+name: Format App
+
+on:
+    push:
+        branches: [master, develop]
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.9'
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff format
+        run: ruff format packet
+
+      - name: Commit and push changes
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git add .
+          git diff --cached --quiet || git commit -m "Auto-format code with ruff"
+          git push

.github/workflows/python-app.yml

@@ -27,11 +27,11 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-      - name: Lint with pylint
+          python -m pip install uv
+          if [ -f requirements.txt ]; then uv pip install -r requirements.txt --system; fi
+      - name: Lint with ruff
         run: |
-          pylint packet/routes packet
+          ruff check packet
 
   typecheck:
     runs-on: ubuntu-latest
@@ -50,8 +50,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install uv
+          if [ -f requirements.txt ]; then uv pip install -r requirements.txt --system; fi
       - name: Typecheck with mypy
         run: |
           # Disabled error codes to discard errors from imports

.gitignore

@@ -105,6 +105,10 @@ ENV/
 
 # vscode
 .vscode
+.devcontainer
+
+# SonarQube
+.scannerwork
 
 # Configurations
 config.py
@@ -132,4 +136,4 @@ packet/static/site.webmanifest
 faviconData.json
 
 # csvs
-*.csv
+*.csv

Dockerfile

@@ -14,7 +14,7 @@ RUN mkdir /opt/packet
 WORKDIR /opt/packet
 
 COPY requirements.txt /opt/packet/
-RUN pip install -r requirements.txt
+RUN pip install uv && uv pip install -r requirements.txt --system
 
 COPY package.json /opt/packet/
 COPY yarn.lock /opt/packet/
@@ -32,4 +32,9 @@ RUN gulp production && \
 # Set version for apm
 RUN echo "export DD_VERSION=\"$(python3 packet/git.py)\"" >> /tmp/version
 
+RUN groupadd -r packet && useradd --no-log-init -r -g packet packet && \
+    chown -R packet:packet /opt/packet
+
+USER packet
+
 CMD ["/bin/bash", "-c", "source /tmp/version && ddtrace-run gunicorn packet:app --bind=0.0.0.0:8080 --access-logfile=- --timeout=600"]

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM docker.io/python:3.9-slim-trixie
+FROM ghcr.io/astral-sh/uv:python3.9-bookworm-slim
 
 RUN ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
 RUN apt-get -yq update && \
@@ -14,7 +14,7 @@ RUN mkdir /opt/packet
 WORKDIR /opt/packet
 
 COPY requirements.txt /opt/packet/
-RUN pip install -r requirements.txt
+RUN uv pip install -r requirements.txt --system
 
 COPY package.json /opt/packet/
 COPY yarn.lock /opt/packet/
@@ -29,6 +29,11 @@ RUN gulp production && \
     apt-get -yq autoremove && \
     apt-get -yq clean all
 
+RUN groupadd -r packet && useradd --no-log-init -r -g packet packet && \
+    chown -R packet:packet /opt/packet
+
+USER packet
+
 EXPOSE 8000
 
 CMD ["/bin/bash", "-c", "python3 wsgi.py"]

README.md

@@ -133,12 +133,12 @@ All DB commands are from the `Flask-Migrate` library and are used to configure D
 docs [here](https://flask-migrate.readthedocs.io/en/latest/) for details. 
 
 ## Code standards
-This project is configured to use Pylint and mypy. Commits will be pylinted and typechecked by GitHub actions and if the
+This project is configured to use ruff and mypy. Commits will be ruffed and typechecked by GitHub actions and if the
 score drops your build will fail blocking you from merging. To make your life easier just run it before making a PR.
 
-To run pylint and mypy use these commands:
+To run ruff and mypy use these commands:
 ```bash
-pylint packet/routes packet
+ruff check packet
 mypy --disable-error-code import --disable-error-code name-defined --disallow-untyped-defs --exclude routes packet
 ```
 

config.env.py

@@ -2,6 +2,7 @@
 Default configuration settings and environment variable based configuration logic
     See the readme for more information
 """
+
 from distutils.util import strtobool
 from os import environ, path, getcwd
 

gulpfile.js/index.js

@@ -20,4 +20,4 @@ requireDir('./tasks', {recurse: true});
 // Default task
 gulp.task('default', gulp.parallel('css', 'js'));
 gulp.task('production', gulp.parallel('css', 'js', 'generate-favicon'));
-gulp.task('lint', gulp.parallel('pylint'));
+gulp.task('lint', gulp.parallel('ruff'));

gulpfile.js/tasks/pylint.js → gulpfile.js/tasks/ruff.js

@@ -1,12 +1,12 @@
 const gulp = require('gulp');
 const exec = require('child_process').exec;
 
-let pylintTask = (cb) => {
-    exec('pylint --load-plugins pylint_quotes packet/routes packet', function (err, stdout, stderr) {
+let ruffTask = (cb) => {
+    exec('ruff check packet', function (err, stdout, stderr) {
         console.log(stdout);
         console.log(stderr);
         cb(err);
     });
 };
 
-gulp.task('pylint', pylintTask);
+gulp.task('ruff', ruffTask);