Merge branch 'main' into dm/doc-services

.github/workflows/ci.yml

@@ -69,6 +69,10 @@ jobs:
           POSTGRES_INITDB_ARGS: '--no-sync --set fsync=off --set full_page_writes=off'
         # Set health checks to wait until postgres has started
         options: --health-cmd "pg_isready --username=postgres --dbname=postgres" --health-interval 10s --health-timeout 5s --health-retries 5
+      redis:
+        image: ${{ (matrix.name == 'Tests') && 'redis:7.0' || '' }}
+        ports:
+          - 6379:6379
       stripe:
         image: ${{ (matrix.name == 'Tests') && 'stripe/stripe-mock:v0.162.0' || '' }}
         ports:

.python-version

@@ -1 +1 @@
-3.12.4
+3.12.6

.readthedocs.yml

@@ -8,6 +8,6 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.11"
+    python: "3.12"
   commands:
     - ./bin/rtd-docs

Dockerfile

@@ -1,6 +1,6 @@
 # First things first, we build an image which is where we're going to compile
 # our static assets with. We use this stage in development.
-FROM node:22.7.0-bookworm AS static-deps
+FROM node:22.8.0-bookworm AS static-deps
 
 WORKDIR /opt/warehouse/src/
 
@@ -36,7 +36,7 @@ RUN NODE_ENV=production npm run build
 
 
 # We'll build a light-weight layer along the way with just docs stuff
-FROM python:3.12.4-slim-bookworm AS docs
+FROM python:3.12.6-slim-bookworm AS docs
 
 # By default, Docker has special steps to avoid keeping APT caches in the layers, which
 # is good, but in our case, we're going to mount a special cache volume (kept between
@@ -105,7 +105,7 @@ USER docs
 
 # Now we're going to build our actual application, but not the actual production
 # image that it gets deployed into.
-FROM python:3.12.4-slim-bookworm AS build
+FROM python:3.12.6-slim-bookworm AS build
 
 # Define whether we're building a production or a development image. This will
 # generally be used to control whether or not we install our development and
@@ -189,7 +189,7 @@ RUN --mount=type=cache,target=/root/.cache/pip \
 
 # Now we're going to build our actual application image, which will eventually
 # pull in the static files that were built above.
-FROM python:3.12.4-slim-bookworm
+FROM python:3.12.6-slim-bookworm
 
 # Setup some basic environment variables that are ~never going to change.
 ENV PYTHONUNBUFFERED 1

Makefile

@@ -20,6 +20,14 @@ ifneq ($(T),)
 		endif
 endif
 
+# PEP 669 introduced sys.monitoring, a lighter-weight way to monitor
+# the execution. While this introduces significant speed-up during test
+# execution, coverage does not yet support dynamic contexts when enabled.
+# This variable can be set to other tracers (ctrace, pytrace) to fall
+# back use them.
+# https://nedbatchelder.com/blog/202312/coveragepy_with_sysmonitoring.html
+COVERAGE_CORE ?= sysmon
+
 default:
 	@echo "Call a specific subcommand:"
 	@echo
@@ -76,7 +84,7 @@ debug: .state/docker-build-base
 	docker compose run --rm --service-ports web
 
 tests: .state/docker-build-base
-	docker compose run --rm --env COVERAGE=$(COVERAGE) tests bin/tests --postgresql-host db $(T) $(TESTARGS)
+	docker compose run --rm --env COVERAGE=$(COVERAGE) --env COVERAGE_CORE=$(COVERAGE_CORE) tests bin/tests --postgresql-host db $(T) $(TESTARGS)
 
 static_tests: .state/docker-build-static
 	docker compose run --rm static bin/static_tests $(T) $(TESTARGS)

Procfile

@@ -1,5 +1,6 @@
 release: bin/release
 web: bin/start-web ddtrace-run python -m gunicorn.app.wsgiapp -c gunicorn-prod.conf.py warehouse.wsgi:application
+web-api: bin/start-web ddtrace-run python -m gunicorn.app.wsgiapp -c gunicorn-prod.conf.py warehouse.wsgi:application
 web-uploads: bin/start-web ddtrace-run python -m gunicorn.app.wsgiapp -c gunicorn-uploads.conf.py warehouse.wsgi:application
 worker: bin/start-worker celery -A warehouse worker -Q default -l info --max-tasks-per-child 32
 worker-beat: bin/start-worker celery -A warehouse beat -S redbeat.RedBeatScheduler -l info

bin/tests

@@ -7,6 +7,10 @@ set -e
 export LC_ALL="${ENCODING:-en_US.UTF-8}"
 export LANG="${ENCODING:-en_US.UTF-8}"
 export COVERAGE_PROCESS_START="$(pwd)/pyproject.toml"
+# PEP 669 introduced sys.monitoring, a lighter-weight way to monitor
+# the execution. Tell coverage to use this
+# https://nedbatchelder.com/blog/202312/coveragepy_with_sysmonitoring.html
+export COVERAGE_CORE="${COVERAGE_CORE:-sysmon}"
 COMMAND_ARGS=( "$@" )
 
 # Test the postgres connection

dev/environment

@@ -13,7 +13,7 @@ DATABASE_URL=postgresql+psycopg://postgres@db/warehouse
 
 OPENSEARCH_URL=http://opensearch:9200/development
 
-REDIS_URL=redis://redis:6379/0
+REDIS_URL=redis://redis:6379
 
 SESSION_SECRET="an insecure development secret"
 
@@ -46,6 +46,7 @@ BREACHED_EMAILS=warehouse.accounts.NullEmailBreachedService
 BREACHED_PASSWORDS=warehouse.accounts.NullPasswordBreachedService
 
 OIDC_BACKEND=warehouse.oidc.services.NullOIDCPublisherService
+INTEGRITY_BACKEND=warehouse.attestations.services.NullIntegrityService
 
 METRICS_BACKEND=warehouse.metrics.DataDogMetrics host=notdatadog
 

docker-compose.yml

@@ -137,6 +137,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+      redis:
+        condition: service_started
       stripe:
         condition: service_started