Merge 7a5181ef48 into e77fe115c6

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -13,6 +13,10 @@ on:
       - "**/CHANGELOG.md"
       - "**/docs/**"
   workflow_dispatch:
+  pull_request:
+    branches:
+      - dev
+      - master
 
 env:
   REGISTRY: ghcr.io

Dockerfile

@@ -1,9 +1,15 @@
 FROM python:3.12-slim
-ARG VERSION=unkown
+ARG VERSION=unknown
+
+# Create a non-root user and group
+RUN groupadd -r appuser && useradd -r -g appuser appuser
 
 WORKDIR /app
 COPY . .
 
+# Change ownership of the application directory
+RUN chown -R appuser:appuser /app
+
 # Python setup
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
@@ -12,13 +18,19 @@ ENV ENV=DEV
 
 # Install dependencies
 RUN pip install --no-cache-dir --upgrade -r requirements.txt
-RUN pip install 'uvicorn[standard]'
+
+# Switch to the non-root user
+USER appuser
 
 EXPOSE 9000
 CMD ["uvicorn", "app.main:app", "--workers", "6" , "--host", "0.0.0.0", "--port", "9000"]
 
 # Install curl
-RUN apt-get update && apt-get install -y curl && apt-get clean
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends curl && apt-get clean
+
+# Switch back to the non-root user
+USER appuser
 
 HEALTHCHECK --interval=30s --timeout=10s --retries=5 \
   CMD curl --fail http://localhost:9000/openapi.json || exit 1

renovate.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(feat)"
+  ]
+}

requirements.txt

@@ -1,8 +1,8 @@
 annotated-types==0.7.0
-anyio==4.6.0
+anyio==4.6.2.post1
 certifi==2024.8.30
 creyPY==1.2.5
-fastapi==0.115.0
+fastapi==0.115.5
 fastapi-pagination==0.12.31
 h11==0.14.0
 httpcore==1.0.6
@@ -10,13 +10,13 @@ httpx==0.27.2
 idna==3.10
 psycopg==3.2.3
 psycopg-binary==3.2.3
-psycopg-pool==3.2.3
+psycopg-pool==3.2.4
 pydantic==2.9.2
 pydantic_core==2.23.4
 python-dotenv==1.0.1
 sniffio==1.3.1
 SQLAlchemy==2.0.35
-starlette==0.38.6
+starlette==0.40.0
 typing_extensions==4.12.2
 
 Mako==1.3.5 # Alembic