autumn-cli 0.10.0

CLI tool for the Autumn web framework
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

FROM rust:{{rust_version}}-bookworm AS builder

WORKDIR /app

ARG TAILWIND_VERSION=v4.1.4

# Tailwind CSS standalone CLI, checksum-verified. Two things matter here:
#
#   * The architecture is detected, not assumed — an arm64 build that pulled
#     `linux-x64` would install a binary it cannot execute.
#   * The binary is verified against the `sha256sums.txt` published with that
#     Tailwind release, and the build FAILS on a mismatch. An unverified
#     executable download into a build image is exactly the hole issue #1615
#     closes; `autumn setup` does the same verification for the dev loop.
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p target/autumn \
    && arch="$(uname -m)" \
    && case "$arch" in \
         x86_64) asset="tailwindcss-linux-x64" ;; \
         aarch64) asset="tailwindcss-linux-arm64" ;; \
         *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
       esac \
    && base="https://github.com/tailwindlabs/tailwindcss/releases/download/${TAILWIND_VERSION}" \
    && curl -fsSL -o "target/autumn/$asset" "$base/$asset" \
    && curl -fsSL -o target/autumn/sha256sums.txt "$base/sha256sums.txt" \
    && (cd target/autumn \
        && grep -E "[[:space:]][.]?/?${asset}\$" sha256sums.txt \
             | sed "s|[.]/||" > expected.sha256 \
        && test -s expected.sha256 \
        && sha256sum -c expected.sha256) \
    && mv "target/autumn/$asset" target/autumn/tailwindcss \
    && rm -f target/autumn/sha256sums.txt target/autumn/expected.sha256 \
    && chmod +x target/autumn/tailwindcss

COPY Cargo.toml autumn.toml build.rs tailwind.config.js ./
COPY src ./src
COPY static ./static
COPY migrations ./migrations
# __AUTUMN_I18N_BUILDER_COPY__

# Git/build provenance passthrough. The build context excludes `/.git` (see
# .dockerignore), so the generated build.rs cannot shell out to git here.
# Supply provenance explicitly and surface it as ENV, which build.rs prefers
# over git and bakes into the binary for `/actuator/info`. Populate from CI, e.g:
#   docker build \
#     --build-arg AUTUMN_BUILD_GIT_SHA=$(git rev-parse HEAD) \
#     --build-arg AUTUMN_BUILD_GIT_SHA_SHORT=$(git rev-parse --short HEAD) \
#     --build-arg AUTUMN_BUILD_GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD) \
#     --build-arg AUTUMN_BUILD_GIT_DIRTY=false \
#     --build-arg AUTUMN_BUILD_TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ) .
# Unset args stay empty and are ignored, so `/actuator/info` reports `null`.
ARG AUTUMN_BUILD_GIT_SHA=
ARG AUTUMN_BUILD_GIT_SHA_SHORT=
ARG AUTUMN_BUILD_GIT_BRANCH=
ARG AUTUMN_BUILD_GIT_DIRTY=
ARG AUTUMN_BUILD_TIMESTAMP=
ENV AUTUMN_BUILD_GIT_SHA=${AUTUMN_BUILD_GIT_SHA} \
    AUTUMN_BUILD_GIT_SHA_SHORT=${AUTUMN_BUILD_GIT_SHA_SHORT} \
    AUTUMN_BUILD_GIT_BRANCH=${AUTUMN_BUILD_GIT_BRANCH} \
    AUTUMN_BUILD_GIT_DIRTY=${AUTUMN_BUILD_GIT_DIRTY} \
    AUTUMN_BUILD_TIMESTAMP=${AUTUMN_BUILD_TIMESTAMP}

RUN cargo build --release

FROM debian:bookworm-slim AS runtime

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --create-home --uid 10001 autumn

WORKDIR /app

COPY --from=builder /app/target/release/{{project_name}} /usr/local/bin/{{project_name}}
COPY --from=builder /app/autumn.toml /app/autumn.toml
COPY --from=builder /app/static /app/static
COPY --from=builder /app/migrations /app/migrations
# __AUTUMN_I18N_RUNTIME_COPY__

ENV AUTUMN_PROFILE=prod
EXPOSE 3000

USER autumn

CMD ["{{project_name}}"]