Updating files to change python to 3.11

.dockerignore

@@ -26,8 +26,6 @@
 
 # CI and test configuration, not needed at runtime.
 **/Jenkinsfile
-**/pytest.ini
-**/tests/
 
 # Documentation and planning, not needed at runtime.
 **/*.md

Dockerfile

@@ -1,6 +1,5 @@
-FROM python:3.11-slim
+FROM python:3.11-slim AS runtime
 
-# Fail fast and log straight to stdout, so `docker-compose logs` is useful.
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1
 
@@ -11,16 +10,14 @@ WORKDIR /app
 COPY expenses_manager/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-# Copy the Django project itself, not the repository root, so that /app is
+# Copy the Django project itself, not the repository root, so /app is the
-# the directory holding manage.py. The previous version copied the repo root
+# directory holding manage.py.
-# into /app/expenses_manager, which left manage.py and wsgi.py one level
-# deeper than the gunicorn command expected.
 COPY expenses_manager/ .
 
 # Collect static files at build time so the running container never needs to
 # write to its own filesystem. SECRET_KEY is required by settings.py when
-# DEBUG is False, but collectstatic never uses it, so a throwaway value is
+# DEBUG is False but collectstatic never uses it, so a throwaway value is
-# enough — the real one comes from the environment at runtime.
+# enough — the real one comes from the environment at runtime.
 RUN SECRET_KEY=build-time-placeholder \
     DEBUG=False \
     ALLOWED_HOSTS=localhost \
@@ -29,3 +26,11 @@ RUN SECRET_KEY=build-time-placeholder \
 EXPOSE 8000
 
 CMD ["gunicorn", "expenses_manager.wsgi:application", "--bind", "0.0.0.0:8000"]
+
+
+# The production image plus the test-only dependencies. Tests then run on
+# exactly the Python version and packages production uses; the virtualenv this
+# replaces ran on Python 3.14 while production runs 3.11.
+FROM runtime AS test
+
+RUN pip install --no-cache-dir -r requirements-dev.txt

expenses_manager/Jenkinsfile

@@ -38,74 +38,89 @@ pipeline {
             options { timeout(time: 30, unit: 'MINUTES') }
             stages {
 
-                stage('Setup Python') {
+                stage('Build images') {
-                    steps {
-                        sh '''
-                            cd expenses_manager
-                            python --version
-                            python -m venv venv
-                            venv/bin/pip install --upgrade pip
-                            venv/bin/pip install -r requirements.txt
-                        '''
-                    }
-                }
-
-                // Catches models changed without generating the migration.
-                stage('Check migrations') {
-                    steps {
-                        sh '''
-                            cd expenses_manager
-                            venv/bin/python manage.py makemigrations --check --dry-run
-                        '''
-                    }
-                }
-
-                stage('Run tests') {
-                    steps {
-                        sh '''
-                            cd expenses_manager
-                            venv/bin/pytest --cov --junitxml=junit.xml
-                        '''
-                    }
-                    post {
-                        always {
-                            // allowEmptyResults: false is deliberate. A build where
-                            // pytest died before collecting anything produces no XML,
-                            // and that must fail rather than pass quietly.
-                            junit allowEmptyResults: false,
-                                testResults: 'expenses_manager/junit.xml'
-                        }
-                    }
-                }
-
-                stage('Build image') {
                     steps {
                         sshagent(credentials: ['nas-ssh']) {
                             sh '''
                                 SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
                                 TAG=$(echo "${BRANCH_NAME}" | tr '/' '-')
 
-                                # Ship the workspace that was just tested rather than
+                                # Ship the workspace rather than cloning again on the
-                                # cloning again: what gets built is then provably the
+                                # NAS: what gets built is then provably the same code
-                                # same code the tests ran against.
+                                # this build checked out.
                                 ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
                                     "rm -rf ${CI_DIR} && mkdir -p ${CI_DIR}"
 
-                                tar -czf - --exclude=./expenses_manager/venv \
+                                tar -czf - --exclude=./.git . \
-                                        --exclude=./.git . \
                                     | ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
                                         "tar -xzf - -C ${CI_DIR}"
 
+                                # The test image is the runtime image plus test
+                                # dependencies, so the second build reuses every layer
+                                # of the first.
                                 ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
                                     "cd ${CI_DIR} && sudo ${NAS_DOCKER} build \
+                                        --target runtime \
                                         -t ${IMAGE}:${SHA} -t ${IMAGE}:${TAG} ."
+
+                                ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
+                                    "cd ${CI_DIR} && sudo ${NAS_DOCKER} build \
+                                        --target test \
+                                        -t ${IMAGE}-test:${SHA} ."
                             '''
                         }
                     }
                 }
 
-                // A successful build only proves the Dockerfile is syntactically
+                // Catches models changed without generating the migration.
-                // sound. Django's own checks prove the image can actually start.
+                stage('Check migrations') {
+                    steps {
+                        sshagent(credentials: ['nas-ssh']) {
+                            sh '''
+                                SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
+                                ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
+                                    "sudo ${NAS_DOCKER} run --rm \
+                                        -e SECRET_KEY=ci-only-value \
+                                        -e DEBUG=True \
+                                        -e DB_ENGINE=sqlite3 \
+                                        ${IMAGE}-test:${SHA} \
+                                        python manage.py makemigrations --check --dry-run"
+                            '''
+                        }
+                    }
+                }
+
+                stage('Run tests') {
+                    steps {
+                        sshagent(credentials: ['nas-ssh']) {
+                            // pytest output goes to stderr so it shows up in this log,
+                            // while stdout carries only the JUnit XML. That avoids
+                            // copying a root-owned file back from the NAS, which
+                            // jenkins-ci could not read.
+                            sh '''
+                                SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
+                                ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
+                                    "sudo ${NAS_DOCKER} run --rm \
+                                        -e SECRET_KEY=ci-only-value \
+                                        -e DEBUG=True \
+                                        -e DB_ENGINE=sqlite3 \
+                                        ${IMAGE}-test:${SHA} \
+                                        sh -c 'pytest --cov --junitxml=/tmp/junit.xml >&2; \
+                                            rc=\\$?; cat /tmp/junit.xml; exit \\$rc'" \
+                                    > junit.xml
+                            '''
+                        }
+                    }
+                    post {
+                        always {
+                            // allowEmptyResults: false is deliberate. A build where
+                            // pytest died before collecting anything produces no XML,
+                            // and that must fail rather than pass quietly.
+                            junit allowEmptyResults: false, testResults: 'junit.xml'
+                        }
+                    }
+                }
+
                 stage('Smoke test image') {
                     steps {
                         sshagent(credentials: ['nas-ssh']) {
@@ -121,10 +136,10 @@ pipeline {
                             '''
 
                             // A migrations directory without __init__.py is a namespace
-                        // package, and Django deliberately ignores those: the app then
+                            // package, and Django deliberately ignores those: the app
-                        // appears to have no migrations at all, migrate --check always
+                            // then appears to have no migrations at all, migrate --check
-                        // reports nothing pending, and a real migration would silently
+                            // always reports nothing pending, and a real migration would
-                        // never be applied. This is what .gitignore line 6 caused.
+                            // silently never be applied.
                             sh '''
                                 SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
                                 ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \

expenses_manager/requirements-dev.txt

@@ -0,0 +1,11 @@
+-r requirements.txt
+
+colorama==0.4.6
+coverage==7.13.1
+iniconfig==2.3.0
+pluggy==1.6.0
+Pygments==2.19.2
+pytest==9.0.2
+pytest-cov>=4.0
+pytest-django==4.11.1
+toml==0.10.2