fix: use rabe base image and wheel multistage build (#118)

.github/workflows/release.yaml

@@ -3,8 +3,10 @@ name: Build Container Image
 on:
   push:
     branches:
-      - master
       - main
+    tags:
+      - 'v*.*.*'
+  pull_request:
 
 jobs:
   build:
@@ -38,6 +40,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v2
+        if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

Dockerfile

@@ -1,8 +1,20 @@
-FROM python:3-alpine@sha256:2a068b9442f61f4480306d44e3b166bfe3343761e9bd57c38f66302ebf28fd9e
+FROM ghcr.io/radiorabe/s2i-python:0.5.1 AS build
 
-WORKDIR /src
-COPY requirements.txt /src/
-RUN ["pip","install","--no-cache-dir","-r","/src/requirements.txt"]
-COPY . /src/
+COPY ./ $HOME
 
-ENTRYPOINT ["python","-m","suisa_sendemeldung.suisa_sendemeldung"]
+RUN python3 setup.py bdist_wheel
+
+
+FROM ghcr.io/radiorabe/python-minimal:0.5.1 AS app
+
+COPY --from=build /opt/app-root/src/dist/*.whl /tmp/dist/
+
+RUN    python3 -mpip --no-cache-dir install /tmp/dist/*.whl \
+    && rm -rf /tmp/dist/
+
+# make requests use os ca certs that contain the RaBe root CA
+ENV REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
+
+USER nobody
+
+ENTRYPOINT ["suisa_sendemeldung"]