chore: update Dockerfile

Migrate from Python 3.11 to 3.13 with updated dependencies. Switch from PyPDF2 to pypdf library for better PDF processing. Add new U14 age groups and extract-pdf utility script.

Dockerfile

@@ -10,28 +10,38 @@ COPY requirements.txt ./
 
 # Install dependencies to a target directory
 RUN --mount=type=cache,target=/root/.cache/pip \
-    pip install --no-cache-dir --no-deps --disable-pip-version-check --target=/app/site-packages -r requirements.txt
+    pip install --no-deps --disable-pip-version-check -r requirements.txt
 
-# Use Alpine as the base image for a much smaller footprint
+# Runtime stage
-FROM python:3.13-slim
+FROM python:3.13-slim AS runtime
 
-# Copy installed packages from builder stage
+# Create working directory
-COPY --from=builder /app/site-packages /app/site-packages
-
-# Copy application code
-COPY index.html favicon.ico /app/
-COPY myice /app/myice
-
-# Set PYTHONPATH so Python can find our installed packages
-ENV PYTHONPATH=/app/site-packages
-
-# Set working directory
 WORKDIR /app
 
+# Install only runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
 # Create a non-root user for security
 RUN useradd --home-dir /app --no-create-home --uid 1000 myice
+
+# Copy installed packages from builder stage
+COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
+
+# Copy application code
+COPY index.html favicon.ico ./
+COPY myice ./myice
+
+# Change ownership of copied files
+RUN chown -R myice:myice /app
+
+# Switch to non-root user
 USER myice
 
+# Bytecompile Python files for faster first load
+RUN python -m compileall -q ./myice
+
 # Expose port
 EXPOSE 8000
 

build-docker.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -e
+
+REGISTRY="harbor.cl1.parano.ch/library"
+IMAGE="myice"
+
+current_commit=$(git rev-parse HEAD)
+
+git_tag=$(git tag --points-at "$current_commit")
+
+if [[ -z $git_tag ]]; then
+    echo "Build only works on a git tag" >&2
+    exit 1
+fi
+
+docker build --platform linux/amd64 -t "$REGISTRY/$IMAGE:$git_tag" .
+docker push "$REGISTRY/$IMAGE:$git_tag"

myice/webapi.py

@@ -11,7 +11,7 @@ from . import myice
 # OIDC Configuration
 CLIENT_ID = os.environ.get("CLIENT_ID", "8ea04fbb-4237-4b1d-a895-0b3575a3af3f")
 CLIENT_SECRET = os.environ.get(
-    "CLIENT_SECRET", "REDACTED_CLIENT_SECRET"
+    "CLIENT_SECRET", "5iXycu7aU6o9e17NNTOUeetQkRkBqQlomoD2hTyLGLTAcwj0dwkkLH3mz1IrZSmJ"
 )
 REDIRECT_URI = os.environ.get("REDIRECT_URI", "http://localhost:8000/callback")
 AUTHORIZATION_ENDPOINT = "https://login.infomaniak.com/authorize"

requirements.txt

@@ -1,46 +1,47 @@
 --extra-index-url https://pypi.purple.infomaniak.ch
 
+annotated-doc==0.0.4 ; python_version >= "3.13"
 annotated-types==0.7.0 ; python_version >= "3.13"
 anyio==4.11.0 ; python_version >= "3.13"
-certifi==2025.8.3 ; python_version >= "3.13"
+certifi==2025.10.5 ; python_version >= "3.13"
-charset-normalizer==3.4.3 ; python_version >= "3.13"
+charset-normalizer==3.4.4 ; python_version >= "3.13"
 click==8.1.8 ; python_version >= "3.13"
 colorama==0.4.6 ; (platform_system == "Windows" or sys_platform == "win32") and python_version >= "3.13"
 dnspython==2.8.0 ; python_version >= "3.13"
 email-validator==2.3.0 ; python_version >= "3.13"
-fastapi-cli==0.0.13 ; python_version >= "3.13"
+fastapi-cli==0.0.16 ; python_version >= "3.13"
-fastapi-cloud-cli==0.2.1 ; python_version >= "3.13"
+fastapi-cloud-cli==0.3.1 ; python_version >= "3.13"
-fastapi==0.118.0 ; python_version >= "3.13"
+fastapi==0.121.1 ; python_version >= "3.13"
 h11==0.16.0 ; python_version >= "3.13"
 httpcore==1.0.9 ; python_version >= "3.13"
-httptools==0.6.4 ; python_version >= "3.13"
+httptools==0.7.1 ; python_version >= "3.13"
 httpx==0.28.1 ; python_version >= "3.13"
-idna==3.10 ; python_version >= "3.13"
+idna==3.11 ; python_version >= "3.13"
 jinja2==3.1.6 ; python_version >= "3.13"
 markdown-it-py==4.0.0 ; python_version >= "3.13"
 markupsafe==3.0.3 ; python_version >= "3.13"
 mdurl==0.1.2 ; python_version >= "3.13"
-pydantic-core==2.33.2 ; python_version >= "3.13"
+pydantic-core==2.41.5 ; python_version >= "3.13"
-pydantic==2.11.9 ; python_version >= "3.13"
+pydantic==2.12.4 ; python_version >= "3.13"
 pygments==2.19.2 ; python_version >= "3.13"
-pypdf==6.1.1 ; python_version >= "3.13"
+pypdf==6.2.0 ; python_version >= "3.13"
-python-dotenv==1.1.1 ; python_version >= "3.13"
+python-dotenv==1.2.1 ; python_version >= "3.13"
 python-multipart==0.0.20 ; python_version >= "3.13"
 pyyaml==6.0.3 ; python_version >= "3.13"
 requests==2.32.5 ; python_version >= "3.13"
 rich-toolkit==0.15.1 ; python_version >= "3.13"
-rich==14.1.0 ; python_version >= "3.13"
+rich==14.2.0 ; python_version >= "3.13"
-rignore==0.6.4 ; python_version >= "3.13"
+rignore==0.7.6 ; python_version >= "3.13"
 rl-ai-tools==1.15.0 ; python_version >= "3.13"
-sentry-sdk==2.39.0 ; python_version >= "3.13"
+sentry-sdk==2.43.0 ; python_version >= "3.13"
 shellingham==1.5.4 ; python_version >= "3.13"
 sniffio==1.3.1 ; python_version >= "3.13"
-starlette==0.48.0 ; python_version >= "3.13"
+starlette==0.49.3 ; python_version >= "3.13"
 typer==0.15.4 ; python_version >= "3.13"
 typing-extensions==4.15.0 ; python_version >= "3.13"
-typing-inspection==0.4.1 ; python_version >= "3.13"
+typing-inspection==0.4.2 ; python_version >= "3.13"
 urllib3==2.5.0 ; python_version >= "3.13"
-uvicorn==0.37.0 ; python_version >= "3.13"
+uvicorn==0.38.0 ; python_version >= "3.13"
-uvloop==0.21.0 ; sys_platform != "win32" and sys_platform != "cygwin" and platform_python_implementation != "PyPy" and python_version >= "3.13"
+uvloop==0.22.1 ; sys_platform != "win32" and sys_platform != "cygwin" and platform_python_implementation != "PyPy" and python_version >= "3.13"
-watchfiles==1.1.0 ; python_version >= "3.13"
+watchfiles==1.1.1 ; python_version >= "3.13"
 websockets==15.0.1 ; python_version >= "3.13"