Align with spec-python-projects

.github/workflows/ci.yml

@@ -1,7 +1,11 @@
 name: CI
-on: push
+permissions: read-all
+on:
+  pull_request:
+    paths-ignore:
+      - '.github/**'
 jobs:
   test:
-    uses: mitlibraries/.github/.github/workflows/python-shared-test.yml@main
+    uses: mitlibraries/.github/.github/workflows/python-uv-shared-test.yml@main
   lint:
-    uses: mitlibraries/.github/.github/workflows/python-shared-lint.yml@main
+    uses: mitlibraries/.github/.github/workflows/python-uv-shared-lint.yml@main

.github/workflows/dev-build.yml

@@ -1,24 +1,25 @@
-### This is the Terraform-generated dev-build.yml workflow for the asati-dev app repository ###
-### If this is a Lambda repo, uncomment the FUNCTION line at the end of the document ###
-### If the container requires any additional pre-build commands, uncomment and edit ###
-### the PREBUILD line at the end of the document. ###
-name: Dev Container Build and Deploy
+name: Dev Image Build and Deploy
 on:
-    workflow_dispatch:
-    pull_request:
-        branches:
-            - main
-        paths-ignore:
-            - '.github/**'
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '.github/**'
+
+permissions:
+  id-token: write
+  contents: read
 
 jobs:
-    deploy:
-        name: Dev Container Deploy
-        uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-dev.yml@main
-        secrets: inherit
-        with:
-            AWS_REGION: "us-east-1"
-            GHA_ROLE: "asati-gha-dev"
-            ECR: "asati-dev"
-            # FUNCTION: ""
-            # PREBUILD:
+
+  build-push:
+    name: Dev Build and Push
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-dev.yml@main
+    secrets: inherit
+    with:
+      AWS_REGION: us-east-1
+      GHA_ROLE: asati-gha-dev
+      ECR: asati-dev
+      # DOCKERFILE: # only if the name of the Dockerfile is not "Dockerfile"!
+      # PREBUILD: # only if there is some pre-build dependency

.github/workflows/prod-promote.yml

@@ -1,20 +1,23 @@
-### This is the Terraform-generated prod-promote.yml workflow for the asati-prod repository.    ###
-### If this is a Lambda repo, uncomment the FUNCTION line at the end of the document.           ###
-name: Prod Container Promote
+name: Prod Image Promote
 on:
   workflow_dispatch:
   release:
     types: [published]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
-  deploy:
-    name: Prod Container Promote
-    uses: mitlibraries/.github/.github/workflows/ecr-shared-promote-prod.yml@main
+
+  promote:
+    name: Prod promote
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-promote-prod.yml@main
     secrets: inherit
     with:
-      AWS_REGION: "us-east-1"
+      AWS_REGION: us-east-1
       GHA_ROLE_STAGE: asati-gha-stage
       GHA_ROLE_PROD: asati-gha-prod
-      ECR_STAGE: "asati-stage"
-      ECR_PROD: "asati-prod"
-      # FUNCTION: ""
+      ECR_STAGE: asati-stage
+      ECR_PROD: asati-prod
+      # DEFAULT_BRANCH: # Only if the default branch is not "main"!

.github/workflows/stage-build.yml

@@ -1,24 +1,25 @@
-### This is the Terraform-generated dev-build.yml workflow for the asati-stage app repository ###
-### If this is a Lambda repo, uncomment the FUNCTION line at the end of the document ###
-### If the container requires any additional pre-build commands, uncomment and edit ###
-### the PREBUILD line at the end of the document. ###
-name: Stage Container Build and Deploy
+name: Stage Image Build and Deploy
 on:
-    workflow_dispatch:
-    push:
-        branches:
-            - main
-        paths-ignore:
-            - '.github/**'
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '.github/**'
+
+permissions:
+  id-token: write
+  contents: read
 
 jobs:
-    deploy:
-        name: Stage Container Deploy
-        uses: mitlibraries/.github/.github/workflows/ecr-shared-deploy-stage.yml@main
-        secrets: inherit
-        with:
-            AWS_REGION: "us-east-1"
-            GHA_ROLE: "asati-gha-stage"
-            ECR: "asati-stage"
-            # FUNCTION: ""
-            # PREBUILD:
+
+  build-push:
+    name: Stage Build and Push
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-stage.yml@main
+    secrets: inherit
+    with:
+      AWS_REGION: us-east-1
+      GHA_ROLE: asati-gha-stage
+      ECR: asati-stage
+      # DOCKERFILE: # only if the name of the Dockerfile is not "Dockerfile"!
+      # PREBUILD: # only if there is some pre-build dependency

.gitignore

@@ -155,3 +155,5 @@ cython_debug/
 .DS_Store
 output/
 .vscode/
+.arch_tag
+.tool-versions

.pre-commit-config.yaml

@@ -1,29 +1,30 @@
 default_language_version:
-  python: python3.11 # set for project python version
+  python: python3.13
+
+default_stages:
+  - pre-push
+
 repos:
   - repo: local
     hooks:
-      - id: black-apply
-        name: black-apply
-        entry: pipenv run black
+      - id: ruff-format
+        name: ruff-format
+        entry: uv run ruff format --diff
         language: system
         pass_filenames: true
         types: ["python"]
+
       - id: mypy
         name: mypy
-        entry: pipenv run mypy
+        entry: uv run mypy
         language: system
         pass_filenames: true
         types: ["python"]
-        exclude: "tests/"
-      - id: ruff-apply
-        name: ruff-apply
-        entry: pipenv run ruff check --fix
+        exclude: "(tests/|output/|migrations/)"
+
+      - id: ruff-check
+        name: ruff-check
+        entry: uv run ruff check
         language: system
         pass_filenames: true
-        types: ["python"]
-      - id: safety
-        name: safety
-        entry: pipenv check
-        language: system
-        pass_filenames: false
+        types: ["python"]

.python-version

@@ -1 +1 @@
-3.12
+3.13

Dockerfile

@@ -1,12 +1,18 @@
-FROM python:3.12-slim as build
-WORKDIR /app
-COPY . .
+FROM python:3.13-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir --upgrade pip pipenv
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
+ENV UV_SYSTEM_PYTHON=1
+
+WORKDIR /app
 
-RUN apt-get update && apt-get dist-upgrade -y && apt-get install -y git
+COPY pyproject.toml uv.lock* ./
+COPY asati ./asati
 
-COPY Pipfile* /
-RUN pipenv install
+RUN uv pip install --system .
 
-ENTRYPOINT ["pipenv", "run", "asati"]
+ENTRYPOINT ["asati"]
+CMD []