Docker image creation

.dockerignore

@@ -0,0 +1,24 @@
+.git
+.gitignore
+.venv
+__pycache__
+*.py[cod]
+*.egg-info
+.mypy_cache
+.pytest_cache
+.ruff_cache
+.uv-cache
+.coverage
+build
+dist
+
+# Credentials and local configuration must never enter the build context.
+.env*
+envrc
+.secrets
+secrets
+config
+
+# Development-only files are not needed by the runtime image.
+tests
+docs

.github/workflows/docker-build.yml

@@ -0,0 +1,41 @@
+name: Docker Image
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-push:
+    name: Build and push
+    runs-on: ubuntu-latest
+    env:
+      IMAGE_TAG: latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+        with:
+          username: ${{ secrets.SAAS_DOCKERHUB_USERNAME }}
+          password: ${{ secrets.SAAS_DOCKERHUB_TOKEN }}
+
+
+      - name: Build and push image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
+        with:
+          context: .
+          push: true
+          tags: veridise/audithub-mcp:${{ github.sha }}, veridise/audithub-mcp:${{ env.IMAGE_TAG }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+
+FROM ghcr.io/astral-sh/uv:0.12.7 AS uv
+
+FROM python:3.12-slim-bookworm
+
+COPY --from=uv /uv /uvx /bin/
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy
+
+WORKDIR /app
+
+# Install locked third-party dependencies before copying the source so this
+# layer remains cached when only application code changes.
+COPY pyproject.toml uv.lock ./
+RUN uv sync --locked --no-dev --no-install-project
+
+COPY src ./src
+RUN uv sync --locked --no-dev --no-editable
+
+RUN useradd --create-home --uid 10001 audithub \
+    && mkdir /data \
+    && chown audithub:audithub /data
+
+USER audithub
+WORKDIR /data
+
+ENTRYPOINT ["audithub-mcp"]