chore: Update to Debian 12 and Python 3.11

*   Use python for the pip_compile ci script

    The distroless image for Python no longer contains `sh`.

*   Don't upgrade pip

    This should make the image smaller, build faster, and avoid issues
    of newer versions of pip breaking pip-tools.

*   Update dependencies as resolved by new pip-compile run.

    *   aioquic 1.2.0 to 1.3.0
    *   pylsqpack 0.3.22 to 0.3.23

Signed-off-by: Erik Swanson <[email protected]>

Author: eriksw

.github/workflows/update.yaml

@@ -20,15 +20,15 @@ jobs:
         id: update
         run: |
           docker create --name=pip-compile \
-          --entrypoint /bin/sh \
+          --entrypoint python \
           --interactive \
           --user root \
           --workdir /tmp \
           $IMAGE
           
           docker cp requirements.in pip-compile:/tmp/
           
-          docker start --attach --interactive pip-compile < ci/pip-compile.sh
+          docker start --attach --interactive pip-compile < ci/pip_compile.py
           
           mv requirements.txt requirements.txt.orig
           docker cp pip-compile:/tmp/requirements.txt .

Dockerfile

@@ -1,19 +1,18 @@
-FROM debian:11-slim@sha256:75e0b7a6158b4cc911d4be07d9f6b8a65254eb8c58df14023c3da5c462335593 AS build
+FROM debian:12-slim@sha256:936abff852736f951dab72d91a1b6337cf04217b2a77a5eaadc7c0f2f1ec1758 AS build
 RUN apt-get update \
 && apt-get install --no-install-suggests --no-install-recommends --yes \
 gcc \
 libpython3-dev \
 libssl-dev \
 python3-venv \
 && rm -rf /usr/local \
-&& python3 -m venv /usr/local \
-&& /usr/local/bin/pip install --upgrade pip setuptools wheel
+&& python3 -m venv /usr/local
 
 COPY requirements.txt /requirements.txt
 
 RUN /usr/local/bin/pip install --disable-pip-version-check -r /requirements.txt
 
-FROM gcr.io/distroless/python3-debian11:nonroot@sha256:f3331305dc14092a6df5a23733b3afc5806da8bab8089e63f441221ebcdb7cfb
+FROM gcr.io/distroless/python3-debian12:nonroot@sha256:1a7c3d2445f783c51be174c8913624dc5bea2cd7ff1f94b9a229a16f0e40fa34
 
 COPY --from=build /usr/local /usr/local
 

ci/pip-compile.sh

@@ -0,0 +1,7 @@
+import subprocess
+
+# Install pip-tools for the pip-compile command
+subprocess.check_call(["/usr/local/bin/pip", "install", "--disable-pip-version-check", "pip-tools"])
+
+# Run pip-compile to generate requirements.txt
+subprocess.check_call(["/usr/local/bin/pip-compile", "requirements.in"])

ci/pip_compile.py

@@ -5,7 +5,7 @@
 #
 # If python has been upgraded, we need to make sure it's in sync with the
 # build step and the constraint in renovate.json
-if sys.version_info.major != 3 or sys.version_info.minor != 9:
+if sys.version_info.major != 3 or sys.version_info.minor != 11:
     sys.exit(sys.version_info)
 
 # Check that pycrypto isn't broken

ci/validate.py

@@ -1,10 +1,10 @@
 #
-# This file is autogenerated by pip-compile with Python 3.9
+# This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
 #    pip-compile requirements.in
 #
-aioquic==1.2.0
+aioquic==1.3.0
     # via pproxy
 asyncssh==2.21.1
     # via pproxy
@@ -32,7 +32,7 @@ pycparser==2.23
     # via cffi
 pycryptodome==3.23.0
     # via pproxy
-pylsqpack==0.3.22
+pylsqpack==0.3.23
     # via aioquic
 pyopenssl==25.3.0
     # via aioquic
@@ -41,7 +41,6 @@ service-identity==24.2.0
 typing-extensions==4.15.0
     # via
     #   asyncssh
-    #   cryptography
     #   pyopenssl
 uvloop==0.22.1
     # via pproxy