Spaces:
Running
Running
File size: 2,225 Bytes
9d60e8e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 | """Static, secret-safe verification for the CPU deployment bundle."""
from __future__ import annotations
import json
from pathlib import Path
import tomllib
ROOT = Path(__file__).resolve().parents[1]
def main() -> int:
project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
base_dependencies = project["project"]["dependencies"]
retrieval_dependencies = project["project"]["optional-dependencies"]["local-retrieval"]
dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
dockerignore = (ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines()
ui_source = (ROOT / "src" / "doc_inspector" / "ui.py").read_text(
encoding="utf-8"
)
forbidden_base = ("torch", "transformers", "accelerate")
assert not any(dependency.startswith(forbidden_base) for dependency in base_dependencies)
assert any(dependency.startswith("torch") for dependency in retrieval_dependencies)
assert "uv sync --locked --no-dev --no-editable" in dockerfile
assert "GRADIO_SERVER_NAME=0.0.0.0" in dockerfile
assert "GRADIO_TEMP_DIR=/tmp/doc-inspector-gradio" in dockerfile
assert "GRADIO_ANALYTICS_ENABLED=False" in dockerfile
assert "PUBLIC_MAX_REQUESTS_PER_HOUR=60" in dockerfile
assert "USER appuser" in dockerfile
assert 'api_visibility="private"' in ui_source
assert "max_size=8" in ui_source
assert "analytics_enabled=False" in ui_source
assert "enable_monitoring=False" in ui_source
assert "allowed_paths=" not in ui_source
assert ".env" in dockerignore
assert "data/" in dockerignore
assert "*.safetensors" in dockerignore
summary = {
"base_dependency_count": len(base_dependencies),
"local_retrieval_dependency_count": len(retrieval_dependencies),
"cpu_image_excludes_local_retrieval": True,
"secret_files_excluded": True,
"non_root_runtime": True,
"managed_temp_cleanup": True,
"analytics_disabled": True,
"event_api_private": True,
"bounded_queue": True,
"monitoring_disabled": True,
}
print(json.dumps(summary, ensure_ascii=False))
return 0
if __name__ == "__main__":
raise SystemExit(main())
|