From 8f757119202aaf8f50b53cb639580346a64fdef0 Mon Sep 17 00:00:00 2001
From: R-sh <r-sh@R-shs-MacBook-Pro.local>
Date: Thu, 23 Jul 2026 18:48:43 -0400
Subject: [PATCH] fix(docker): use CPU-only PyTorch image

Avoid pulling CUDA runtime dependencies for the CPU-only app container, and rely on the separate Ollama service instead of launching a nonexistent embedded daemon. Stabilize lint CI across Ruff releases and add packaging regression tests.\n\nCloses #6
---
 .github/workflows/lint.yml    |  8 +++++---
 Dockerfile                    |  9 +++++++--
 pyproject.toml                |  4 +++-
 tests/unit/test_dockerfile.py | 22 ++++++++++++++++++++++
 4 files changed, 37 insertions(+), 6 deletions(-)
 create mode 100644 tests/unit/test_dockerfile.py

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c2a3c57..49782cf 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,14 +8,16 @@ on:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.11'
 
       - run: pip install ruff
 
-      - run: ruff check .
\ No newline at end of file
+      - run: ruff check .
diff --git a/Dockerfile b/Dockerfile
index d035713..fa9aaa7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,6 +9,11 @@ RUN apt-get update && apt-get install -y build-essential \
 
 COPY requirements.txt .
 RUN python -m pip install --upgrade pip && \
+    pip install \
+    --retries 10 \
+    --timeout 600 \
+    --index-url https://download.pytorch.org/whl/cpu \
+    torch==2.7.1 && \
     pip install \
     --retries 10 \
     --timeout 600 \
@@ -25,5 +30,5 @@ ENV FLASK_APP=main.py
 ENV PYTHONUNBUFFERED=1
 ENV OLLAMA_HOST=http://ollama:11434
 
-# Start Ollama in background, wait for it, then start Flask
-CMD ollama serve > /tmp/ollama.log 2>&1 & sleep 5 && flask run --host=0.0.0.0 --port=8080 --no-reload
+# Ollama runs in its own Compose service or at OLLAMA_HOST.
+CMD ["flask", "run", "--host=0.0.0.0", "--port=8080", "--no-reload"]
diff --git a/pyproject.toml b/pyproject.toml
index b5c465b..aee791f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,5 +10,7 @@ exclude = [
 ]
 
 [tool.ruff.lint]
-# CI workflow ignores these; keep aligned.
+# Keep the CI contract stable across Ruff releases instead of inheriting
+# version-dependent defaults.
+select = ["E4", "E7", "E9", "F"]
 ignore = ["E402", "F401", "F841"]
diff --git a/tests/unit/test_dockerfile.py b/tests/unit/test_dockerfile.py
new file mode 100644
index 0000000..d7886e6
--- /dev/null
+++ b/tests/unit/test_dockerfile.py
@@ -0,0 +1,22 @@
+from pathlib import Path
+
+DOCKERFILE = Path(__file__).parents[2] / "Dockerfile"
+
+
+def test_docker_image_installs_cpu_only_torch_before_app_requirements():
+    contents = DOCKERFILE.read_text()
+
+    cpu_index = contents.index("https://download.pytorch.org/whl/cpu")
+    requirements_install = contents.index("-r requirements.txt")
+
+    assert cpu_index < requirements_install
+    assert "torch==2.7.1" in contents[cpu_index:requirements_install]
+
+
+def test_app_image_does_not_start_a_second_ollama_server():
+    command = next(
+        line for line in DOCKERFILE.read_text().splitlines() if line.startswith("CMD ")
+    )
+
+    assert "ollama serve" not in command
+    assert command.startswith('CMD ["flask", "run"')