Closed dreamorosi closed 1 month ago
Bumping docker image to 2a703999163cdb8257a85849fb2d39914a82587769f95c297bb3f01acf72a609
which is 9.5.35 fixes the issue.
⚠️ COMMENT VISIBILITY WARNING ⚠️
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
Hey @am29d and @dreamorosi! dedicated some time tonight to check this issue, and I believe I've identified the root cause. Before going into the details, I must say that I don't understand why we need to use pip-compile
to generate a requirements.txt
file with hashes and transitive dependencies in this situation. I mean, I understand that this approach can sometimes be useful to prevent conflicts, but in our current situation it seems to be having the opposite effect: it's actually creating conflicts.
Maybe in the past it was useful, but right now I don't see any need to use this.
So, can you try to reproduce the fix in your local environment? If it works, I can submit a PR:
1 - Remove the current docker image: docker image rm powertools-typescript/docs --force
2 - Clear the contents of the docs/requirements.txt
file.
3 - Copy the content from docs/requirements.in
to docs/requirements.txt
4 - Remove the flag --require-hashes
from the docs/Dockerfile
(line 5)
5 - Build the documentation: docker build -t powertools-typescript/docs ./docs/
6 - Run the documentation: docker run --rm -it -p 8000:8000 -v ${PWD}:/docs powertools-typescript/docs
I checked the pipeline for building the documentation and it should not be affected when using mkdocs build
to build the documentation directly.
While we're at it, why don't you also use the Makefile
to automate some things? This isn't exclusive to npm scripts
and you can maintain them, but I think there's a universe of people who might take a while to figure out which npm script to run, whereas the Makefile
is more straightforward.
Thanks
Hi Leo, thanks for looking into this, this helps.
I have tested the steps you shared and confirmed that it works, however as discussed offline we might not be able to implement them. Removing the lock file would affect our supply chain posture, and also our OpenSSF scorecard.
Ideally, if there's a conflict between the base image we are using and the additional dependencies we are installing, we should try to fix that instead.
I don't have a good solution yet, but we can think of something.
Regarding the Makefile
suggestion, I think for now we'll stick to npm. I don't have anything against using makefiles specifically but at least from my personal experience I don't think it's a standard that is very common in the Node.js ecosystem.
Hi @dreamorosi, thanks for sharing the OpenSSF scorecard check with me. There is actually a check for pinned dependencies
if a pip install
command is found.
The same issue is happening with Python and I figured out the problem. The dependabot is bumping packages and dependencies in the requirements.txt
file, but it is not smart enough - don't ask me why - to detect that it should bump the transitive dependency mkdocs
to 1.6.1, which is where the conflict is happening.
If you look here, you will see that it is using mkdocs 1.6.0, even though the latest is 1.6.1.
I created a new requirements.txt
file with the dependencies updated and it's working now.
This is the first time this has happened and I don't know if it will happen again in the future, but it seems like we don't have many options now.
I'm sending a PR to fix this.
⚠️ COMMENT VISIBILITY WARNING ⚠️
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
Summary
When running the documentation locally using Docker the
mkdocs serve
command seems to failRunning
docker run --rm -it -p 8000:8000 -v ${PWD}:/docs powertools-typescript/docs
, causes this exception:The issue seem to have been introduced in this PR and only occurs when using Docker. If I run the docs using Python directly on my machine I am able to run it normally.
Likewise, the build for the docs is also unaffected.
We should investigate why this is happening.
Why is this needed?
So that contributors in this repo can run the docs locally without having to install Python on their machines.
Which area does this relate to?
Other
Solution
No response
Acknowledgment
Future readers
Please react with 👍 and your use case to help us understand customer demand.