Python 3.13

.github/workflows/gating.yaml

@@ -16,12 +16,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install system dependencies
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2
+        uses: nick-invision/retry@7152eba30c6575329ac0576536151aca5a72780e # v3
         with:
           timeout_minutes: 10
           retry_wait_seconds: 30
@@ -78,9 +78,9 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: |
@@ -122,12 +122,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install system dependencies
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2
+        uses: nick-invision/retry@7152eba30c6575329ac0576536151aca5a72780e # v3
         with:
           timeout_minutes: 10
           retry_wait_seconds: 30

.readthedocs.yaml

@@ -9,7 +9,7 @@ sphinx:
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.11"
+    python: "3.13"
   apt_packages:
     - libkrb5-dev
     - libldap2-dev

Dockerfile

@@ -1,23 +1,15 @@
-FROM quay.io/fedora/python-312:20241120@sha256:aedc5b00a981c671a5dab3c1885f89398b2bf633264542635e3fc3096a56538a AS builder
+FROM quay.io/fedora/python-313:20250101@sha256:dc3b9cf6de0ce9dca8b7eda0b353f7cfa15887e0bfe2015b2100f7d1aa368293 AS builder
 
 # builder should use root to install/create all files
 USER root
 
 # hadolint ignore=DL3033,DL3041,DL4006,SC2039,SC3040
 RUN set -exo pipefail \
     && mkdir -p /mnt/rootfs \
-    # install builder dependencies
-    && dnf install -y \
-        --setopt install_weak_deps=false \
-        --nodocs \
-        --disablerepo=* \
-        --enablerepo=fedora,updates \
-        krb5-devel \
-        openldap-devel \
     # install runtime dependencies
     && dnf install -y \
         --installroot=/mnt/rootfs \
-        --releasever=/ \
+        --use-host-config \
         --setopt install_weak_deps=false \
         --nodocs \
         --disablerepo=* \
@@ -98,5 +90,11 @@ WORKDIR /app
 
 USER 1001
 EXPOSE 8080
+
+# Validate virtual environment
+RUN /app/entrypoint.sh python -c 'import waiverdb' \
+    && /app/entrypoint.sh gunicorn --version \
+    && /app/entrypoint.sh waiverdb --help
+
 ENTRYPOINT ["/app/entrypoint.sh"]
 CMD ["gunicorn", "--bind", "0.0.0.0:8080", "--access-logfile", "-", "--enable-stdio-inheritance", "waiverdb.wsgi:app"]

docker-compose.yml

@@ -22,32 +22,31 @@ services:
     healthcheck: &dev-healthcheck
       test: >-
         /code/docker/docker-entrypoint.sh python -c 'import requests;
-        requests.get("http://127.0.0.1:8080/health/live").raise_for_status();
+        requests.get("http://127.0.0.1:8080").raise_for_status();
         requests.get("http://127.0.0.1:5004/healthcheck").raise_for_status();
         '
       interval: 1s
       timeout: 5s
       retries: 30
 
   waiverdb-db:
-    image: postgres:14.7-alpine@sha256:07985c5c5e01ee550b30c67a2cf806f8b08b32f74e3f24c4cbef31305ef5776d
+    image: postgres:17.2-alpine@sha256:d37d2c160d34430877c802e5adc22824a2ad453499db9bab1a2ceb2be6c1a46f
     restart: always
     env_file: ["docker/waiverdb-db.env"]
     healthcheck:
       <<: *dev-healthcheck
       test: "pg_isready -U postgres"
 
   keycloak:
-    image: quay.io/keycloak/keycloak:24.0.2@sha256:b8a3f00fc433f2999bc304b73df331e2005037e8f5673f644f9c0eacd5fbe048
+    image: quay.io/keycloak/keycloak:26.0.7@sha256:4388e2379b7e870a447adbe7b80bd61f5fbf04e925832b19669fda4957f05a81
     ports:
       - 127.0.0.1:5004:5004
       - 127.0.0.1:8080:8080
     environment:
-      - KEYCLOAK_ADMIN=admin
-      - KEYCLOAK_ADMIN_PASSWORD=admin
+      - KC_BOOTSTRAP_ADMIN_USERNAME=admin
+      - KC_BOOTSTRAP_ADMIN_PASSWORD=admin
     command:
       - start-dev
-      - --health-enabled=true
       - --import-realm
     volumes:
       - ./docker/keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro,z