feat: adopt mitodl/ol-python-base:3.11, granian (#5524)

* Configure bumpver for Concourse release pipeline

Add [tool.bumpversion] configuration to pyproject.toml for the CalVer
release format YYYY.MM.DD.N required by the Concourse release pipeline.

Add test_bump_my_version_format (skipped) to validate VERSION against
the configured pattern once the CalVer pipeline is confirmed working.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: adopt mitodl/ol-python-base:3.11, BuildKit cache mounts, granian

- Replace FROM python:3.11-slim with FROM mitodl/ol-python-base:3.11;
  removes duplicated apt-get, user creation, and uv installation.
- Add BuildKit --mount=type=cache on uv sync for faster rebuilds.
- Switch CMD and docker-compose command from uwsgi to granian.
- Replace uwsgi_pass with proxy_pass in nginx.conf (dev) and
  nginx.conf.erb (Heroku).
- Update Procfile to run granian on port 8077.
- Remove uwsgi from pyproject.toml and regenerate uv.lock.
- Update apt.txt to document that all packages are in the base image.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: COPY --chown to avoid extra layer; exec granian for signal handling

- Replace COPY + RUN chown with COPY --chown to avoid a redundant image
  layer (Gemini review feedback).
- Prefix granian with exec in docker-compose command so granian receives
  OS signals directly instead of through bash.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: blarghmatey

Dockerfile

@@ -1,68 +1,56 @@
-FROM python:3.11-slim AS base
+# syntax=docker/dockerfile:1
+# hadolint global ignore=DL3008
 
+FROM mitodl/ol-python-base:3.11 AS base
 LABEL maintainer="ODL DevOps <mitx-devops@mit.edu>"
 
-WORKDIR /tmp
+# All required apt packages (git, curl, libjpeg-dev, zlib1g-dev, net-tools,
+# build-essential, libpq-dev, postgresql-client) are in mitodl/ol-python-base:3.11.
 
-COPY apt.txt /tmp/apt.txt
-RUN apt-get update && \
-    apt-get install --no-install-recommends -y $(grep -vE "^\s*#" apt.txt | tr "\n" " ") libpq-dev postgresql-client && \
-    apt-get clean && \
-    apt-get autoremove -y --purge && \
-    rm -rf /var/lib/apt/lists/*
-
-FROM base AS system
-
-RUN mkdir /src && \
-    adduser --disabled-password --gecos "" mitodl && \
-    mkdir /var/media && chown -R mitodl:mitodl /var/media
-
-FROM system AS uv
-
-ENV \
-  PYTHONUNBUFFERED=1 \
-  PYTHONDONTWRITEBYTECODE=1 \
-  UV_PROJECT_ENVIRONMENT="/opt/venv"
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
 ENV PATH="/opt/venv/bin:$PATH"
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
-
-COPY pyproject.toml uv.lock /src/
+# ─── Dependency install ───────────────────────────────────────────────────────
+FROM base AS deps
 
-RUN chown -R mitodl:mitodl /src && \
-    mkdir -p /opt/venv && \
-    chown -R mitodl:mitodl /opt/venv
+COPY --chown=mitodl:mitodl pyproject.toml uv.lock /src/
 
 USER mitodl
 WORKDIR /src
-RUN uv sync --frozen --no-install-project --no-dev
+# BuildKit cache mount keeps the uv download cache across builds.
+RUN --mount=type=cache,target=/opt/uv-cache,uid=1000,gid=1000 \
+    uv sync --frozen --no-install-project --no-dev
 
+# ─── Node / frontend asset build ─────────────────────────────────────────────
 FROM node:14.18.2 AS node_builder
 COPY . /src
 WORKDIR /src
 RUN yarn install --immutable
 RUN node node_modules/webpack/bin/webpack.js --config webpack.config.prod.js --bail
 
-FROM uv AS code
+# ─── Code stage ───────────────────────────────────────────────────────────────
+FROM deps AS code
 
 COPY --chown=mitodl:mitodl . /src
-
-# Set pip cache folder, as it is breaking pip when it is on a shared volume
 ENV XDG_CACHE_HOME=/tmp/.cache
 
+# ─── Production target ────────────────────────────────────────────────────────
 FROM code AS production
 
 COPY --from=node_builder --chown=mitodl:mitodl /src/static/bundles /src/static/bundles
 COPY --from=node_builder --chown=mitodl:mitodl /src/webpack-stats.json /src/webpack-stats.json
 
 EXPOSE 8079
 ENV PORT=8079
-CMD ["uwsgi", "uwsgi.ini"]
+CMD ["sh", "-c", "exec granian --interface wsgi --host 0.0.0.0 --port ${PORT:-8079} --workers 2 micromasters.wsgi:application"]
 
+# ─── Development target ───────────────────────────────────────────────────────
 FROM code AS development
 
-RUN uv sync --frozen --no-install-project
+RUN --mount=type=cache,target=/opt/uv-cache,uid=1000,gid=1000 \
+    uv sync --frozen --no-install-project
 
 EXPOSE 8079
 ENV PORT=8079
-CMD ["uwsgi", "uwsgi.ini"]
+CMD ["sh", "-c", "exec granian --interface wsgi --host 0.0.0.0 --port ${PORT:-8079} --workers 2 micromasters.wsgi:application"]

Procfile

@@ -1,3 +1,3 @@
-web: bin/start-nginx bin/start-pgbouncer uwsgi uwsgi.ini
+web: bin/start-nginx bin/start-pgbouncer granian --interface wsgi --host 0.0.0.0 --port 8077 --workers 2 micromasters.wsgi:application
 worker: bin/start-pgbouncer celery -A micromasters.celery:app worker -Q search,exams,dashboard,default -B -l $MICROMASTERS_LOG_LEVEL
 extra_worker: bin/start-pgbouncer celery -A micromasters.celery:app worker -Q search,exams,dashboard,default -l $MICROMASTERS_LOG_LEVEL

apt.txt

@@ -1,7 +1,4 @@
-# Core requirements
-git
-curl
-libjpeg-dev
-zlib1g-dev
-net-tools
-build-essential
+# App-specific apt extras for micromasters.
+# All required packages (git, curl, libjpeg-dev, zlib1g-dev, net-tools,
+# build-essential, libpq-dev, postgresql-client) are in
+# mitodl/ol-python-base:3.11. No extras needed.

config/nginx.conf

@@ -17,10 +17,11 @@ server {
     }
 
     location / {
-        include uwsgi_params;
-        uwsgi_pass web:8077;
-        uwsgi_pass_request_headers on;
-        uwsgi_pass_request_body on;
+        proxy_pass http://web:8077;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
         client_max_body_size 25M;
     }
 

config/nginx.conf.erb

@@ -80,22 +80,11 @@ http {
         }
 
         location / {
-            uwsgi_param QUERY_STRING $query_string;
-            uwsgi_param REQUEST_METHOD $request_method;
-            uwsgi_param CONTENT_TYPE $content_type;
-            uwsgi_param CONTENT_LENGTH $content_length;
-            uwsgi_param REQUEST_URI $request_uri;
-            uwsgi_param PATH_INFO $document_uri;
-            uwsgi_param DOCUMENT_ROOT $document_root;
-            uwsgi_param SERVER_PROTOCOL $server_protocol;
-            uwsgi_param REMOTE_ADDR $remote_addr;
-            uwsgi_param REMOTE_PORT $remote_port;
-            uwsgi_param SERVER_ADDR $server_addr;
-            uwsgi_param SERVER_PORT $server_port;
-            uwsgi_param SERVER_NAME $server_name;
-            uwsgi_pass unix:/tmp/nginx.socket;
-            uwsgi_pass_request_headers on;
-            uwsgi_pass_request_body on;
+            proxy_pass http://<%= ENV["NGINX_UPSTREAM"] || "localhost:8077" %>;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
             client_max_body_size 25M;
         }
     }

docker-compose.yml

@@ -78,7 +78,7 @@ services:
       sleep 3 &&
       python3 manage.py collectstatic --noinput &&
       python3 manage.py migrate --no-input &&
-      uwsgi uwsgi.ini --honour-stdin'
+      exec granian --interface wsgi --host 0.0.0.0 --port 8077 --workers 2 micromasters.wsgi:application'
     stdin_open: true
     tty: true
     ports:

micromasters/tests/test_settings.py

@@ -3,9 +3,13 @@
 """
 
 import importlib
+import re
 import sys
+import tomllib
 from unittest import mock
 
+import pytest
+
 import semantic_version
 from ddt import data, ddt
 from django.conf import settings
@@ -158,3 +162,14 @@ def test_semantic_version():
         Verify that we have a semantic compatible version.
         """
         semantic_version.Version(settings.VERSION)
+
+    @staticmethod
+    @pytest.mark.skip(reason="VERSION uses semver until CalVer pipeline is validated")
+    def test_bump_my_version_format():
+        """Verify that VERSION matches the bump-my-version calver format."""
+        with open("pyproject.toml", "rb") as f:  # noqa: PTH123
+            pyproject = tomllib.load(f)
+        version_pattern = pyproject["tool"]["bumpversion"]["parse"]
+        package_version = pyproject["project"]["version"]
+        assert settings.VERSION == package_version
+        assert re.fullmatch(version_pattern, settings.VERSION)

pyproject.toml

@@ -43,7 +43,6 @@ dependencies = [
     "robohash==2.0.0",
     "tornado>=6.0",
     "urllib3==1.26.5",
-    "uwsgi",
     "wagtail>=7.0,<8.0",
     "flaky==3.7.0",
     "pyopenssl",
@@ -79,3 +78,37 @@ dev = [
     "isort",
     "semantic-version",
 ]
+
+[tool.bumpversion]
+current_version = "0.250.1"
+commit = false
+tag = false
+parse = "(?P<release>(?:[1-9][0-9]{3})\\.(?:1[0-2]|[1-9])\\.(?:3[0-1]|[12][0-9]|[1-9]))\\.(?P<build>\\d+)"
+serialize = ["{release}.{build}"]
+
+[tool.bumpversion.parts.release]
+calver_format = "{YYYY}.{MM}.{DD}"
+
+[tool.bumpversion.parts.build]
+first_value = "1"
+
+[[tool.bumpversion.files]]
+filename = "VERSION"
+search = "{current_version}"
+replace = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "pyproject.toml"
+search = 'version = "{current_version}"'
+replace = 'version = "{new_version}"'
+
+[[tool.bumpversion.files]]
+filename = "uv.lock"
+search = """
+name = "micromasters"
+version = "{current_version}"
+source = {{ virtual = "." }}"""
+replace = """
+name = "micromasters"
+version = "{new_version}"
+source = {{ virtual = "." }}"""