Skip to content

Add pyproject.toml, add Python 3.14 support #577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
byewokko wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Add pyproject.toml, add Python 3.14 support #577

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
1eb0fc3
Add pyproject.toml
byewokko May 26, 2026
f647296
Use pyproject.toml in github CI
byewokko May 26, 2026
8789c38
Update ignore files for pyproject.toml usage
byewokko May 26, 2026
df1dd84
Remove editable flag
byewokko May 26, 2026
35cd26c
Increase minimal python version
byewokko May 28, 2026
725fe36
Remove redundant packages from lint and test
byewokko May 28, 2026
96b161a
Merge branch 'main' into feature/pyproject-toml
byewokko Jun 17, 2026
66f2e0b
Fix: CI test stage dependencies
byewokko Jun 17, 2026
f0beb8a
Feature: Update to alpine 3.24 and python 3.14
byewokko Jun 17, 2026
52e7195
Fix: Use pip for prod build, use poetry for CI
byewokko Jun 17, 2026
fe1d353
Chore: Update CHANGELOG.md
byewokko Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,26 @@
doc
example
.github

# Python build artifacts
build/
dist/
*.egg-info/
.eggs/
*.egg

# pip cache
.cache/

# Virtual environments
.venv/
venv/

# Development artifacts
__pycache__/
*.py[cod]
*$py.class

# Poetry
.poetry/
poetry.toml
46 changes: 24 additions & 22 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.11", "3.12", "3.13"]
python-version: ["3.11", "3.12", "3.13", "3.14"]

steps:
- uses: actions/checkout@v4
Expand All @@ -27,22 +27,25 @@ jobs:
with:
python-version: ${{ matrix.python-version }}

- name: Install dependencies
- name: Install Poetry
run: |
python -m pip install --upgrade pip
pip install flake8
pip install git+https://github.com/TeskaLabs/asab.git

pip install poetry
Comment on lines +30 to +33

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/ci.yml | head -100

Repository: TeskaLabs/seacat-auth

Length of output: 2935

Pin Poetry to a fixed version in both CI jobs for reproducible builds.

Poetry is installed without version pinning at lines 33 and 61, which can cause workflows to break when new Poetry versions introduce breaking changes. Pin to a specific tested version.

Suggested change 
-        pip install poetry
+        pip install "poetry==<approved-version>"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 30 - 33, The Poetry installation
commands lack version pinning, which can cause workflow failures when new
versions introduce breaking changes. In the "Install Poetry" step and any other
Poetry installation commands in the workflow, replace the generic pip install
poetry command with pip install poetry==<specific-version> where you pin to a
stable tested version (for example, a recent stable release). Apply this fix to
both occurrences mentioned in the comment to ensure reproducible builds across
all CI jobs.


- name: Install lint dependencies
run: |
poetry install --no-interaction --only lint

- name: Lint with flake8
run: |
flake8 seacatauth seacatauth.py
poetry run flake8 seacatauth seacatauth.py

test:
needs: flake8
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.11", "3.12", "3.13"]
python-version: ["3.11", "3.12", "3.13", "3.14"]

steps:
- uses: actions/checkout@v4
Expand All @@ -52,19 +55,18 @@ jobs:
with:
python-version: ${{ matrix.python-version }}

- name: Install dependencies
- name: Install Poetry
run: |
python -m pip install --upgrade pip
pip install bson
pip install pymongo
pip install bcrypt
pip install argon2-cffi
pip install jwcrypto
pip install "asab[encryption] @ git+https://github.com/TeskaLabs/asab.git"

pip install poetry

- name: Install test dependencies
run: |
poetry install --no-interaction --only test

- name: Test with unittest
run: |
python3 -m unittest test
poetry run python -m unittest test

build:
needs: test
Expand All @@ -73,7 +75,7 @@ jobs:

steps:
- uses: actions/checkout@v4

- name: Docker Metadata action
uses: docker/metadata-action@v5
id: meta
Expand All @@ -83,13 +85,13 @@ jobs:
type=raw,value=latest
type=ref,event=tag
type=semver,pattern={{raw}}

- name: Login to DockerHub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USER }}
password: ${{ secrets.DOCKER_PASSWORD }}
username: ${{ secrets.DOCKER_USER }}
password: ${{ secrets.DOCKER_PASSWORD }}
Comment on lines 89 to +93

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

GitHub Actions best practices pinning commit SHA vs tag 2024 2025

💡 Result:

The industry-standard best practice for GitHub Actions is to pin references to a full-length commit SHA rather than a version tag or branch name [1][2][3]. This approach provides security through immutability, ensuring that your workflow consistently runs the exact same code you have reviewed, regardless of changes made to the upstream repository [1][4][5]. Why Pin to a Commit SHA GitHub tags (e.g., @v4) are mutable references that can be moved, deleted, or recreated by an action's maintainer [4][5][6]. A compromised maintainer account or a malicious actor can retarget these tags to point at compromised code, causing your CI/CD pipelines to execute unauthorized actions and potentially expose sensitive secrets [2][7][6]. Pinning to an immutable full-length commit SHA eliminates this supply chain risk, as an attacker cannot change the content of a Git commit without generating a collision [1][8][3]. Implementation Strategy To maintain the readability and updateability of your workflows, use the following pattern: - Pin to the full 40-character commit SHA [1][6]. - Include the version tag as a comment on the same line to keep the reference human-readable and compatible with automated dependency tools [8][2][5]. Example: - uses: actions/checkout@3df4ab1 # v4.0.0 Managing Updates Manually updating SHAs is inefficient. Instead, automate the process using dependency management tools like Dependabot or Renovate [8][2][7]. Both tools support the "SHA-pin with tag comment" convention; they parse the comment to identify the latest version and open pull requests to bump the SHA and update the comment simultaneously [8][5]. Enforcement - Organizational Policy: GitHub allows administrators to enforce full commit SHA pinning at the repository or organization level [1][4][2]. When enabled, any workflow referencing an action by a mutable tag or branch will fail, blocking unpinned dependencies [4][2]. - Automated Checks: For environments where a policy isn't enforced, you can integrate tools like zizmor or custom scripts into your CI pipeline to scan and reject workflows that use mutable references [2][6]. Exceptions While pinning to a SHA is the recommended standard for all third-party actions, some organizations allow tag-based references for internal, first-party actions over which they maintain full, direct control [6]. However, for all external dependencies, SHA pinning is widely considered a required security practice [2][3][6].

Citations:

🌐 Web query:

docker/login-action versioning recommendations security

💡 Result:

For the docker/login-action GitHub Action, security best practices focus on minimizing supply chain risk through strict versioning and adhering to secure credential management. Versioning Recommendations To protect against supply chain compromises where malicious code could be injected into action updates, it is highly recommended to pin the action to a specific immutable commit SHA rather than a semantic version tag [1]. While semantic version tags (e.g., v4) are convenient, they are mutable and can be updated by maintainers; pinning to a full-length commit hash ensures that the exact code you have reviewed and tested is always executed [1]. Credential Security Best Practices 1. Use Scoped Credentials: When possible, use the scope input to limit registry credentials to a specific repository or namespace [2][3]. This prevents the action from overriding global Docker credentials, which is particularly useful for maintaining unauthenticated pull capabilities for base images while authenticating only for necessary push operations [2][3]. 2. Prefer Repository Variables for Usernames: Use GitHub Actions variables (vars) for usernames instead of secrets [4]. Secrets are automatically redacted from logs, but using them for non-sensitive data can sometimes lead to excessive masking that obscures useful debugging information; variables provide a clearer, more appropriate storage mechanism for non-sensitive identity information [5][4]. 3. Use Personal Access Tokens (PATs) or GITHUB_TOKEN: - For Docker Hub: Never use your main account password. Always use a dedicated Personal Access Token (PAT) with appropriate, limited scopes [2][6]. - For GitHub Container Registry (ghcr.io): Use the built-in GITHUB_TOKEN, which provides the most secure and streamlined authentication experience for actions within a repository [6][7][8]. 4. Automatic Logout: The action defaults to logout: true, which is a security best practice that ensures credentials are not left in the runner's environment after the job completes [2][3]. Maintain this default setting unless there is a specific, well-justified reason to change it. 5. Consider Third-Party Alternatives: If highly specialized security environments are required, community-maintained drop-in replacements that emphasize enhanced security posture (such as those provided by organizations specializing in CI/CD security) may be evaluated [9]. Always monitor the official repository releases and changelogs to stay informed about dependency updates and security patches [10][11].

Citations:

🌐 Web query:

GitHub Actions security supply chain integrity pinning versions

💡 Result:

To ensure supply chain integrity in GitHub Actions, the most critical security practice is to pin all third-party actions to their full-length commit SHA [1][2][3]. Why Pinning to SHA is Required Standard Git tags (e.g., @v1, @v2) are mutable, meaning an attacker or a compromised maintainer account can move a tag to point to a different, malicious commit [4][5][6]. Pinning to a full-length commit SHA ensures that the action remains immutable, as the SHA uniquely identifies the exact state of the code [1][4][6]. This protects workflows against "tag retargeting" attacks [5]. Policy Enforcement GitHub provides features to enforce this security posture at scale [4]. Organization and repository administrators can configure "Allowed Actions" policies to require that all actions be pinned to a full-length commit SHA [4][3]. When enabled, any workflow attempting to use an action not pinned to a SHA will fail, preventing the accidental use of unverified or mutable versions [4]. Best Practices for Implementation - Automated Maintenance: While SHA pinning increases security, it creates a manual maintenance burden for updates [7]. Use automated dependency management tools like Dependabot or Renovate to keep these SHAs updated [2][5][6]. These tools can propose pull requests that update the commit SHA while often maintaining a human-readable tag in a comment for context [5][6]. - Trust and Verification: Even when pinned, you should only use actions from reputable creators [1][3]. For actions from less-trusted sources, consider vetting the code or forking it into your own organization for controlled use [7]. - Holistic Security: Pinning is one layer of a secure supply chain. Complement this with other strategies: - Enable CodeQL to scan workflows for security best practices [2]. - Utilize OpenID Connect (OIDC) to eliminate the need for long-lived secrets in workflows [2]. - Use security tools like Scorecards, zizmor, or StepSecurity's Harden-Runner to detect risky practices and monitor runtime behavior [1][7][6]. For developers looking to automate the transition to SHA pinning, community tools such as pinact, frizbee, or ratchet can help identify and replace existing tag references with immutable digests [8][6].

Citations:

Pin docker/login-action to a full commit SHA.

Line 90 uses a mutable tag (@v3). Pinning to a full commit SHA is the industry-standard security practice and improves supply-chain integrity by preventing tag-retargeting attacks where a compromised maintainer account or malicious actor could redirect the tag to malicious code.

For maintainability, include the version tag as a comment on the same line so automated dependency tools like Dependabot can keep the SHA updated:

Suggested change 
-      uses: docker/login-action@v3
+      uses: docker/login-action@<full-commit-sha> # v3
🧰 Tools
🪛 zizmor (1.25.2)

[error] 90-90: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 89 - 93, The docker/login-action is
currently pinned to the mutable tag `@v3`, which poses a security risk. Replace
`@v3` with a pinned full commit SHA (for example, `@abc123def456`...). Additionally,
add the version tag as a comment on the same line (e.g., # v3) to enable
automated dependency tools like Dependabot to track and update the SHA when new
versions are released. This follows industry-standard security practices for
GitHub Actions workflows.

Source: Linters/SAST tools


- name: Build and push
uses: docker/build-push-action@v6
with:
Expand Down
10 changes: 10 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,16 @@ __pycache__/

# Distribution / packaging
.Python
build/
dist/
*.egg-info/
.eggs/
*.egg
MANIFEST

# Poetry cache and config
.poetry/
poetry.toml

# Unit test / coverage reports
htmlcov/
Expand Down
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
## v26.15

### Pre-releases
- v26.15-alpha12
- v26.15-alpha11
- ~~v26.15-alpha10~~
- ~~v26.15-alpha9~~
Expand Down Expand Up @@ -32,6 +33,9 @@
- Redirect to login when external login initialization fails (#565, v26.15-alpha1)
- Always include link in response if SMTP is not configured (#561, v26.15-alpha)

### Refactoring
- Add pyproject.toml, add Python 3.14 support, update CI (#577, v26.15-alpha12)

---


Expand Down
48 changes: 21 additions & 27 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ---- Build stage ----
FROM alpine:3.21 AS builder
FROM alpine:3.24 AS builder
LABEL maintainer="TeskaLabs Ltd (support@teskalabs.com)"

ENV LANG=C.UTF-8
Expand All @@ -16,7 +16,7 @@ RUN apk add --no-cache \
xmlsec \
openldap

# Create build environment so that dependencies like aiohttp can be build
# Create build environment so that dependencies like aiohttp can be built
# Run all as a single command in order to reduce image size --virtual buildenv
RUN apk add --no-cache \
git \
Expand All @@ -28,43 +28,37 @@ RUN apk add --no-cache \
musl-dev \
openldap-dev \
rust \
cargo \
&& python3 -m venv /venv \
&& /venv/bin/pip3 install --upgrade pip \
&& /venv/bin/pip3 install --no-cache-dir \
aiohttp \
aiosmtplib \
motor \
cryptography \
jwcrypto>=0.9.1 \
fastjsonschema \
bcrypt \
argon2_cffi \
python-ldap \
aiomysql \
jinja2 \
pyotp \
webauthn \
pyyaml \
pysaml2 \
pymongo \
sentry-sdk \
"asab[encryption] @ git+https://github.com/TeskaLabs/asab.git"

RUN cat /venv/lib/python3.12/site-packages/asab/__version__.py
cargo

# Create virtual environment
RUN python3 -m venv /venv \
&& /venv/bin/pip3 install --upgrade pip

RUN mkdir -p /app/seacat-auth
RUN mkdir -p /app/seacat-auth/scripts
WORKDIR /app/seacat-auth

# Copy project metadata files first for better layer caching
COPY README.md pyproject.toml /app/seacat-auth/

# Copy the source code
COPY seacatauth /app/seacat-auth/seacatauth
COPY seacatauth.py /app/seacat-auth/seacatauth.py

# Install using pip with pyproject.toml (includes all main deps + ldap extra)
RUN /venv/bin/pip3 install --no-cache-dir ".[ldap]"

# Verify ASAB version
RUN /venv/bin/python -c "import asab; print(asab.__version__)"

# Create MANIFEST.json in the working directory
# The manifest script requires git to be installed
COPY ./.git /app/seacat-auth/.git
RUN /venv/bin/asab-manifest.py ./MANIFEST.json


# ---- Runtime stage ----
FROM alpine:3.21
FROM alpine:3.24

RUN apk add --no-cache \
python3 \
Expand Down
98 changes: 98 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"

[tool.poetry]
name = "seacat-auth"
version = "26.15.0"
description = "SeaCat Auth is a microservice that provides authentication, authorization, identity management, session management and other access control features."
readme = "README.md"
license = "GPL-3.0-or-later"
authors = ["TeskaLabs Ltd <support@teskalabs.com>"]
maintainers = ["TeskaLabs Ltd <support@teskalabs.com>"]
keywords = [
"authentication",
"authorization",
"identity",
"session-management",
"openid-connect",
"oauth2",
"rbac",
"microservice",
"access-control",
"webauthn",
"2fa",
"mfa",
]
classifiers = [
"Development Status :: 5 - Production/Stable",
"Intended Audience :: Developers",
"Intended Audience :: System Administrators",
"License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
"Operating System :: OS Independent",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.13",
"Programming Language :: Python :: 3.14",
"Topic :: Security",
"Topic :: Security :: Cryptography",
"Topic :: System :: Systems Administration :: Authentication/Directory",
"Topic :: Internet :: WWW/HTTP :: HTTP Servers",
]
packages = [{include = "seacatauth"}]

[tool.poetry.dependencies]
python = "^3.11"
aiohttp = "*"
aiosmtplib = "*"
motor = "*"
cryptography = "*"
jwcrypto = ">=0.9.1"
fastjsonschema = "*"
bcrypt = "*"
argon2-cffi = "*"
aiomysql = "*"
jinja2 = "*"
pyotp = "*"
webauthn = "*"
pyyaml = "*"
pysaml2 = "*"
pymongo = "*"
sentry-sdk = "*"
asab = {git = "https://github.com/TeskaLabs/asab.git", extras = ["encryption"]}

# Optional extras (installed via poetry install -E ldap)
python-ldap = { version = "*", optional = true }

[tool.poetry.extras]
ldap = ["python-ldap"]

# Development dependency groups - these are independent from main deps
# Use 'poetry install --only lint' to install just flake8 (no main deps!)
[tool.poetry.group.lint.dependencies]
flake8 = "*"

[tool.poetry.group.test.dependencies]
pymongo = "*"
bcrypt = "*"
argon2-cffi = "*"
jwcrypto = ">=0.9.1"
asab = {git = "https://github.com/TeskaLabs/asab.git", extras = ["encryption"]}

[tool.poetry.group.dev.dependencies]
pytest = "*"
pytest-asyncio = "*"

# No CLI entry point defined - the application is started via seacatauth.py

[tool.poetry.urls]
"Homepage" = "https://github.com/TeskaLabs/seacat-auth"
"Documentation" = "https://docs.teskalabs.com/seacat-auth"
"Docker Image" = "https://hub.docker.com/r/teskalabs/seacat-auth"
"Changelog" = "https://github.com/TeskaLabs/seacat-auth/blob/main/CHANGELOG.md"
"Bug Tracker" = "https://github.com/TeskaLabs/seacat-auth/issues"

[tool.flake8]
# From setup.cfg - flake8 configuration
ignore = ["W191", "W503", "E117", "E501", "E303", "E301"]
Loading