From 47716c8d4afa5ecfca49584ff29fd74a3a75e3ee Mon Sep 17 00:00:00 2001 From: Martin Torp Date: Thu, 12 Nov 2026 13:21:45 +0100 Subject: [PATCH 1/2] Disable pip's cache in the Docker image's CLI install retries The v2.11.14 release published to PyPI but failed to push the Docker image. The first pip install inside the build saw a stale PyPI index without 2.11.14, and pip cached that response, so all ten retries reused it and never saw the release. Pass --no-cache-dir to the CLI and SDK installs so each retry fetches the index fresh. The release workflow's host-side verify step already does this. Bump to 2.11.15. --- CHANGELOG.md | 8 ++++++++ Dockerfile | 7 ++++--- pyproject.toml | 2 +- socketsecurity/__init__.py | 2 +- uv.lock | 2 +- 5 files changed, 15 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ecec455..7ab7ca51 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## 2.11.15 + +### Fixed: Docker image publishing + +- The `socketdev/cli` Docker image now publishes reliably when PyPI is slow to + list a new release. A delay could leave a release on PyPI without a matching + Docker image. + ## 2.11.14 ### Changed: bump pinned Coana CLI to 15.15.0 diff --git a/Dockerfile b/Dockerfile index 4450c6a1..daba128f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -152,14 +152,15 @@ RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-proje --index-url https://pypi.org/simple --extra-index-url https://pypi.org/simple \ -r /tmp/socket-cli-lock/requirements.txt -# Install CLI based on build mode +# Install CLI based on build mode. pip caches PyPI's package index for up to +# 10 minutes, so --no-cache-dir lets each retry see a just-published release. RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \ echo "Using local development install"; \ else \ cli_installed=false; \ for i in $(seq 1 10); do \ echo "Attempt $i/10: Installing socketsecurity==$CLI_VERSION"; \ - if pip install --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \ + if pip install --no-cache-dir --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \ cli_installed=true; \ break; \ fi; \ @@ -174,7 +175,7 @@ RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \ fi; \ pip check || exit 1; \ if [ ! -z "$SDK_VERSION" ]; then \ - pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \ + pip install --no-cache-dir --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \ fi; \ fi diff --git a/pyproject.toml b/pyproject.toml index 6579b240..e1e37b54 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ build-backend = "hatchling.build" [project] name = "socketsecurity" -version = "2.11.14" +version = "2.11.15" requires-python = ">= 3.11" license = {"file" = "LICENSE"} dependencies = [ diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py index 42841af8..260e8935 100644 --- a/socketsecurity/__init__.py +++ b/socketsecurity/__init__.py @@ -1,4 +1,4 @@ __author__ = 'socket.dev' -__version__ = '2.11.14' +__version__ = '2.11.15' USER_AGENT_NAME = 'socket-python-cli' USER_AGENT = f'{USER_AGENT_NAME}/{__version__}' diff --git a/uv.lock b/uv.lock index 2cf70cf2..469fc2f9 100644 --- a/uv.lock +++ b/uv.lock @@ -1332,7 +1332,7 @@ wheels = [ [[package]] name = "socketsecurity" -version = "2.11.14" +version = "2.11.15" source = { editable = "." } dependencies = [ { name = "beautifulsoup4" }, From 5780789bfa7e798205e1c880843386f84a6ffcfc Mon Sep 17 00:00:00 2001 From: Martin Torp Date: Thu, 12 Nov 2026 14:42:50 +0100 Subject: [PATCH 2/2] Disable pip's cache through a build-time ARG Set PIP_NO_CACHE_DIR=1 as an ARG at the top of the image build, the same way #439 does, so every pip call during the build skips the cache. This covers the CLI install retries and replaces the per-call flags. --- Dockerfile | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index daba128f..836b7d91 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,6 +6,10 @@ FROM node:24-alpine3.24 AS node FROM python:3-alpine LABEL org.opencontainers.image.authors="socket.dev" +# Build-time only. Keeps pip's cache out of the layers, and lets the CLI install +# retries see a release PyPI has just listed (pip caches its index for 10 min). +ARG PIP_NO_CACHE_DIR=1 + # Language version arguments with defaults ARG GO_VERSION=system ARG JAVA_VERSION=17 @@ -152,15 +156,14 @@ RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-proje --index-url https://pypi.org/simple --extra-index-url https://pypi.org/simple \ -r /tmp/socket-cli-lock/requirements.txt -# Install CLI based on build mode. pip caches PyPI's package index for up to -# 10 minutes, so --no-cache-dir lets each retry see a just-published release. +# Install CLI based on build mode RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \ echo "Using local development install"; \ else \ cli_installed=false; \ for i in $(seq 1 10); do \ echo "Attempt $i/10: Installing socketsecurity==$CLI_VERSION"; \ - if pip install --no-cache-dir --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \ + if pip install --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \ cli_installed=true; \ break; \ fi; \ @@ -175,7 +178,7 @@ RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \ fi; \ pip check || exit 1; \ if [ ! -z "$SDK_VERSION" ]; then \ - pip install --no-cache-dir --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \ + pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \ fi; \ fi