Bump + pin web versions (#667)

* Bump + pin web versions

* Linting

* Reorder doc command

---------

Co-authored-by: Michael Franklin <[email protected]>

dataproc/README.md

@@ -68,8 +68,14 @@ Note, we support specifying the hail_version, but only a very select number of v
 ```sh
 gcloud config set project analysis-runner
 # grab the HAIL_VERSION from analysis_runner/dataproc.py
-HAIL_VERSION=$(grep "DEFAULT_HAIL_VERSION = '" analysis_runner/dataproc.py | awk -F\' '{print $2}')
-gcloud builds submit --timeout=1h --tag=australia-southeast1-docker.pkg.dev/analysis-runner/images/dataproc:hail-$HAIL_VERSION .
+HAIL_VERSION=$(grep "DEFAULT_HAIL_VERSION = '" ../analysis_runner/dataproc.py | awk -F\' '{print $2}')
+
+# if from repo root
+cd dataproc
+gcloud builds submit \
+  --timeout=1h \
+  --tag=australia-southeast1-docker.pkg.dev/analysis-runner/images/dataproc:hail-$HAIL_VERSION \
+  .
 ```
 
 ## Known Issues

web/Dockerfile

@@ -1,10 +1,11 @@
 FROM python:3.10-slim
 
 ENV PYTHONUNBUFFERED True
+WORKDIR /opt/app
 
 COPY requirements.txt ./
-RUN pip3 install -r requirements.txt
+RUN pip3 install --no-cache-dir --no-deps -r requirements.txt
 
 COPY main.py ./
 
-CMD exec gunicorn --bind :$PORT --workers 1 --threads 8 --timeout 0 main:app
+CMD ["exec", "gunicorn", "--bind", ":$PORT", "--workers", "1", "--threads", "8", "--timeout", "0", "main:app"]

web/main.py

@@ -5,12 +5,12 @@
 import logging
 import mimetypes
 import os
-from flask import Flask, abort, request, Response, stream_with_context
 
-from cpg_utils.cloud import read_secret, is_member_in_cached_group
-import google.cloud.storage
 import google.auth.transport.requests
+import google.cloud.storage
 import google.oauth2.id_token
+from cpg_utils.cloud import is_member_in_cached_group, read_secret
+from flask import Flask, Response, abort, request, stream_with_context
 
 ANALYSIS_RUNNER_PROJECT_ID = 'analysis-runner'
 
@@ -60,7 +60,11 @@ def handler(dataset=None, filename=None):
     if os.path.basename(filename) == '.access':
         return abort(403, 'Unable to read .access files')
 
-    server_config = json.loads(read_secret(ANALYSIS_RUNNER_PROJECT_ID, 'server-config'))
+    server_config_raw = read_secret(ANALYSIS_RUNNER_PROJECT_ID, 'server-config')
+    if not server_config_raw:
+        logger.exception('Failed to read server-config secret')
+        return abort(500, 'Failed to read server-config secret')
+    server_config = json.loads(server_config_raw)
     if dataset not in server_config:
         logger.warning(f'Invalid dataset "{dataset}"')
         return abort(403, 'Invalid dataset')

web/requirements.in

@@ -0,0 +1,7 @@
+cpg-utils==4.18.3
+cryptography==41.0.7
+flask==3.0.0
+gunicorn==21.2.0
+google-api-python-client==2.113.0
+google-cloud-storage==2.14.0
+google-cloud-secret-manager==2.17.0

web/requirements.txt

@@ -1,7 +1,172 @@
-cpg-utils==4.15.0
-cryptography==3.3.2
-flask==2.1.2
-gunicorn==20.1.0
-google-api-python-client==2.51.0
-google-cloud-storage==2.8.0
-google-cloud-secret-manager==2.11.1
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    pip-compile requirements.in
+#
+anyio==4.2.0
+    # via azure-core
+azure-core==1.29.6
+    # via azure-storage-blob
+azure-storage-blob==12.19.0
+    # via cloudpathlib
+blinker==1.7.0
+    # via flask
+boto3==1.28.56
+    # via
+    #   cloudpathlib
+    #   cpg-utils
+botocore==1.31.56
+    # via
+    #   boto3
+    #   cpg-utils
+    #   s3transfer
+cachetools==5.3.2
+    # via google-auth
+certifi==2023.11.17
+    # via requests
+cffi==1.16.0
+    # via cryptography
+charset-normalizer==3.3.2
+    # via requests
+click==8.1.7
+    # via flask
+cloudpathlib[all,azure,gs,s3]==0.17.0
+    # via cpg-utils
+cpg-utils==4.18.3
+    # via -r requirements.in
+cryptography==41.0.7
+    # via
+    #   -r requirements.in
+    #   azure-storage-blob
+flask==3.0.0
+    # via -r requirements.in
+frozendict==2.4.0
+    # via cpg-utils
+google-api-core[grpc]==2.15.0
+    # via
+    #   google-api-python-client
+    #   google-cloud-core
+    #   google-cloud-secret-manager
+    #   google-cloud-storage
+google-api-python-client==2.113.0
+    # via -r requirements.in
+google-auth==2.26.1
+    # via
+    #   cpg-utils
+    #   google-api-core
+    #   google-api-python-client
+    #   google-auth-httplib2
+    #   google-cloud-core
+    #   google-cloud-storage
+google-auth-httplib2==0.2.0
+    # via google-api-python-client
+google-cloud-core==2.4.1
+    # via google-cloud-storage
+google-cloud-secret-manager==2.17.0
+    # via
+    #   -r requirements.in
+    #   cpg-utils
+google-cloud-storage==2.14.0
+    # via
+    #   -r requirements.in
+    #   cloudpathlib
+google-crc32c==1.5.0
+    # via
+    #   google-cloud-storage
+    #   google-resumable-media
+google-resumable-media==2.7.0
+    # via google-cloud-storage
+googleapis-common-protos[grpc]==1.62.0
+    # via
+    #   google-api-core
+    #   grpc-google-iam-v1
+    #   grpcio-status
+grpc-google-iam-v1==0.13.0
+    # via google-cloud-secret-manager
+grpcio==1.60.0
+    # via
+    #   google-api-core
+    #   googleapis-common-protos
+    #   grpc-google-iam-v1
+    #   grpcio-status
+grpcio-status==1.60.0
+    # via google-api-core
+gunicorn==21.2.0
+    # via -r requirements.in
+httplib2==0.22.0
+    # via
+    #   google-api-python-client
+    #   google-auth-httplib2
+idna==3.6
+    # via
+    #   anyio
+    #   requests
+isodate==0.6.1
+    # via azure-storage-blob
+itsdangerous==2.1.2
+    # via flask
+jinja2==3.1.2
+    # via flask
+jmespath==1.0.1
+    # via
+    #   boto3
+    #   botocore
+markupsafe==2.1.3
+    # via
+    #   jinja2
+    #   werkzeug
+packaging==23.2
+    # via gunicorn
+proto-plus==1.23.0
+    # via google-cloud-secret-manager
+protobuf==4.25.1
+    # via
+    #   google-api-core
+    #   google-cloud-secret-manager
+    #   googleapis-common-protos
+    #   grpc-google-iam-v1
+    #   grpcio-status
+    #   proto-plus
+pyasn1==0.5.1
+    # via
+    #   pyasn1-modules
+    #   rsa
+pyasn1-modules==0.3.0
+    # via google-auth
+pycparser==2.21
+    # via cffi
+pyparsing==3.1.1
+    # via httplib2
+python-dateutil==2.8.2
+    # via botocore
+requests==2.31.0
+    # via
+    #   azure-core
+    #   google-api-core
+    #   google-cloud-storage
+rsa==4.9
+    # via google-auth
+s3transfer==0.7.0
+    # via boto3
+six==1.16.0
+    # via
+    #   azure-core
+    #   isodate
+    #   python-dateutil
+sniffio==1.3.0
+    # via anyio
+toml==0.10.2
+    # via cpg-utils
+typing-extensions==4.9.0
+    # via
+    #   azure-core
+    #   azure-storage-blob
+uritemplate==4.1.1
+    # via google-api-python-client
+urllib3==1.26.18
+    # via
+    #   botocore
+    #   requests
+werkzeug==3.0.1
+    # via flask