The published image can't run jobs or push: prometheus-client, defusedxml and zeroconf aren't installed

claude-bot commented

2026-09-26 10:22:20 +00:00

Collaborator

Bug (critical)

Verified against the published git.rhoving.com/rbrooks/iris-wled:1.1.1 image:

prometheus_client MISSING ModuleNotFoundError
defusedxml MISSING ModuleNotFoundError
zeroconf MISSING ModuleNotFoundError
app.services.metrics FAILS: ModuleNotFoundError No module named 'prometheus_client'

schedule_service.log_run (so every scheduler job) and wled_push._try_push (every WLED push) import app.services.metrics without a guard. A container from this image starts and passes its health check, but can't run the on/off jobs or push to the lights. Off-site S3 backup (defusedxml) and controller discovery (zeroconf) are broken too. This affects 1.1.0 and 1.1.1; the production deploy (Rhoving/iac-repo#527) is on hold.

Found by the delegate building #154, and then confirmed against the registry image.

Cause

The Dockerfile installs from backend/requirements.txt, a hand-kept copy of pyproject.toml's dependencies. It was not updated when #15 (metrics), #18 (off-site backup) and #50 (discovery) added dependencies to pyproject.toml. It also installs pytest and respx into the production image. And audit.yml runs pip-audit -r requirements.txt, so the weekly dependency audit has been auditing the wrong set as well.

It's the same class of bug as #147: two lists that nothing keeps in step.

Why CI didn't catch it

Tests run from uv sync (so everything is installed), and the E2E container never runs a scheduler job or pushes to a controller. The image's health endpoint doesn't import metrics.

Fix

The image installs from uv.lock, via uv export --frozen --no-dev with hashes, so the image is byte-for-byte the locked set. requirements.txt is deleted, so there's no second list left to drift.
audit.yml audits the same exported set.
A CI smoke step imports every app.* module inside the built image, so any runtime import that the image can't satisfy fails the build.
Released as v1.1.2 from a release/1.1.x branch cut at v1.1.1, because main already has unreleased v1.2.0 features. The same fix goes to main.

## Bug (critical) Verified against the published `git.rhoving.com/rbrooks/iris-wled:1.1.1` image: ``` prometheus_client MISSING ModuleNotFoundError defusedxml MISSING ModuleNotFoundError zeroconf MISSING ModuleNotFoundError app.services.metrics FAILS: ModuleNotFoundError No module named 'prometheus_client' ``` `schedule_service.log_run` (so every scheduler job) and `wled_push._try_push` (every WLED push) import `app.services.metrics` without a guard. A container from this image starts and passes its health check, but **can't run the on/off jobs or push to the lights.** Off-site S3 backup (`defusedxml`) and controller discovery (`zeroconf`) are broken too. This affects 1.1.0 and 1.1.1; the production deploy (Rhoving/iac-repo#527) is on hold. Found by the delegate building #154, and then confirmed against the registry image. ## Cause The Dockerfile installs from `backend/requirements.txt`, a hand-kept copy of `pyproject.toml`'s dependencies. It was not updated when #15 (metrics), #18 (off-site backup) and #50 (discovery) added dependencies to `pyproject.toml`. It also installs `pytest` and `respx` into the production image. And `audit.yml` runs `pip-audit -r requirements.txt`, so the weekly dependency audit has been auditing the wrong set as well. It's the same class of bug as #147: two lists that nothing keeps in step. ## Why CI didn't catch it Tests run from `uv sync` (so everything is installed), and the E2E container never runs a scheduler job or pushes to a controller. The image's health endpoint doesn't import metrics. ## Fix - **The image installs from `uv.lock`,** via `uv export --frozen --no-dev` with hashes, so the image is byte-for-byte the locked set. `requirements.txt` is deleted, so there's no second list left to drift. - **`audit.yml`** audits the same exported set. - **A CI smoke step imports every `app.*` module inside the built image,** so any runtime import that the image can't satisfy fails the build. - **Released as v1.1.2** from a `release/1.1.x` branch cut at `v1.1.1`, because `main` already has unreleased v1.2.0 features. The same fix goes to `main`.

rbrooks referenced this issue from a commit

2026-09-26 10:38:43 +00:00

Install the image's dependencies from uv.lock, so it can run its own jobs (#173)

rbrooks referenced this issue from a commit

2026-09-26 10:41:58 +00:00

Install the image's dependencies from uv.lock, so it can run its own jobs (#173)

claude-bot referenced this issue from a pull request that will close it,

2026-09-26 10:42:24 +00:00

Install the image's dependencies from uv.lock, so it can run its own jobs (#173) #174

claude-bot added the

labels

2026-09-26 10:43:28 +00:00

rbrooks referenced this issue from a commit

2026-09-26 10:55:35 +00:00

Install the image's dependencies from uv.lock, so it can run its own jobs (#173)

claude-bot closed this issue

2026-09-26 11:06:19 +00:00

claude-bot referenced this issue from a commit

2026-09-26 11:06:19 +00:00

Install the image's dependencies from uv.lock, so it can run its own jobs (#173) (#174)

claude-bot commented

2026-09-26 11:06:47 +00:00

Author

Collaborator

Fixed and released.

v1.1.2 (tag on release/1.1.x, cut from v1.1.1) is published as sha256:6a5c1fb5…. :1.1.2, :1.1 and :latest all point to it.
- Checked against the published image: every app.* module imports, and prometheus_client, defusedxml and zeroconf are present.
- pytest and respx are gone.
- schedule_service.log_run succeeds in a read-only, cap-dropped container. On 1.1.1 it raises ModuleNotFoundError.
main: #174 (squash-merged, CI green). The build installs the locked set exported from uv.lock with hashes, requirements.txt is deleted, audit.yml audits the same export, and the new CI step imports every app module inside the built image.
Production: Rhoving/iac-repo#527 now pins 1.1.2, and its hold is lifted.

Known limit: zeroconf is imported inside a function, so the import sweep can't detect its absence. It's installed from the lock now regardless.

Note: CI doesn't run on release/* branches, so the 1.1.2 image was verified by hand. A follow-up could extend ci.yml's triggers to release/**.

Fixed and released. - **v1.1.2** (tag on `release/1.1.x`, cut from `v1.1.1`) is published as `sha256:6a5c1fb5…`. `:1.1.2`, `:1.1` and `:latest` all point to it. - Checked against the **published** image: every `app.*` module imports, and `prometheus_client`, `defusedxml` and `zeroconf` are present. - `pytest` and `respx` are gone. - `schedule_service.log_run` succeeds in a read-only, cap-dropped container. On 1.1.1 it raises `ModuleNotFoundError`. - **`main`:** #174 (squash-merged, CI green). The build installs the locked set exported from `uv.lock` with hashes, `requirements.txt` is deleted, `audit.yml` audits the same export, and the new CI step imports every app module inside the built image. - **Production:** Rhoving/iac-repo#527 now pins 1.1.2, and its hold is lifted. **Known limit:** `zeroconf` is imported inside a function, so the import sweep can't detect its absence. It's installed from the lock now regardless. **Note:** CI doesn't run on `release/*` branches, so the 1.1.2 image was verified by hand. A follow-up could extend `ci.yml`'s triggers to `release/**`.

claude-bot referenced this issue

2026-09-26 11:18:57 +00:00

Install Iris on a phone and get its alerts there (#154) #178

claude-bot referenced this issue

2026-09-26 11:28:34 +00:00

Installable app with push notifications (PWA) #154

~~claude-bot referenced this issue 2026-09-26 11:48:16 +00:00~~

Show what the lights used and cost this season (#153), and keep Settings edits until saved (#181) #180