always use python310

.github/workflows/release.yaml

@@ -17,41 +17,37 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: true
 
-      - run: echo "SHA=$(git show --no-patch --no-notes --date=short-local --pretty='%as-%h')" >> $GITHUB_ENV
-        env:
-          TZ: UTC
-
-      - name: Setup Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
 
       - name: Docker metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.IMAGE }}
           tags: |
-            type=ref,event=branch
-            type=sha,prefix={{branch}}-
-            type=ref,event=branch,suffix=-${{ env.SHA }}
+            type=semver,pattern=v{{version}}
 
-            type=raw,value=${{ env.SHA }}
+            type=ref,event=branch
+            type=ref,event=branch,suffix=-{{ sha }}
 
-      - uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Build Final Docker Image
         uses: docker/build-push-action@v6
         with:
           context: ./
-          builder: ${{ steps.buildx.output.name }}
           provenance: false
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          github-token: ${{ github.token }}

Dockerfile

@@ -1,25 +1,31 @@
+# syntax=docker/dockerfile:1@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
+
 ### convert poetry.lock to requirements.txt ###
-FROM python:3.11-slim AS poetry
+FROM python:3.10-slim@sha256:80619a5316afae7045a3c13371b0ee670f39bac46ea1ed35081d2bf91d6c3dbd AS poetry
 
 WORKDIR /app
-COPY . ./
-COPY pyproject.toml poetry.lock requirements-poetry.txt ./
 
-RUN pip install -r requirements-poetry.txt &&\
-  poetry export -f requirements.txt --output requirements.txt
+ENV PIP_ROOT_USER_ACTION=ignore
+
+COPY requirements-poetry.txt ./
+RUN pip install -r requirements-poetry.txt
+
+COPY pyproject.toml poetry.lock ./
+RUN poetry export -f requirements.txt --output requirements.txt
 
 ### final image ###
-FROM python:3.11-slim
+FROM python:3.10-slim@sha256:80619a5316afae7045a3c13371b0ee670f39bac46ea1ed35081d2bf91d6c3dbd
 
 WORKDIR /app
 
 ENV PYTHONPATH=/app
 
 COPY --from=poetry /app/requirements.txt ./requirements.txt
 
-RUN pip install -r requirements.txt --no-cache-dir
+ENV PIP_ROOT_USER_ACTION=ignore
 
-WORKDIR /app
+RUN pip install -U pip && \
+    pip install -r requirements.txt
 
 ENTRYPOINT [ "python", "./main.py" ]