Update Python dependencies

This updates Alpine to 3.15 as well to help with the cryptography wheel
building which requires Rust.

.github/workflows/ci.yml

@@ -29,10 +29,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.0.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v1.2.0
 
       - id: prep
         name: Set up tag name
@@ -41,10 +41,10 @@ jobs:
           echo ::set-output name=tag::${GITHUB_REF#refs/tags/v}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v1.7.0
 
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@v3.0.2
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -53,14 +53,14 @@ jobs:
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v1.14.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push latest
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v2.10.0
         with:
           context: .
           file: ./Dockerfile
@@ -76,7 +76,7 @@ jobs:
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
 
       - name: Build and push ARMv7
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v2.10.0
         with:
           context: .
           file: ./Dockerfile
@@ -92,7 +92,7 @@ jobs:
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
 
       - name: Build and push ARMv6
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v2.10.0
         with:
           context: .
           file: ./Dockerfile

Dockerfile

@@ -6,24 +6,27 @@ COPY static/public ./public
 RUN npm install
 RUN PUBLIC_URL=/build npm run build
 
-FROM python:3.9.5-alpine3.12
+FROM python:3.9.12-alpine3.15
 WORKDIR /tmp
 COPY poetry.lock ./
 COPY pyproject.toml ./
 COPY feeder/ ./feeder
 COPY --from=frontend-build /tmp/build ./static/build
 COPY alembic.ini ./
 COPY README.md ./
+# This has a hack with pip to get around the fact that poetry doesn't handle extra index URLs correctly yet
 RUN apk add --no-cache --virtual .build-deps \
         build-base \
         libffi-dev \
         openssl-dev \
         py3-pip \
         python3-dev \
         git \
+        jq \
     && python -m pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir poetry cryptography==3.3.2 \
-    && poetry install --no-dev -v\
+    && pip install --no-cache-dir poetry yq --extra-index-url https://www.piwheels.org/simple \
+    && cat poetry.lock | tomlq -r '.package[] | select(.category == "main") | select(.source == null) | "\(.name)==\(.version)"' | xargs poetry run pip install --no-cache-dir --extra-index-url https://www.piwheels.org/simple \
+    && poetry install --no-dev -v \
     && apk del .build-deps \
     && rm -rf ~/.cache/pip \
     && rm -rf ~/.cache/pypoetry/{cache,artifacts}