indygreg standalone python builds

.github/workflows/docker-publish.yml

@@ -22,11 +22,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - python-version: 3.12.2 # renovate: python
+          - python-version: 3.12.1 # renovate: indygreg-python
             output-tags: |
               type=raw,value=latest
               type=raw,value=3.12
-          - python-version: 3.11.8 # renovate: python
+          - python-version: 3.11.7 # renovate: indygreg-python
             output-tags: |
               type=raw,value=3.11
 
@@ -87,7 +87,7 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: |
-            PYTHON_VERSION=${{ matrix.python-version }}
+            PYTHON_RUNTIME_VERSION=${{ matrix.python-version }}
 
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker

Dockerfile

@@ -5,17 +5,17 @@ ARG TARGETARCH
 
 # python
 # renovate: datasource=custom.setup-python depName=python
-ARG PYTHON_VERSION=3.12.2
+ARG PYTHON_RUNTIME_VERSION=3.12.1
+# renovate: datasource=github-releases depName=indygreg/python-build-standalone
+ARG PYTHON_BUILD_VERSION=20240107
 COPY python.sh .
 RUN ./python.sh && rm python.sh
 ENV PATH="/python/bin:$PATH"
 
 # poetry
 # renovate: datasource=github-releases depName=python-poetry/poetry
 ARG POETRY_VERSION=1.7.1
-ENV POETRY_HOME="/poetry"
-RUN curl -sSL https://install.python-poetry.org | python3 -
-ENV PATH="$POETRY_HOME/bin:$PATH"
+RUN pip3 install --no-cache-dir "poetry==${POETRY_VERSION}"
 
 # yq
 # renovate: datasource=github-releases depName=mikefarah/yq

python.sh

@@ -1,23 +1,17 @@
 #!/bin/sh -xe
-MANIFEST_URL=https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json
-
-ARCH=$TARGETARCH
-if [ "$ARCH" = "amd64" ]; then
-    ARCH=x64
+VERSION=${PYTHON_RUNTIME_VERSION}+${PYTHON_BUILD_VERSION}
+if [ "$TARGETARCH" = "amd64" ]; then
+    TARGET=x86_64-unknown-linux-gnu
+    CONFIG=pgo+lto
+elif [ "$TARGETARCH" = "arm64" ]; then
+    TARGET=aarch64-unknown-linux-gnu
+    CONFIG=lto
 fi
+FLAVOR=full
 
-ARCHIVE_URL=$(
-    curl $MANIFEST_URL |
-    jq -r ".[]
-        | select(.version == \"${PYTHON_VERSION}\")
-        | .files[]
-        | select(.arch == \"${ARCH}\" and .platform_version == \"${LSB_RELEASE}\")
-        | .download_url"
-)
-
-wget $ARCHIVE_URL -O python.tar.gz
-mkdir -p /python
-tar xvzf python.tar.gz -C /python
-(cd /python && bash setup.sh)
+DISTRIB=cpython-${VERSION}-${TARGET}-${CONFIG}-${FLAVOR}
 
-rm -rf python.tar.gz /python/*.tgz
+wget https://github.com/indygreg/python-build-standalone/releases/download/${PYTHON_BUILD_VERSION}/${DISTRIB}.tar.zst
+tar xvf ${DISTRIB}.tar.zst
+mv python/install /python
+rm -rf ${DISTRIB}.tar.zst python

renovate.json

@@ -21,17 +21,17 @@
       "customType": "regex",
       "fileMatch": [".*\\.ya?ml$"],
       "matchStrings": [
-        "(?<currentValue>\\S+) # renovate: python(?: extractVersion=(?<extractVersion>\\S+))?"
+        "(?<currentValue>\\S+) # renovate: indygreg-python(?: extractVersion=(?<extractVersion>\\S+))?"
       ],
       "depNameTemplate": "python",
-      "datasourceTemplate": "custom.setup-python"
+      "datasourceTemplate": "custom.indygreg-python"
     }
   ],
   "customDatasources": {
-    "setup-python": {
-      "defaultRegistryUrlTemplate": "https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json",
+    "indygreg-python": {
+      "defaultRegistryUrlTemplate": "https://api.github.com/repos/indygreg/python-build-standalone/releases/latest",
       "transformTemplates": [
-        "{\"releases\": $map($, function($v) { { \"version\": $v.version } }) }"
+        "($matcher := /[^-]+-([^+]+)\\+([^-]+)/; {\"releases\": $map($.assets, function($v) { ($g := $matcher($v.name).groups; {\"version\": $g[0], \"digest\": $g[1]}) })})"
       ]
     }
   }