chore: pin at debian 12

[jgravois]

closes #71

i built the image locally and tested a handful of different benefits flows successfully

• benefits unit tests ✅
• self-serve littlepay CST agency card ✅
• self-serve littlepay CST medicare ✅
• self-serve switchio CST older adult ✅
• in-person littlepay/switchio CST 🚫 (i see the same errors on main)

/calitp/app/benefits/enrollment_littlepay/enrollment.py, line 76, in enroll
group_id = str(session.group(request).group_id) # needs to be a string for the API call
'NoneType' object has no attribute 'group_id'

if we have the appetite for bumping to python:3.14 while we're at it, just say the word. i definitely feel comfortable following the testing and follow-up steps outlined in #23 and #51 now and i'd be happy to verify that all is well in eligibility-server and complete the relevant follow-up steps.

[thekaveman]

Since you're here... what do you think about adding a docs guide page about the process for testing these kinds of updates (as you found in #23 (comment) and #53 (comment))

[jgravois]

what do you think about adding a docs guide page

i think its a good idea! i'm on the fence regarding whether to tackle a draft assuming the current state of affairs or do it more aspirationally (given #73).

[lalver1]

I think this is a good, immediate solution for the problem we are seeing in #71 👍

An alternative (or follow-up) that would probably take more effort, would be to run the check-migrations-and-messages.yml check in the CI like we do check-dynamic-version.yml, where we spin up a Docker container based on the Benefits image. I think this would give us exact reproducibility and avoid the issue described in #71, and it might alleviate the burden of keeping track of pinned image versions. At a first glance running Docker in a GitHub runner seemed weird like in this PR, but it's actually ok.

[jgravois]

interesting idea @lalver1! to be honest it didn't even occur to me that we could continue to use a hosted runner and rely on a container to give us the exact runtime we want. 🤯

i think there's value in pinning the major OS version in our containers regardless but i'm definitely on board with exploring your idea in earnest if we end up wanting to lay down trixie before a comparable Ubuntu version is available.

[jgravois]

just pushed up another commit to add the Guide @thekaveman requested. f2b4f0b

i don't think deploy previews are wired up in this repo, so here's a screenshot.

i'm keen to dogfood these steps and test out a Python 3.14 upgrade, but given that slush is coming to a close the prudent thing to do would probably be to save that as a stretch goal after (or simultaneous to) #73.

[Scotchester]

Thanks for the testing guide! Went through it all and everything seemed to work just fine. I've got a few suggestions for the new guide just to add a little clarity / reduce possible oversights.

[Scotchester]

A content suggestion, and a suggestion to make the command copyable. Doing so also requires adding content.code.copy to the theme.features. list in mkdocs.yml

(Also note that I can't include the closing triple backticks in this suggestion due to GitHub using them for the suggestion syntax itself.)

Suggested change

	- Rebuild the local image - `docker compose build app --no-cache`
	- From your `docker-python-web` repository, rebuild the local image:
	```bash
	docker compose build app --no-cache

[jgravois]

i dig it! a6815ba

[Scotchester]

Suggested change

	1. Update Benefits Dockerfile to use `docker-python-web:app`
	1. Update `appcontainer/Dockerfile` to use `docker-python-web:app` (remove the `ghcr.io/cal-itp/` and replace `main` with `app`)

[jgravois]

i went one step further and made this a block comment because it seemed helpful to show the exact string to search/replace. a6815ba

[Scotchester]

Suggested change

	1. Update eligibility-server Dockerfile to use `docker-python-web:app`
	1. Update `./Dockerfile` to use `docker-python-web:app` (remove the `ghcr.io/cal-itp/` and replace `main` with `app`)

[Scotchester]

Suggested change

	In your `eligibility-server` repository:

[Scotchester]

Uncertain if the rebuild I'm mentioning below needs to be without cache or not.

Suggested change

	1. Point Benefits compose.yml at local `eligibility_server:latest` image
	And confirm the update works in Benefits:
	1. Point Benefits `./compose.yml`'s `server` service at local `eligibility_server:latest` image
	1. Rebuild the devcontainer

[jgravois]

i've been seeing rebuilds fetch updated images even without blowing away the cache.

[jgravois]

thx @Scotchester. i liked all your suggestions and fixed the port forwarding while i was in there.

now that i'm writing this i realize i should update the README to make it clear where to look for the docs because i was as confused as you were initially.

[jgravois]

i should update the README

done in b6dbdd5. i snuck in a fix for file watching too 😈

[Scotchester]

Thanks, John!

[thekaveman]

Requesting that we come back to this post-Sprint

[thekaveman]

Sorry. I'm realizing this will probably be annoying for a number of the Sprint tickets we have around new agency group / regions pages that will have copy implications.

[jgravois]

note to self: try unpinning click and passing --live-reload here instead

docker-python-web/compose.yml

Line 29 in 8e28e38

command: serve --dev-addr "0.0.0.0:8001"

ref: squidfunk/mkdocs-material#8478

[thekaveman]

Found another (possible) reason this PR would be useful sooner than later: cal-itp/benefits#3563 (comment)

[jgravois]

Sorry. I'm realizing this will probably be annoying for a number of the Sprint tickets

all good. i agree there's value in landing this one as-is.

Found another (possible) reason this PR would be useful sooner than later

no idea why, but i didn't get notified that @thekaveman approved earlier this morning. sorry about that!

i pushed one last commit (08d0334) after realizing there's new guidance to get live reload working without having to pin 'click'.

[thekaveman]

The outer quotes shouldn't be necessary here

Suggested change

	command: 'serve --livereload --dev-addr "0.0.0.0:8001"'
	command: serve --livereload --dev-addr "0.0.0.0:8001"

[jgravois]

👍 less is more! 5241710

feedback addressed