fix: assemble a build context for uv path sources and pin the uv that resolves it (#56)

Two independent defects made this recipe emit an image build that resolved on
the developer's machine and failed inside the builder stage.

A `[tool.uv.sources]` path is resolved against the directory of the
pyproject.toml that declares it, and uv.lock records the same relative path. The
recipe's context was the service directory and nothing beside it, so a path
naming a sibling service was absent from the builder stage and `uv sync
--frozen` failed there with

    error: Could not compute absolute path from workspace root and lockfile path

Two services sharing one Python project in a repository is a layout this recipe
has to build. It now assembles a context when, and only when, a path leaves the
project: the service's own tree and each escaping target are placed at their
repository-relative paths under one root, and the builder stage's working
directory is the project's own path under it, so every relative path resolves
there to what it resolves to on the host. Nothing in pyproject.toml or uv.lock
is rewritten. Containment is the rule: a path leaving the repository, or naming
a directory that is not there, is reported with the declaration rather than
skipped, because a silently dropped source would build the image against a
different dependency than the developer builds against.

That build claims the whole tree it assembled (RECIPE_INVENTORY_SCOPE_TREE),
which is what roots the docker context at the assembled output; a build that
only renders a Dockerfile and its ignore still claims exactly those and still
builds the service directory.

Second, the builder stage ran whichever uv the base image had been built with,
a version stated nowhere a project or this agent can read. A project written
against a newer `[tool.uv]` key was diagnosed there as an unknown field — the
base image carries uv 0.5.29, measured, and that uv rejects
build-constraint-dependencies. A recipe meant to be durable and reproducible
cannot leave its resolver implicit, and the Go recipe already states its Go and
Alpine versions outright. The builder stage now copies a pinned uv in before
anything resolves.

Co-authored-by: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: antoinetoussaint-byte

AGENTS.md

@@ -112,6 +112,7 @@ anything from it.
 | `main.go` | settings, agent advertisement, composition of the generic Python layer |
 | `runtime.go` | Init/Start/Stop/Destroy, uvicorn supervision, hot reload, the lock order |
 | `builder.go` | `Create` scaffolding, OpenAPI endpoint loading, Docker + kustomize recipes |
+| `uvsources.go` | the assembled build context: `[tool.uv.sources]` paths leaving the project |
 | `probes.go`, `probe.py` | endpoint health translated to Kubernetes probes / a local probe |
 | `templates/` | **what ships** — embedded via `go:embed`, rendered on `Create` |
 | `base/` | a checked-in sample service, embedded nowhere |
@@ -135,6 +136,15 @@ into `templates/factory/code/pyproject.toml.tmpl` yourself.
 - **Readiness is the endpoint's declared health check, never an open port.**
   Probe intents (readiness / startup / liveness) stay separate through
   `resources.PlanEndpointProbes`; collapsing them silently drops a predicate.
+- **The build recipe owns its uv, and its build context.** The emitted
+  Dockerfile copies a pinned uv (`uvVersion` in `main.go`) rather than running
+  whichever one the base image was built with — a project written against a
+  newer `[tool.uv]` key otherwise resolves locally and fails in the builder
+  stage. And a `[tool.uv.sources]` path leaving the project makes the recipe
+  assemble its own context, mirroring the repository-relative layout so the
+  same relative path resolves there; that plan claims the whole tree
+  (`RECIPE_INVENTORY_SCOPE_TREE`), the Dockerfile-only one claims just what it
+  emitted. Never rewrite `pyproject.toml` or `uv.lock` to make a path resolve.
 - **The runtime image is pinned.** `docker-image` rejects a bare name and
   `:latest`. The default `codeflydev/python` companion is built by core and
   repinned on release — prefer it.

builder.go

@@ -167,6 +167,18 @@ type DockerTemplating struct {
 	Components      []string
 	RuntimePackages []string
 	Envs            []Env
+
+	// UVImage is the pinned uv distribution the builder stage copies its uv
+	// from, so the tool that reads pyproject.toml and uv.lock is a declared
+	// input of the recipe rather than whatever the base image was built with.
+	UVImage string
+
+	// ServicePrefix, ProjectWorkdir and Carried describe the build context.
+	// They are empty / defaulted when the recipe builds the service directory
+	// itself, which renders the Dockerfile this agent has always rendered.
+	ServicePrefix  string
+	ProjectWorkdir string
+	Carried        []CarriedSource
 }
 
 func (s *Builder) BuildCapabilities(context.Context, *builderv0.BuildCapabilitiesRequest) (*builderv0.BuildCapabilitiesResponse, error) {
@@ -183,19 +195,69 @@ func (s *Builder) Build(ctx context.Context, req *builderv0.BuildRequest) (*buil
 		return s.Base.Builder.BuildError(err)
 	}
 	ctx = s.Wool.Inject(ctx)
-	docker := DockerTemplating{
-		Builder:    runtimeImage.FullName(),
-		Components: requirements.All(),
-	}
 	outputDir := req.GetOutputDirectory()
 	emitted, err := services.PrepareRecipeDestination(builderFS, outputDir)
 	if err != nil {
 		return s.Base.Builder.BuildError(err)
 	}
+	// A `[tool.uv.sources]` path resolves against the project directory, and the
+	// default context is the service directory and nothing beside it: carry what
+	// leaves the project into an assembled context so the builder stage resolves
+	// what the host resolves. A service with no such path assembles nothing.
+	assembled, err := assembleUVContext(s.Location, s.SourceLocation, outputDir)
+	if err != nil {
+		return s.Base.Builder.BuildError(err)
+	}
+	docker := DockerTemplating{
+		Builder:        runtimeImage.FullName(),
+		Components:     requirements.All(),
+		UVImage:        uvImage,
+		ProjectWorkdir: defaultProjectWorkdir,
+	}
+	if assembled != nil {
+		docker.ServicePrefix = assembled.ServicePrefix
+		docker.ProjectWorkdir = assembled.ProjectWorkdir
+		docker.Carried = assembled.Carried
+	}
 	if err := s.Base.Templates(ctx, docker, services.WithBuilder(builderFS).WithDestination("%s", outputDir)); err != nil {
 		return s.Base.Builder.BuildError(err)
 	}
-	return s.Base.Builder.SingleImageBuildResponse(req, s.DockerImage(dockerRequest).FullName(), emitted)
+	image := s.DockerImage(dockerRequest).FullName()
+	if assembled == nil {
+		// Only the Dockerfile and its ignore were written, and the application's
+		// inputs are the service's own tree: the plan claims what it emitted and
+		// the caller builds the service directory.
+		return s.Base.Builder.SingleImageBuildResponse(req, image, emitted)
+	}
+	// The whole destination was assembled by this build, so the plan claims all
+	// of it and the caller builds the assembled tree rather than the service
+	// directory — which is what RECIPE_INVENTORY_SCOPE_TREE declares.
+	plan, err := services.BuildDockerBuildPlan(outputDir, []*builderv0.DockerBuildRecipe{{
+		Name:         "app",
+		Dockerfile:   "Dockerfile",
+		Context:      ".",
+		Dockerignore: dockerignoreOf(emitted),
+		Image:        image,
+		Platforms:    services.RecipeBuildPlatforms(),
+	}})
+	if err != nil {
+		return s.Base.Builder.BuildError(err)
+	}
+	s.Base.Builder.WithBuildPlan(plan)
+	return s.Base.Builder.BuildResponse()
+}
+
+// dockerignoreOf names the ignore file only when this build rendered one.
+// Probing the destination instead would adopt a stale file: the executor copies
+// the referenced ignore to the path buildx discovers, so one left behind by an
+// older template set would silently keep files out of the image.
+func dockerignoreOf(emitted []string) string {
+	for _, name := range emitted {
+		if name == "dockerignore" {
+			return name
+		}
+	}
+	return ""
 }
 
 // SBOM serves both evidence scopes. Source inventory stays with the generic

go.mod

@@ -5,6 +5,7 @@ go 1.27.0
 require (
 	github.com/codefly-dev/core v0.5.1
 	github.com/codefly-dev/service-python v0.0.66
+	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/stretchr/testify v1.12.1
 	google.golang.org/grpc v1.83.2
 	gopkg.in/yaml.v3 v3.0.1
@@ -92,7 +93,6 @@ require (
 	github.com/oklog/ulid/v2 v2.1.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect

main.go

@@ -94,6 +94,26 @@ type Settings struct {
 // other codefly-built image.
 var runtimeImage = &resources.DockerImage{Name: "codeflydev/python", Tag: "0.0.1"}
 
+// uvVersion is the uv the emitted build recipe resolves its lockfile with.
+//
+// The base image carries a uv of its own, installed when that image was built
+// and stated nowhere a project or this agent can read. A build recipe is meant
+// to be durable and reproducible, and a recipe whose resolver version is a
+// property of its base image is neither: a project written against a newer
+// `[tool.uv]` key resolves on the developer's machine and fails inside the
+// builder stage with a TOML parse error naming a field the older uv does not
+// know. Pinning it here is the same contract the Go recipe already keeps for
+// its own toolchain, which states its Go and Alpine versions outright.
+//
+// Bump it deliberately, together with uvImage.
+const uvVersion = "0.12.16"
+
+// uvImage is the distribution the builder stage copies that uv from. astral
+// publishes each release as a multi-architecture image holding the static
+// binary, so the copy needs no package manager and no network beyond the
+// registry the build already talks to.
+const uvImage = "ghcr.io/astral-sh/uv:" + uvVersion
+
 // Service is the FastAPI specialization. It embeds the generic Python
 // Service so methods defined on *pythonservice.Service (and transitively
 // *services.Base: Wool, Logger, Location, Identity, …) are promoted.

templates/builder/Dockerfile.tmpl

@@ -1,12 +1,29 @@
 # The builder image — installs the venv via uv, then we copy it into the runtime.
 FROM {{.Builder}} as builder
 
-WORKDIR /app
-
-COPY code/pyproject.toml code/uv.lock ./
-
-# Install deps to a project-local .venv. --frozen requires uv.lock to match
-# pyproject.toml; this catches drift at build time rather than at runtime.
+# uv is part of what the recipe has to state. A base image carries whichever uv
+# it happened to be built with, so a project written against a newer `[tool.uv]`
+# key resolves on the developer's machine and fails inside the builder stage
+# with a TOML parse error naming a field that uv there does not know. Copying a
+# pinned uv in makes the tool that reads pyproject.toml and uv.lock a declared
+# input of the recipe instead of a property of the base image.
+COPY --from={{.UVImage}} /uv /usr/local/bin/uv
+
+WORKDIR {{.ProjectWorkdir}}
+
+COPY {{.ServicePrefix}}code/pyproject.toml {{.ServicePrefix}}code/uv.lock ./
+{{- if .Carried}}
+
+# A `[tool.uv.sources]` path leaving the project, placed at the same
+# repository-relative path the developer resolves it from, so the directive and
+# the lockfile entry that record it resolve here to what they resolve to there.
+{{- range .Carried}}
+COPY {{.Context}} {{.Image}}
+{{- end}}
+{{- end}}
+
+# Install deps to a project-local .venv. --frozen installs the locked resolution
+# as it stands instead of re-resolving it at build time.
 ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
     UV_LINK_MODE=copy
 RUN uv sync --frozen --no-dev --no-install-project
@@ -27,10 +44,10 @@ ENV VIRTUAL_ENV=/app/.venv \
 
 COPY --from=builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
 
-COPY --chown=appuser service.codefly.yaml .
+COPY --chown=appuser {{.ServicePrefix}}service.codefly.yaml .
 
 {{ range .Components}}
-COPY --chown=appuser {{.}} {{.}}
+COPY --chown=appuser {{$.ServicePrefix}}{{.}} {{.}}
 {{end}}
 
 {{ range .Envs}}