fix: ship every top-level package of the project in the image

A service run from source (`uv run uvicorn src.main:app` in code/) can
import any package beside src: uvicorn puts code/ on sys.path and uv
installs the project. The image installs dependencies only
(`uv sync --no-install-project`) and copied code/src alone, so a service
with a sibling package passed every local run and died in the container
with ModuleNotFoundError.

The recipe now copies code/src and every other directory in code/ that
holds __init__.py, leaving out the scaffolded tests tree, build outputs
and tool caches.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: antoinetoussaint-byte

build_recipe_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"strings"
 	"testing"
 	"time"
 
@@ -152,3 +153,48 @@ func TestBuildRejectsInvalidOutputDirectoryBeforePreparation(t *testing.T) {
 		})
 	}
 }
+
+// A package beside code/src is importable when the service runs from source —
+// uvicorn runs from code/ and uv installs the project — so the image has to
+// ship it too, or the service passes every local run and dies in the container
+// with ModuleNotFoundError. The test tree, build outputs, tool caches and
+// directories that are not packages stay out.
+func TestBuildShipsSiblingPackages(t *testing.T) {
+	builder, _ := createdBuilder(t)
+	code := builder.Local("code")
+	for _, file := range []string{
+		"model_service/__init__.py",
+		"model_service/hosted.py",
+		"adapters/__init__.py",
+		".venv/lib/__init__.py",
+		"__pycache__/stale/__init__.py",
+		".hidden/__init__.py",
+		"fixtures/data.json",
+	} {
+		require.NoError(t, os.MkdirAll(path.Dir(path.Join(code, file)), 0o755))
+		require.NoError(t, os.WriteFile(path.Join(code, file), nil, 0o600))
+	}
+	require.FileExists(t, path.Join(code, "tests", "__init__.py"))
+
+	outputDir := t.TempDir()
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+	resp, err := recipeClient(t, builder).Build(ctx, recipeBuildRequest(outputDir))
+	require.NoError(t, err)
+	require.Equal(t, builderv0.BuildStatus_SUCCESS, resp.GetState().GetState(), resp.GetState().GetMessage())
+
+	content, err := os.ReadFile(path.Join(outputDir, "Dockerfile"))
+	require.NoError(t, err)
+	dockerfile := string(content)
+	var copies []string
+	for _, line := range strings.Split(dockerfile, "\n") {
+		if strings.HasPrefix(line, "COPY --chown=appuser code/") {
+			copies = append(copies, line)
+		}
+	}
+	require.Equal(t, []string{
+		"COPY --chown=appuser code/src code/src",
+		"COPY --chown=appuser code/adapters code/adapters",
+		"COPY --chown=appuser code/model_service code/model_service",
+	}, copies)
+}

builder.go

@@ -6,6 +6,10 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
 
 	"github.com/codefly-dev/core/agents/communicate"
 	"github.com/codefly-dev/core/agents/services"
@@ -208,9 +212,13 @@ func (s *Builder) Build(ctx context.Context, req *builderv0.BuildRequest) (*buil
 	if err != nil {
 		return s.Base.Builder.BuildError(err)
 	}
+	components, err := imageComponents(s.SourceLocation)
+	if err != nil {
+		return s.Base.Builder.BuildError(err)
+	}
 	docker := DockerTemplating{
 		Builder:        runtimeImage.FullName(),
-		Components:     requirements.All(),
+		Components:     components,
 		UVImage:        uvImage,
 		ProjectWorkdir: defaultProjectWorkdir,
 	}
@@ -247,6 +255,61 @@ func (s *Builder) Build(ctx context.Context, req *builderv0.BuildRequest) (*buil
 	return s.Base.Builder.BuildResponse()
 }
 
+// testsPackage is the test tree Create scaffolds beside src. It is importable
+// locally but is not part of the application, so the image does not ship it.
+const testsPackage = "tests"
+
+// imageComponents is every service-relative source tree the runtime stage
+// copies: code/src, which uvicorn imports the app from, and every other
+// top-level Python package in the project directory.
+//
+// Locally the service runs as `uv run uvicorn src.main:app` from code/, so
+// every package beside src is importable twice over — from the working
+// directory uvicorn puts on sys.path, and from the project uv installs. The
+// image installs dependencies only (`uv sync --no-install-project`) and runs
+// from /app/code, so a sibling package it does not copy is a service that
+// passes every local run and dies in the container with ModuleNotFoundError.
+// Copying each package keeps the working directory the one thing that makes
+// them importable in both places.
+//
+// A package is a directory holding __init__.py. Build outputs and tool caches
+// are never packages of the application, and neither is the test tree.
+func imageComponents(sourceDir string) ([]string, error) {
+	components := requirements.All()
+	shipped := map[string]bool{}
+	for _, component := range components {
+		shipped[component] = true
+	}
+	entries, err := os.ReadDir(sourceDir)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list the Python project at %s: %w", sourceDir, err)
+	}
+	var packages []string
+	for _, entry := range entries {
+		name := entry.Name()
+		if !entry.IsDir() || name == testsPackage || ephemeralSourceDirectories[name] || strings.HasPrefix(name, ".") {
+			continue
+		}
+		component := path.Join(filepath.Base(sourceDir), name)
+		if shipped[component] {
+			continue
+		}
+		marker, err := os.Stat(filepath.Join(sourceDir, name, "__init__.py"))
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		if !marker.Mode().IsRegular() {
+			continue
+		}
+		packages = append(packages, component)
+	}
+	sort.Strings(packages)
+	return append(components, packages...), nil
+}
+
 // dockerignoreOf names the ignore file only when this build rendered one.
 // Probing the destination instead would adopt a stale file: the executor copies
 // the referenced ignore to the path buildx discovers, so one left behind by an