Run the Python the tests actually use - #8
Merged
Conversation
The image pinned python:3.12-slim while CI and every local environment ran 3.13. Every verification in the Sprint #3 audit — 71 tests, the production boot under a real DEBUG=False, gunicorn actually serving — was performed on a runtime this project does not deploy. The repository that moves money was tested on a Python it does not ship. The audit missed it. Its "not covered" section named live-exchange behaviour, concurrency and the API key's scope; none of those is this. The gap was nearer than any of them: the report never compared the runtime it tested against the runtime it ships. Found because Dependabot proposed 3.14-slim. Taken at face value that bump would have widened the divergence — container 3.14, tests 3.13 — so the useful answer was not the version it offered but the question it raised. Verified by building the image and running `python -V` inside it (3.13.14), rather than by reading the tag. The same check found Django-Pro-Template already consistent and django-users-app correctly shipping no container. Recorded as T-011 in the audit report, including that the audit did not find it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
docker/DockerFilemoves frompython:3.12-slimtopython:3.13-slim.Why
Every verification in the Sprint #3 audit — 71 tests, the production boot under a real
DEBUG=False, gunicorn actually serving — ran on 3.13. The container shipped 3.12. The repository that moves money was tested on a Python it does not deploy.The audit missed it
AUDIT_003has a Not covered section naming live-exchange behaviour, concurrency and the API key's scope. None of those is this. The gap was nearer than any of them: the report never compared the runtime it tested against the runtime it ships. Recorded as T-011, including that the audit did not find it.Found by declining a Dependabot bump
Dependabot proposed
3.14-slim. Taken at face value that would have widened the divergence — container 3.14, tests 3.13. The useful answer was not the version it offered but the question it raised.The same check found
Django-Pro-Templatealready consistent at 3.13 (its3.14-slimPR is closed for the same reason) anddjango-users-appcorrectly shipping no container at all.How it was verified
By building the image and running Python inside it, not by reading the tag:
The app also imports inside the container — Django 6.0.7,
binance-connectorpresent — which the image build alone does not prove.🤖 Generated with Claude Code