From dacf047b8e697d3805049bdf27a6743e535bc44d Mon Sep 17 00:00:00 2001
From: Aleksander Sekowski <aleksander@uixlimited.com>
Date: Sat, 25 Jul 2026 22:07:21 -0700
Subject: [PATCH] Make infra Dockerfile buildable: install git, drop the masked
 deps layer

Three defects kept infra/docker/Dockerfile from building since the
iab-agentic-primitives git dependency landed:

1. Neither stage installs git, so pip aborts with "Cannot find command
   'git'" at the first install (the Docker Build CI job fails exactly
   there). git is now installed in the builder.
2. The "cache-friendly" layer ran pip install -e . with only
   pyproject.toml copied and masked the outcome with 2>/dev/null; true.
   An editable hatchling build cannot succeed without the source tree,
   so the layer installed nothing and silently hid every failure. The
   layer is removed; one honest install runs after COPY.
3. The runtime stage re-ran a full pip install -e ., re-resolving all
   dependencies (and needing git again) even though the builder venv is
   copied wholesale. It now uses --no-deps to just re-point the
   editable install at /app.

Building still requires access to the private iab-agentic-primitives
repo; that remaining blocker is tracked separately.
---
 infra/docker/Dockerfile | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/infra/docker/Dockerfile b/infra/docker/Dockerfile
index 22a0f993..da5856c7 100644
--- a/infra/docker/Dockerfile
+++ b/infra/docker/Dockerfile
@@ -12,23 +12,22 @@ FROM python:3.12-slim AS builder
 
 WORKDIR /build
 
+# git is required: pyproject declares a git dependency (iab-agentic-primitives)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
+    git \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy only dependency metadata first (cache-friendly)
-COPY pyproject.toml ./
-
-# Install dependencies into a virtual env so we can copy it cleanly
+# Install everything into a virtual env so we can copy it cleanly.
+# No separate dependency layer: an editable hatchling build needs the
+# source tree present, so a pyproject-only install cannot succeed and
+# would only mask failures.
 RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 
-RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir -e . 2>/dev/null; true
-
-# Now copy source and install the package itself
 COPY . .
-RUN pip install --no-cache-dir -e .
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -e .
 
 # ---------------------------------------------------------------------------
 # Stage 2 — Runtime
@@ -53,8 +52,9 @@ COPY --from=builder /build/src ./src
 COPY --from=builder /build/pyproject.toml ./
 COPY --from=builder /build/README.md ./
 
-# Install the package in the runtime venv
-RUN pip install --no-cache-dir -e .
+# Re-point the editable install at /app; dependencies already live in the
+# copied venv, so skip resolution (which would also need git at runtime)
+RUN pip install --no-cache-dir --no-deps -e .
 
 # Create data directory for SQLite (owned by non-root user)
 RUN mkdir -p /app/data && chown buyer:buyer /app/data