Retire the classic Python CLI and launch a new docs site

.github/workflows/ci.yml

@@ -95,5 +95,7 @@ jobs:
         run: PYTHONPATH=graybox:whitebox:triager python3 -m unittest discover -s graybox/tests -p 'test_*.py'
       - name: Platform unit tests
         run: PYTHONPATH=platform:graybox:whitebox:triager:bundle python3 -m unittest discover -s platform/tests -p 'test_*.py'
+      - name: Docs site builds
+        run: pip install -r docs/requirements.txt && python docs/build.py
       - name: Reporter unit tests
         run: PYTHONPATH=reporter:triager python3 -m unittest discover -s reporter/tests -p 'test_*.py'

.github/workflows/dev-push.yml

@@ -1,55 +1,31 @@
-name: "Build and Push Dev/main OWASP OFFAT Docker Images to DockerHub"
+name: "Build and push dev/main OWASP OFFAT image to Docker Hub"
 
 on:
   push:
     branches:
       - "main"
       - "dev"
 
+permissions:
+  contents: read
+
 jobs:
-  build-and-push-dev-docker-images:
+  build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - name: Branch Checkout
-        uses: actions/checkout@v2
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+      - uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Build and push offat-base docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/wolfi-base-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-base:${{ github.head_ref || github.ref_name }}
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/dev/cli-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat:${{ github.head_ref || github.ref_name }}
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat-api docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/dev/backend-api-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-api:${{ github.head_ref || github.ref_name }}
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat-api-worker docker image
-        uses: docker/build-push-action@v3
+      # One image: Rust execution engine + the Python platform (docker/Dockerfile).
+      - name: Build and push offat image
+        uses: docker/build-push-action@v6
         with:
-          context: ./src/
-          file: ./src/DockerFiles/dev/backend-api-worker-Dockerfile
+          context: .
+          file: ./docker/Dockerfile
           push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-api-worker:${{ github.head_ref || github.ref_name }}
+          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat:${{ github.ref_name }}
           platforms: linux/amd64,linux/arm64

.github/workflows/pages.yml

@@ -1,6 +1,6 @@
 name: docs
 
-# Build the documentation site (docs/, just-the-docs) and deploy it to
+# Build the documentation site (docs/build.py -> docs/_site) and deploy it to
 # GitHub Pages. Requires Pages "Build and deployment" source = GitHub Actions.
 on:
   push:
@@ -23,22 +23,20 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: docs
     steps:
       - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/setup-python@v5
         with:
-          ruby-version: "3.3"
-          bundler-cache: true
-          working-directory: docs
+          python-version: "3.12"
       - id: pages
         uses: actions/configure-pages@v5
-      - name: Build with Jekyll
-        run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
+      - name: Build the docs site
+        run: |
+          pip install -r docs/requirements.txt
+          python docs/build.py
         env:
-          JEKYLL_ENV: production
+          DOCS_BASE_PATH: ${{ steps.pages.outputs.base_path }}/
+          DOCS_SITE_URL: ${{ steps.pages.outputs.base_url }}/
       - uses: actions/upload-pages-artifact@v3
         with:
           path: docs/_site

.github/workflows/release-push.yml

@@ -1,88 +1,30 @@
-name: "Release: Build and Push OWASP OFFAT Docker Images to DockerHub"
+name: "Release: build and push OWASP OFFAT image to Docker Hub"
 
 on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
-  build-and-push-main-docker-images:
+  build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - name: Branch Checkout
-        uses: actions/checkout@v2
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
+      - uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      # Build and publish version tag image
-      - name: Build and push offat-base docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/wolfi-base-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-base:${{ github.event.release.tag_name }}
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/main/cli-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat:${{ github.event.release.tag_name }}
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat-api docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/main/backend-api-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-api:${{ github.event.release.tag_name }}
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat-api-worker docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/main/backend-api-worker-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-api-worker:${{ github.event.release.tag_name }}
-          platforms: linux/amd64,linux/arm64
-
-      # Build and publish latest tag image
-      - name: Build and push offat-base docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/wolfi-base-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-base:latest
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/main/cli-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat:latest
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat-api docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: ./src/
-          file: ./src/DockerFiles/main/backend-api-Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-api:latest
-          platforms: linux/amd64,linux/arm64
-      - name: Build and push offat-api-worker docker image
-        uses: docker/build-push-action@v3
+      - name: Build and push offat image (version + latest)
+        uses: docker/build-push-action@v6
         with:
-          context: ./src/
-          file: ./src/DockerFiles/main/backend-api-worker-Dockerfile
+          context: .
+          file: ./docker/Dockerfile
           push: true
-          tags: ${{ secrets.DOCKERHUB_USERNAME }}/offat-api-worker:latest
+          tags: |
+            ${{ secrets.DOCKERHUB_USERNAME }}/offat:${{ github.event.release.tag_name }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/offat:latest
           platforms: linux/amd64,linux/arm64

.gitignore

@@ -227,3 +227,6 @@ offat-report/
 
 # OFFAT runtime artifacts
 .offat-triage-cache.json
+
+# docs site build output
+docs/_site/

Makefile

@@ -17,8 +17,8 @@ engine-http3: ## Build the engine with the HTTP/3 + QUIC transport enabled
 engine-test: ## Run the engine's unit tests
 	cd engine-rs && cargo test
 
-platform-install: ## Install the Python platform + its libraries
-	pip install ./bundle ./triager ./whitebox ./graybox ./platform ./reporter
+platform-install: ## Install the platform + its libraries (with the code-graph extra)
+	pip install ./bundle ./triager "./whitebox[graph]" ./graybox ./platform ./reporter
 
 python-check: ## Byte-compile the Python packages
 	python3 -m compileall -q bundle/offat_bundle triager/offat_triage whitebox/offat_wb \
@@ -37,7 +37,7 @@ smoke: ## Offline end-to-end check (map -> prg -> threat-model -> test-gen)
 	  python3 -m offat_platform validate /tmp/offat-smoke.offat.json && echo "platform smoke OK"
 
 docker: ## Build the platform image (Rust engine + Python platform)
-	docker build -t offat-ai:latest -f docker/Dockerfile .
+	docker build -t offat:latest -f docker/Dockerfile .
 
 clean: ## Remove build artifacts and reports
 	rm -rf engine-rs/target offat-report /tmp/offat-smoke*.json