chore: upgrade containers to python 3.13

[ironcommit]

Summary

Upgrades the container build infrastructure from a hardcoded Python 3.11 base image to Python 3.13, making the Python version configurable via build arguments.

Changes

• docker/base/Dockerfile.nmp-python-base: Replace hardcoded python:3.11.15-slim-bookworm base image with a configurable NMP_PYTHON_IMAGE arg (defaulting to python:3.13.14-slim-trixie). The uv venv call now uses NMP_PYTHON_VERSION instead of a hardcoded 3.11.
• docker/Dockerfile.nmp-api and docker/Dockerfile.nmp-core: Parameterize the policy.wasm COPY path to use NMP_PYTHON_VERSION instead of hardcoded python3.11, so the asset is placed in the correct site-packages directory for the selected interpreter.
• docker-bake.hcl: Add NMP_PYTHON_IMAGE and NMP_PYTHON_VERSION variables and pass them to all base image targets (nmp-python-base, nmp-python-dev-base, and their builder variants) as well as nmp-api-docker and nmp-core-docker.

Notes

• Defaults are set to Python 3.13 throughout; no CI or build config changes are needed for the default path.
• The Python version can be overridden at build time by setting NMP_PYTHON_IMAGE and NMP_PYTHON_VERSION in the bake invocation.

Summary by CodeRabbit

• New Features

  • Docker images now support configurable Python versions, defaulting to Python 3.13.
  • Python runtime paths and virtual environments are generated for the selected version.

• Bug Fixes

  • Updated packaged authentication assets to use the configured Python installation path.

• Maintenance

  • Simplified development image toolchain setup by removing fixed GCC 11 configuration.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Python Docker builds now accept a configurable Python version, use matching base images and virtual environments, and place runtime assets in version-specific site-packages paths. Docker Bake forwards the parameter to Python base, API, and core targets.

Changes

Python Docker Configuration

Layer / File(s)	Summary
Bake parameter wiring docker-bake.hcl	Defines NMP_PYTHON_VERSION, updates the Python base tag default, and forwards the version to Python base, API, and core build targets.
Python base selection and virtual environment docker/base/Dockerfile.nmp-python-base	Uses the configured Python slim image and virtual environment interpreter, and removes explicit g++-11 installation and gcc alternatives configuration.
Runtime policy asset paths docker/Dockerfile.nmp-api, docker/Dockerfile.nmp-core	Redeclares the Python version in runtime stages and copies policy.wasm into the matching Python site-packages directory.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: upgrading containers to Python 3.13.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch upgrade-nmp-api-python-313/rsadler

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker-bake.hcl`:
- Around line 39-45: Update the docker-bake.hcl configuration around
NMP_PYTHON_IMAGE, NMP_PYTHON_VERSION, and python_base_target() so the selected
base image and interpreter version cannot drift. Prefer deriving the Python
version from the image or add a build-time validation that rejects mismatches
before building, ensuring the venv layout and policy.wasm destination remain
aligned with the active site-packages path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 23829f6d-90c5-4ad6-825e-c22fa35d6af4

📥 Commits

Reviewing files that changed from the base of the PR and between 7662279 and f3bb22f.

📒 Files selected for processing (4)

• docker-bake.hcl
• docker/Dockerfile.nmp-api
• docker/Dockerfile.nmp-core
• docker/base/Dockerfile.nmp-python-base

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker-bake.hcl`:
- Around line 39-42: Define an NMP_PYTHON_IMAGE bake variable with default
python:3.13.14-slim-trixie, and update all four base targets to use this
variable unchanged instead of constructing an image from NMP_PYTHON_VERSION.
Preserve NMP_PYTHON_VERSION only where independently needed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 70019ad1-74ec-41e7-9901-da6e66895740

📥 Commits

Reviewing files that changed from the base of the PR and between f3bb22f and 5ed7b22.

📒 Files selected for processing (4)

• docker-bake.hcl
• docker/Dockerfile.nmp-api
• docker/Dockerfile.nmp-core
• docker/base/Dockerfile.nmp-python-base

🚧 Files skipped from review as they are similar to previous changes (3)

• docker/Dockerfile.nmp-core
• docker/Dockerfile.nmp-api
• docker/base/Dockerfile.nmp-python-base

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	27118/34832	77.8%	62.1%
Integration Tests	15934/33544	47.5%	19.9%