Install the container image from prebuilt wheels

The runtime layer resolved and built its dependencies straight from PyPI,
so a rebuild could pick up a different set and any sdist in the graph got
to run its setup script inside the image. A throwaway builder stage now
produces every wheel, and the runtime installs with --only-binary and
--no-index against that directory — nothing new can be fetched there.

Drop the two suppressions that turned out to be inert: NOSONAR is not
honoured inside a Dockerfile or a `run: |` block, so they were noise.

Author: JE-Chen

.github/workflows/action-json-lint.yml

@@ -39,7 +39,10 @@ jobs:
           AUTOCONTROL_REF: ${{ inputs.autocontrol_ref }}
         run: |
           python -m pip install --only-binary :all: --upgrade "pip==26.0.1"
-          python -m pip install "$AUTOCONTROL_REF"  # NOSONAR githubactions:S8544  # reason: documented workflow input, pinned by default, so callers can point at their own release or git ref
+          # The spec is a documented workflow input — pinned by default so a
+          # lint run is reproducible, overridable so a caller can track their
+          # own release or a git ref.
+          python -m pip install "$AUTOCONTROL_REF"
 
       - name: Lint action JSON files
         shell: bash

docker/Dockerfile

@@ -5,6 +5,20 @@
 # Build:   docker build -f docker/Dockerfile -t autocontrol:latest .
 # Run:     docker run --rm -p 9939:9939 -p 9940:9940 autocontrol:latest
 
+# Build every wheel — the project and its dependencies — in a throwaway
+# stage. The runtime image then installs binaries only, so no dependency
+# gets to execute a setup script there and the resolved set is fixed at
+# build time instead of being re-resolved against PyPI.
+FROM python:3.12-slim AS builder
+
+WORKDIR /src
+COPY pyproject.toml README.md ./
+COPY je_auto_control ./je_auto_control
+COPY autocontrol-lsp ./autocontrol-lsp
+RUN pip install --no-cache-dir --only-binary :all: --upgrade "pip==26.0.1" \
+    && pip wheel --no-cache-dir --wheel-dir /wheels .
+
+
 FROM python:3.12-slim AS runtime
 
 ARG DEBIAN_FRONTEND=noninteractive
@@ -37,14 +51,13 @@ COPY je_auto_control ./je_auto_control
 COPY autocontrol-lsp ./autocontrol-lsp
 COPY README.md ./
 
-# Install the package + the [webrtc] extra so the optional WebRTC host
-# also works inside the container. pip itself is pinned so a rebuild
-# resolves the same installer, and only wheels are accepted so no
-# dependency gets to run a setup script during the build.
-RUN pip install --no-cache-dir --only-binary :all: --upgrade "pip==26.0.1"
-# The editable install targets the source tree copied in above; there is
-# no upstream version to lock and the project's own build must run.
-RUN pip install --no-cache-dir -e .  # NOSONAR docker:S8541,docker:S8544
+# Install from the wheels built above: pinned pip, wheels only, and no
+# index lookup, so the runtime layer cannot pull anything new from PyPI.
+COPY --from=builder /wheels /wheels
+RUN pip install --no-cache-dir --only-binary :all: --upgrade "pip==26.0.1" \
+    && pip install --no-cache-dir --only-binary :all: --no-index \
+       --find-links=/wheels je_auto_control \
+    && rm -rf /wheels
 
 ENV DISPLAY=:99 \
     PYTHONUNBUFFERED=1 \

docker/Dockerfile.xfce

@@ -13,6 +13,18 @@
 # Connect a VNC viewer to localhost:5900 (no password by default; set
 # AUTOCONTROL_VNC_PASSWORD to enable a TightVNC password).
 
+# Same two-stage build as docker/Dockerfile: wheels are produced here so
+# the runtime layer installs binaries only, with no index lookup.
+FROM python:3.12-slim AS builder
+
+WORKDIR /src
+COPY pyproject.toml README.md ./
+COPY je_auto_control ./je_auto_control
+COPY autocontrol-lsp ./autocontrol-lsp
+RUN pip install --no-cache-dir --only-binary :all: --upgrade "pip==26.0.1" \
+    && pip wheel --no-cache-dir --wheel-dir /wheels .
+
+
 FROM python:3.12-slim AS runtime
 
 ARG DEBIAN_FRONTEND=noninteractive
@@ -39,10 +51,11 @@ COPY je_auto_control ./je_auto_control
 COPY autocontrol-lsp ./autocontrol-lsp
 COPY README.md ./
 
-RUN pip install --no-cache-dir --only-binary :all: --upgrade "pip==26.0.1"
-# The editable install targets the source tree copied in above; there is
-# no upstream version to lock and the project's own build must run.
-RUN pip install --no-cache-dir -e .  # NOSONAR docker:S8541,docker:S8544
+COPY --from=builder /wheels /wheels
+RUN pip install --no-cache-dir --only-binary :all: --upgrade "pip==26.0.1" \
+    && pip install --no-cache-dir --only-binary :all: --no-index \
+       --find-links=/wheels je_auto_control \
+    && rm -rf /wheels
 
 ENV DISPLAY=:99 \
     PYTHONUNBUFFERED=1 \