<type>(scope): <description>

[body]

[footer(s)]

.gitlab-ci.yml

@@ -179,7 +179,7 @@ cache:
     policy: pull-push
   before_script:
     - apt-get update
-    - apt-get install -y --no-install-recommends ca-certificates curl just
+    - apt-get install -y --no-install-recommends ca-certificates curl just git
     - update-ca-certificates
     - curl -LsSf https://astral.sh/uv/install.sh | sh
     - export PATH="$HOME/.local/bin:$PATH"
@@ -348,6 +348,14 @@ sast-image-migrations:
   dependencies:
     - build-migrations
 
+sast-image-ml:
+  <<: *trivy-image-scan
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/ml
+    IMAGE_TYPE: ml
+  dependencies:
+    - build-ml
+
 tag-runtime:
   <<: *tag-config
   variables:

Containerfile

@@ -21,7 +21,7 @@ RUN apt-get update && \
 
 COPY pyproject.toml uv.lock ./
 
-RUN uv sync --frozen --no-dev --no-cache --group backend
+RUN uv sync --group backend --frozen --no-cache
 
 
 # Stage 2: Runtime

Containerfile.ml

@@ -1,9 +1,7 @@
 # syntax=docker/dockerfile:1.20
 
-ARG PY_IMAGE=docker.io/python:3.12-slim
-
 # Stage 1: Builder
-FROM ${PY_IMAGE} AS builder
+FROM docker.io/python:3.12-slim AS builder
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
@@ -23,10 +21,10 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 COPY pyproject.toml uv.lock ./
 
-RUN uv sync --frozen --no-dev --no-cache --group ml
+RUN uv sync --frozen --no-cache --group ml
 
 # Stage 2: ML Runtime
-FROM ${PY_IMAGE} AS ml
+FROM docker.io/python:3.12-slim AS ml
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \