fix(docker): install the project after its sources are copied

[gkorland]

Summary

Follow-up to #723, which merged before this last review point could be addressed.

pip install . runs immediately after COPY pyproject.toml uv.lock ./, i.e. with no project sources present. [tool.setuptools.packages.find] therefore matches nothing, so the api package, the api.mcp templates package-data and the console scripts never reach site-packages.

Because a console script resolves imports from its own bin directory rather than the working directory, both entry points are dead in the shipped image:

api installed: False
cgraph BROKEN
cgraph-mcp BROKEN

That makes the documented CGRAPH_MODE=mcp path in start.sh (exec cgraph-mcp) unable to start at all. Web mode only works by accident, because uvicorn adds the working directory to the import path.

Changes

• Dependency layer now installs the exported uv.lock set directly (-r requirements.txt) instead of using it as constraints for a source install, keeping that layer cache-friendly and free of project sources.
• The project itself is installed with --no-deps after COPY ./api ./api, so the package, its package-data and both entry points land in site-packages.
• README.md is copied alongside it, since pyproject.toml declares readme = "README.md" for its metadata.

Testing

Full build of the real Dockerfile, then inspected the resulting image:

OK: uv gone
graphrag-sdk Version: 0.8.2
api installed: True
cgraph OK            <- run from / , not /app
cgraph-mcp OK        <- run from / , not /app
templates dir: .../site-packages/api/mcp/templates exists: True
                 ['claude_mcp_section.md', 'cursorrules.template']
STATIC_DIR: /app/app/dist exists: True

Runtime smoke tests of both modes:

• web — container boots to Application startup complete; GET /api/list_repos returns 200 {"status":"success","repositories":[]}; GET / serves the SPA with 200.
• mcp — CGRAPH_MODE=mcp answers a JSON-RPC initialize handshake, returning serverInfo.name = "code-graph". This previously could not start.

No regression to web mode: STATIC_DIR still resolves against /app/api, because the working directory takes precedence over site-packages on the import path.

Memory / Performance Impact

N/A — build configuration only, no runtime code changed. Image size is unaffected: the same wheels are installed, just in a different order.

Related Issues

Follow-up to #723 (review feedback that arrived after merge).

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a4f0f0e-a3ac-4655-8701-6d72c6d5c401

📥 Commits

Reviewing files that changed from the base of the PR and between ecc1174 and 7d10b68.

📒 Files selected for processing (1)

• Dockerfile

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR fixes the Docker image build so the CodeGraph Python package (including api.mcp templates package-data and the cgraph/cgraph-mcp console scripts) is actually installed into site-packages by installing the project only after its sources are copied into the image.

Changes:

• Switch dependency installation to pip install -r from a uv export-generated requirements file (pinned to uv.lock), keeping the dependency layer cache-friendly and source-free.
• Copy README.md and install the project itself with pip install --no-deps . after COPY ./api ./api so packages, package-data, and entry points are present in the final image.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.