fix: keep release and health check images self-contained

.github/workflows/publish_to_pypi.yml

@@ -55,25 +55,30 @@ jobs:
           PYPROJECT_VERSION=$(python3 - <<'PY'
           import sys
           import tomllib
-          from packaging.requirements import Requirement
 
           with open("pyproject.toml", "rb") as f:
               proxy_requirements = tomllib.load(f)["project"]["optional-dependencies"]["proxy"]
 
+          version = None
           for requirement in proxy_requirements:
-              parsed = Requirement(requirement)
-              if parsed.name != "litellm-proxy-extras":
+              normalized = requirement.split(";", 1)[0].strip()
+              if not normalized.startswith("litellm-proxy-extras"):
                   continue
-              specifiers = list(parsed.specifier)
-              if len(specifiers) == 1 and specifiers[0].operator == "==":
-                  print(specifiers[0].version)
-                  break
-          else:
+              parts = normalized.split("==", 1)
+              if len(parts) == 2 and parts[0].strip() == "litellm-proxy-extras":
+                  candidate = parts[1].strip()
+                  if candidate:
+                      version = candidate
+                      break
+
+          if version is None:
               print(
                   "::error::Could not find an exact litellm-proxy-extras pin in project.optional-dependencies.proxy",
                   file=sys.stderr,
               )
               sys.exit(1)
+
+          print(version)
           PY
           )
           echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"

docker/Dockerfile.health_check

@@ -9,8 +9,12 @@ WORKDIR /app
 COPY --from=uvbin /uv /usr/local/bin/uv
 COPY scripts/health_check/health_check_client.py /app/health_check_client.py
 
-# Make script executable
-RUN chmod +x /app/health_check_client.py
+# Resolve and install the script dependencies at build time so the runtime
+# image stays self-contained in air-gapped or egress-restricted environments.
+RUN uv export --script /app/health_check_client.py --no-hashes --output-file /tmp/health-check-requirements.txt \
+  && uv pip install --system -r /tmp/health-check-requirements.txt \
+  && rm /tmp/health-check-requirements.txt \
+  && chmod +x /app/health_check_client.py
 
 # Run as non-root user
 RUN adduser --disabled-password --gecos "" --uid 1001 healthcheck
@@ -18,7 +22,7 @@ USER healthcheck
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
-  CMD uv run --script /app/health_check_client.py --help || exit 1
+  CMD python /app/health_check_client.py --help || exit 1
 
 # Set entrypoint
-ENTRYPOINT ["uv", "run", "--script", "/app/health_check_client.py"]
+ENTRYPOINT ["python", "/app/health_check_client.py"]