Pin Python minor version and document upgrade details (#235)

## Changes

Pin the Python version and document details on how to upgrade

## Context for reviewers

Python releases new minor versions (3.12, 3.13, etc.) every year in
October. It usually takes a few weeks for all of our dependencies and
tooling to also be upgraded to the latest version, causing our builds to
break. There isn't much we can do except wait a few weeks and then do
the upgrade (assuming no breaking changes in features we use).

However, we had some of our dependencies pinned to the major version
(Python 3) so it has broken the past few years until it started working
again when the dependencies got fixed. This is just getting ahead of
that and making sure the upgrade to Python 3.13 doesn't cause any
problems.

## Testing
This change is largely documentation as the Python version used in the
dockerfile + pyproject.toml already would have resolved to Python 3.12,
this just makes it so it won't auto-upgrade to 3.13 when that releases
in October.

app/Dockerfile

@@ -4,7 +4,9 @@
 # The build stage that will be used to deploy to the various environments
 # needs to be called `release` in order to integrate with the repo's
 # top-level Makefile
-FROM python:3-slim AS base
+FROM python:3.12-slim AS base
+# See /docs/app/README.md#Upgrading Python
+# for details on upgrading your Python version
 
 # Install poetry, the package manager.
 # https://python-poetry.org

app/pyproject.toml

@@ -6,7 +6,9 @@ packages = [{ include = "src" }]
 authors = ["Nava Engineering <engineering@navapbc.com>"]
 
 [tool.poetry.dependencies]
-python = "^3.12"
+# See /docs/app/README.md#Upgrading Python
+# for details on upgrading your Python version
+python = "~3.12"
 SQLAlchemy = {version = "^2.0.21", extras = ["mypy"]}
 alembic = "^1.12.0"
 python-dotenv = "^1.0.0"

docs/app/README.md

@@ -152,3 +152,30 @@ The API can be run in debug mode that allows for remote attach debugging (curren
     ]
 }
 ```
+
+## Upgrading Python
+Python does [yearly releases](https://devguide.python.org/versions/) for their minor versions (eg. 3.12 -> 3.13). They do not
+use semvar versioning, and their [minor releases](https://devguide.python.org/developer-workflow/development-cycle/#devcycle) contain
+breaking changes.
+
+Pin to a specific minor version of python just in case anything would break when the yearly release does occur.
+Only pin the minor versions of Python (eg. 3.12), and not the patch versions (eg. 3.12.1) as those contain bug and security fixes.
+
+Along with any version upgrades, remember to:
+- Test the system functionality before deploying to production
+- Review the [changelog](https://docs.python.org/3/whatsnew/changelog.html)
+for any breaking changes of features you may use
+
+### Upgrade Steps
+To upgrade the Python version, make changes in the following places:
+1. Local Python version (see more about managing local Python versions in [getting started](/docs/app/getting-started.md))
+2. [Dockerfile](/app/Dockerfile)
+    search for the line `FROM python:3.12-slim as base` - supported versions can be found on [Dockerhub](https://hub.docker.com/_/python)
+3. [pyproject.toml](/app/pyproject.toml)
+    search for the line
+    ```toml
+    [tool.poetry.dependencies]
+    python = "~3.12"
+    ```
+   Then run `poetry lock --no-update` to update the [poetry.lock](/app/poetry.lock) file.
+4. [.python-version](/app/.python-version) which is used by tools like pyenv