-
Notifications
You must be signed in to change notification settings - Fork 1
Phase 3: Rebuild FLASHApp viewers on OpenMS-Insight via frozen template #93
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: develop
Are you sure you want to change the base?
Changes from all commits
0beac64
c80b782
17c3bad
c4bc001
753e2f1
dd89428
bbcee74
58f563e
13e9e06
2e74076
7034a1a
a45ee78
e2b7e44
0539031
77fae60
47f7cc4
0dc8271
a914134
30b3582
f0f5711
fb8680e
d3e94e1
414a7d4
a7fb7a6
758608f
0531cdc
9251ea4
6caeabf
51178ac
a392da0
c62f716
50abbd4
337cfc0
9f3e9fb
1e96a26
3843bc2
377b654
5c1f2c4
6f0a4b3
67c437e
b655565
c6ee4af
de7837d
93195d8
14cfece
340444b
9bf0978
02752cb
9c4bd6e
dcd9b49
de4b7d5
4b882bb
94ed99a
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -24,9 +24,24 @@ jobs: | |
| cache: pip | ||
| cache-dependency-path: requirements.txt | ||
|
|
||
| - name: Set up Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "21" | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| # OpenMS-Insight (Phase-3, 0.1.15) is not on PyPI: build it from the | ||
| # migration branch (Vue bundle + Python) and install from source so the | ||
| # requirements.txt pin resolves -- mirrors the Dockerfile insight-build stage. | ||
| git clone -b claude/kind-heisenberg-u6dVm --single-branch --depth 1 \ | ||
| https://github.com/t0mdavid-m/openms-insight.git /tmp/openms-insight | ||
|
Comment on lines
+38
to
+39
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Locate and print the relevant section of the workflow around the cited lines
FILE=".github/workflows/unit-tests.yml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
nl -ba "$FILE" | sed -n '1,120p'
echo "----"
nl -ba "$FILE" | sed -n '20,80p'
echo "----"
# Also search for any other openms-insight clone/install logic in the repo
rg -n "openms-insight|/tmp/openms-insight|npm run build|js-component/dist|requirements\.txt" .github/workflows/unit-tests.yml .claude/hooks/session-start.sh Dockerfile* . || trueRepository: OpenMS/FLASHApp Length of output: 103 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/unit-tests.yml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
echo "---- $FILE (lines ~20-80) ----"
awk 'NR>=20 && NR<=80 {printf "%5d %s\n", NR, $0}' "$FILE"
echo "---- matches for openms-insight related logic ----"
rg -n "openms-insight|/tmp/openms-insight|js-component/dist|npm run build|requirements\.txt" .github/workflows .claude/hooks Dockerfile* 2>/dev/null || true
echo "---- any checkout/pin patterns in the workflow ----"
rg -n "git clone|checkout .*sha|checkout --detach|fetch --depth|--depth 1" .github/workflows/unit-tests.yml 2>/dev/null || trueRepository: OpenMS/FLASHApp Length of output: 5956 🏁 Script executed: #!/bin/bash
set -euo pipefail
for f in Dockerfile Dockerfile.arm; do
echo "===== $f (around insight clone) ====="
[ -f "$f" ] || continue
# print likely relevant region
awk 'NR>=60 && NR<=160 {printf "%5d %s\n", NR, $0}' "$f"
echo
done
echo "===== search for insight-ref.json usage ====="
rg -n "insight-ref\.json|INSIGHT_BRANCH|openms-insight" Dockerfile Dockerfile.armRepository: OpenMS/FLASHApp Length of output: 12567 🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n "insight-ref\.json|insight-ref|INSIGHT_BRANCH=.*|git.*checkout.*openms-insight" -S . \
|| true
# Specifically ensure there is no follow-up that extracts a SHA from insight-ref.json
rg -n "jq |\.object\.sha|\"sha\"|grep .*insight-ref\.json|cat .*insight-ref\.json" Dockerfile Dockerfile.arm .github/workflows .claude/hooks 2>/dev/null || true
# List any other workflows that clone openms-insight
rg -n "openms-insight\.git|/tmp/openms-insight|openms_insight/js-component/dist" .github/workflows .claude/hooks Dockerfile* 2>/dev/null || trueRepository: OpenMS/FLASHApp Length of output: 2552 Use an immutable
Suggested hardening- git clone -b claude/kind-heisenberg-u6dVm --single-branch --depth 1 \
- https://github.com/t0mdavid-m/openms-insight.git /tmp/openms-insight
+ git clone https://github.com/t0mdavid-m/openms-insight.git /tmp/openms-insight
+ git -C /tmp/openms-insight checkout <pinned-openms-insight-commit-sha>🤖 Prompt for AI Agents |
||
| ( cd /tmp/openms-insight/js-component && npm install && npm run build ) | ||
| mkdir -p /tmp/openms-insight/openms_insight/js-component | ||
| cp -r /tmp/openms-insight/js-component/dist \ | ||
| /tmp/openms-insight/openms_insight/js-component/dist | ||
| pip install /tmp/openms-insight | ||
| # Pinned runtime deps (pyopenms is needed so ParameterManager imports | ||
| # cleanly at collection time) plus test-only deps. fakeredis backs the | ||
| # QueueManager/WorkflowManager tests, which pytest.importorskip it. | ||
|
|
||
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pin
actions/setup-nodeto a full commit SHA..github/workflows/unit-tests.ymluses the mutable action tagactions/setup-node@v4, which weakens CI supply-chain integrity—pin it to a specific commit SHA instead ofv4.🧰 Tools
🪛 zizmor (1.25.2)
[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents