coffea-casa 2024.8.7__tar.gz → 2025.9.24.2__tar.gz

coffea_casa-2025.9.24.2/.github/workflows/autotag.yaml

@@ -0,0 +1,57 @@
+name: Auto CalVer Tag on Master Push
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  calver-tag:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set CalVer date
+        id: calver
+        run: |
+          # Get current date in YYYY.MM.DD format
+          date_tag=$(date +'%Y.%m.%d')
+          echo "base_tag=$date_tag" >> $GITHUB_OUTPUT
+
+      - name: Fetch all tags
+        run: |
+          git fetch --tags
+
+      - name: Determine next CalVer tag
+        id: next_tag
+        run: |
+          base=${{ steps.calver.outputs.base_tag }}
+          # List all existing tags that match today's date
+          existing=$(git tag --list "${base}*")
+
+          if ! echo "$existing" | grep -q "^$base$"; then
+            # No base tag exists yet, use the base tag (no suffix)
+            new_tag="$base"
+          else
+            # Base tag exists, find the highest numbered suffix
+            max=1  # because base tag is already used
+            for tag in $existing; do
+              suffix=$(echo $tag | sed -n "s/^$base\.//p")
+              if [[ "$suffix" =~ ^[0-9]+$ && "$suffix" -gt "$max" ]]; then
+                max=$suffix
+              fi
+            done
+            new_tag="$base.$((max + 1))"
+          fi
+
+          echo "New tag: $new_tag"
+          echo "new_tag=$new_tag" >> $GITHUB_OUTPUT
+
+      - name: Create and push new tag
+        run: |
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+          git tag ${{ steps.next_tag.outputs.new_tag }}
+          git push origin ${{ steps.next_tag.outputs.new_tag }}

{coffea_casa-2024.8.7 → coffea_casa-2025.9.24.2}/.github/workflows/dockercd-dev.yml

@@ -1,9 +1,10 @@
 name: Push tag of docker images
 
 on:
+  release:
+    types:
+      - published
   push:
-    tags:
-      - "*"
     paths:
       - docker/**
     branches:
@@ -20,24 +21,22 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        image: [cc-base-ubuntu, cc-analysis-ubuntu, cc-dask-alma8, cc-analysis-alma8, cc-dask-alma9, cc-analysis-alma9]
-        # Keep this line in sync with gh actions @ coffea-dask repo
-        # python: [3.8, 3.9, '3.10']
-        #exclude:
-        #  - image: cc7
-        #    python: 3.8           
+        image: [cc-dask-alma9, cc-analysis-alma9, cc-dask-combine-alma9, cc-analysis-combine-alma9]        
     name: ${{ matrix.image }}
     runs-on: ubuntu-latest
     steps:
+
+      - name: Identify event type
+        run: |
+          echo "Triggered by: ${{ github.event_name }}"
+
       - name: Generate tags
         id: tags
         env:
           image: ${{ env.REGISTRY }}/coffea-casa/${{ matrix.image }}
-          #python: ${{ matrix.python }}
-          release: ${{ github.ref_name }}
-          stable: ${{ startsWith(github.ref, 'refs/tags') }}
+          release: ${{ github.event.release.tag_name }}
         run: |
-          if [ "$stable" == "true" ]; then
+          if [ "${{ github.event_name }}" == 'release']; then
             tag="${image}:${release}"
             tags=$tag
             releasetag=${release}
@@ -72,9 +71,9 @@ jobs:
         with:
           context: docker/
           file: docker/Dockerfile.${{ matrix.image }}
-          push: ${{  github.event_name == 'push' }}
           platforms: linux/amd64
           tags: ${{ steps.tags.outputs.tags }}
+          push: true
           build-args: |
             TAG=${{ steps.tags.outputs.releasetag }}
             PROJECT=${{ env.PROJECT }} 

{coffea_casa-2024.8.7 → coffea_casa-2025.9.24.2}/.github/workflows/dockerci-dev.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        image: [cc-base-ubuntu, cc-analysis-ubuntu, cc-dask-alma8, cc-analysis-alma8, cc-dask-alma9, cc-analysis-alma9]
+        image: [cc-dask-alma9, cc-analysis-alma9, cc-dask-combine-alma9, cc-analysis-combine-alma9]
         # Keep this line in sync with gh actions @ coffea-dask repo
         # python: [3.8, 3.9, '3.10']
         #exclude:

coffea_casa-2025.9.24.2/.github/workflows/pypi-tag-deploy.yml

@@ -0,0 +1,34 @@
+name: Deploy to PyPI
+
+on:
+  workflow_dispatch:
+  release:
+    types:
+      - published
+
+jobs:
+  build-and-inspect-package:
+    name: Build & inspect package.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hynek/build-and-inspect-python-package@v2
+
+  upload-to-pypi:
+    name: Upload package to PyPI
+    needs: build-and-inspect-package
+    environment:
+      name: pypi
+      url: https://pypi.org/project/coffea-casa/
+    runs-on: ubuntu-latest
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing, but
+      # should NOT be granted anywhere else!
+      id-token: write
+    steps:
+      - name: Download built artifact to dist/
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1

coffea_casa-2025.9.24.2/.github/workflows/update_docker.yml

@@ -0,0 +1,64 @@
+name: Auto Update Base Docker Images
+
+on:
+  schedule:
+    - cron: '0 6 * * *'  # Every day at 6am UTC
+  workflow_dispatch:
+
+jobs:
+  update-base-images:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - name: Get latest base image tag from Docker Hub
+        id: latest
+        run: |
+          LATEST_TAG=$(curl -s https://registry.hub.docker.com/v2/repositories/coffeateam/coffea-dask-almalinux9-noml/tags |  
+          jq -r '.results[].name' | 
+          grep 'py3.12$' | 
+          sort -V | 
+          head -n 1 )
+          echo "Found latest tag: $LATEST_TAG"
+          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+
+      - name: Find and update all Dockerfiles
+        id: update
+        run: |
+          set -e
+
+          UPDATED=false
+          LATEST_TAG=${{ steps.latest.outputs.latest_tag }}
+          IMAGE_NAME="coffeateam/coffea-dask-almalinux9-noml"
+
+          for dockerfile in $(find . -name "Dockerfile*"); do
+            echo "Checking $dockerfile..."
+
+            # Extract current tag
+            CURRENT_TAG=$(grep -E "^FROM $IMAGE_NAME:" "$dockerfile" | sed "s|FROM $IMAGE_NAME:||")
+
+            if [ -n "$CURRENT_TAG" ] && [ "$CURRENT_TAG" != "$LATEST_TAG" ]; then
+              echo "Updating $dockerfile: $CURRENT_TAG → $LATEST_TAG"
+              sed -i "s|$IMAGE_NAME:$CURRENT_TAG|$IMAGE_NAME:$LATEST_TAG|" "$dockerfile"
+              UPDATED=true
+            else
+              echo "No update needed in $dockerfile"
+            fi
+          done
+
+          echo "UPDATED=$UPDATED" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        if: env.UPDATED == 'true'
+        uses: peter-evans/create-pull-request@v5
+        with:
+          token: ${{ secrets.REPO_ACCESS_TOKEN  }}
+          commit-message: "chore: update base image to coffeateam/coffea-dask-almalinux9-noml:${{ steps.latest.outputs.latest_tag }}"
+          title: "chore: update base image to coffeateam/coffea-dask-almalinux9-noml:${{ steps.latest.outputs.latest_tag }}"
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          branch: "update-coffea-base-image"
+          body: |
+            A new Coffea image version has been detected.
+
+            This PR updates all Dockerfiles that use `coffeateam/coffea-dask-almalinux9-noml:<old>` to `coffeateam/coffea-dask-almalinux9-noml:${{ steps.latest.outputs.latest_tag }}`.

{coffea_casa-2024.8.7 → coffea_casa-2025.9.24.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: coffea-casa
-Version: 2024.8.7
+Version: 2025.9.24.2
 Summary: Wrappers for Dask clusters to be used from coffea-casa AF
 Project-URL: Homepage, https://github.com/CoffeaTeam/coffea-casa
 Project-URL: Documentation, https://coffea-casa.readthedocs.io/en/latest/

coffea_casa-2025.9.24.2/coffea_casa/_version.py

@@ -0,0 +1,34 @@
+# file generated by setuptools-scm
+# don't change, don't track in version control
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Tuple
+    from typing import Union
+
+    VERSION_TUPLE = Tuple[Union[int, str], ...]
+    COMMIT_ID = Union[str, None]
+else:
+    VERSION_TUPLE = object
+    COMMIT_ID = object
+
+version: str
+__version__: str
+__version_tuple__: VERSION_TUPLE
+version_tuple: VERSION_TUPLE
+commit_id: COMMIT_ID
+__commit_id__: COMMIT_ID
+
+__version__ = version = '2025.9.24.2'
+__version_tuple__ = version_tuple = (2025, 9, 24, 2)
+
+__commit_id__ = commit_id = None

{coffea_casa-2024.8.7 → coffea_casa-2025.9.24.2}/coffea_casa/coffea_casa.py

@@ -1,8 +1,8 @@
 """CoffeaCasaCluster class
 """
 import os
-import sys
 from pathlib import Path
+import sys
 import dask
 from dask_jobqueue.htcondor import HTCondorCluster, HTCondorJob
 from distributed.security import Security
@@ -17,17 +17,11 @@ DEFAULT_NANNY_PORT = 8001
 # REMOVE ME (backward compatibity for now)
 SECRETS_DIR = Path("/etc/cmsaf-secrets")
 SECRETS_DIR_CHOWN = Path("/etc/cmsaf-secrets-chown")
-# CEPH (Skyhook)
-CEPH_DIR = Path("/opt/ceph")
-CEPH_CONF = CEPH_DIR / "ceph.conf"
-KEYRING_CONF = CEPH_DIR / "keyring"
 CA_FILE = SECRETS_DIR / "ca.pem"
 CERT_FILE = SECRETS_DIR / "hostcert.pem"
 HOME_DIR = Path.home()
 # XCache
-# REMOVE ME (backward compatibity for now)
-XCACHE_FILE = SECRETS_DIR / "xcache_token"
-XCACHE_SCITOKEN_FILE = SECRETS_DIR_CHOWN / "access_token"
+#XCACHE_SCITOKEN_FILE = SECRETS_DIR_CHOWN / "access_token"
 # pip
 PIP_REQUIREMENTS = HOME_DIR / "requirements.txt"
 # conda, with yml/yaml both supported
@@ -36,6 +30,56 @@ if (HOME_DIR / "environment.yaml").is_file():
 else:
     CONDA_ENV = HOME_DIR / "environment.yml"
 
+import os
+from pathlib import Path
+
+def bearer_token_path():
+    """Return the path to the user's X.509 proxy or None if not found"""
+
+    def check_token_path(path, suffix=''):
+        token_path = f'{path}{suffix}'
+        if Path(token_path).is_file():
+            return token_path
+        return None
+
+    # 1. Check BEARER_TOKEN_FILE env variable
+    try:
+        path = check_token_path(os.environ['BEARER_TOKEN_FILE'])
+        if path:
+            return path
+    except KeyError:
+        pass
+
+    # 2. Check XDG_RUNTIME_DIR + /bt_u$UID
+    try:
+        xdg_runtime_dir = os.environ['XDG_RUNTIME_DIR']
+        path = check_token_path(xdg_runtime_dir, suffix=f'/bt_u{os.geteuid()}')
+        if path:
+            return path
+    except KeyError:
+        pass
+
+    # 3. Check /tmp/bt_u$UID
+    try:
+        path = check_token_path(f'/tmp/bt_u{os.geteuid()}')
+        if path:
+            return path
+    except KeyError:
+        pass
+
+    return None
+
+def x509_user_proxy_path():
+    """Return the path to the user's X.509 proxy or raise FileNotFoundError if it doesn't exist on disk
+    """
+    try:
+        path = os.environ['X509_USER_PROXY']
+    except KeyError:
+        path = f'/tmp/x509up_u{os.geteuid()}'
+
+    if open(path):
+        return path
+    return None  # we shouldn't get here; failure to open should raise OSError
 
 def merge_dicts(*dict_args):
     """
@@ -136,23 +180,21 @@ class CoffeaCasaCluster(HTCondorCluster):
                            ):
         job_config = job_kwargs.copy()
         input_files = []
-        if CEPH_CONF.is_file() and KEYRING_CONF.is_file():
-            input_files += [CEPH_CONF, KEYRING_CONF]
         if PIP_REQUIREMENTS.is_file():
             input_files += [PIP_REQUIREMENTS]
         if CONDA_ENV.is_file():
             input_files += [CONDA_ENV]
+        opendata = os.environ.get('OPENDATA_INSTANCE')
         # If we have certs in env, lets try to use TLS
         if (CA_FILE.is_file() and CERT_FILE.is_file() and cls.security().get_connection_args("scheduler")["require_encryption"]):
             job_config["protocol"] = "tls://"
             job_config["security"] = cls.security()
             input_files += [CA_FILE, CERT_FILE]
-        if (XCACHE_SCITOKEN_FILE.is_file()):
+        XCACHE_SCITOKEN_FILE = bearer_token_path()
+        if XCACHE_SCITOKEN_FILE:
             input_files += [XCACHE_SCITOKEN_FILE]
-        if (XCACHE_FILE.is_file()):
-            input_files += [XCACHE_FILE]
         else:
-            raise KeyError("Please check with system administarator why you do not have a certificate.")
+            print("Warning: No bearer token found — proceeding without it.")
         files = ", ".join(str(path) for path in input_files)
         ## Networking settings
         try:
@@ -187,6 +229,14 @@ class CoffeaCasaCluster(HTCondorCluster):
                 dask.config.get(f"jobqueue.{cls.config_name}.scheduler-options"),
             ),
         )
+        # try in case we have x509 proxy
+        try:
+            proxy = x509_user_proxy_path()
+            if proxy:
+                use_proxy = True
+        except:
+            use_proxy = False
+            pass
         ## Job extra settings (HTCondor ClassAd)
         job_config["job_extra_directives"] = merge_dicts(
             {
@@ -198,6 +248,7 @@ class CoffeaCasaCluster(HTCondorCluster):
                 "dask_container_port": DEFAULT_CONTAINER_PORT,
                 "nanny_container_port": DEFAULT_NANNY_PORT,
             },
+            {"use_x509userproxy": use_proxy},
             {"transfer_input_files": files},
             {"encrypt_input_files": files},
             {"transfer_output_files": ""},
@@ -205,9 +256,9 @@ class CoffeaCasaCluster(HTCondorCluster):
             {"should_transfer_files": "YES"},
             {"Stream_Output": "False"},
             {"Stream_Error": "False"},
-            {"+CoffeaCasaWorkerType": "dask"},
+            {"+CoffeaCasaWorkerType": '"dask"'},
             {"+DaskSchedulerAddress": external_ip_string},
-            {"+AccountingGroup": "cms.other.coffea.$ENV(HOSTNAME)"},
+            {"+AccountingGroup": '"cms.other.coffea.$ENV(HOSTNAME)"'},
             job_kwargs.get(
                 "job_extra_directives", dask.config.get(f"jobqueue.{cls.config_name}.job_extra_directives")
             ),

{coffea_casa-2024.8.7 → coffea_casa-2025.9.24.2}/docker/Dockerfile.cc-analysis-alma9

@@ -1,5 +1,5 @@
 #FROM coffeateam/coffea-base-almalinux8:0.7.22-py3.10
-FROM coffeateam/coffea-dask-almalinux9:latest-py3.10
+FROM coffeateam/coffea-dask-almalinux9-noml:2025.9.0-py3.12
 
 
 USER root
@@ -9,6 +9,8 @@ ARG TAG="development"
 ARG NB_USER="cms-jovyan"
 ARG NB_UID="6440"
 ARG NB_GID="11265"
+ARG CONDOR_USER="condor"
+ARG CONDOR_GID="989"
 ARG CERT_DIR="/etc/cmsaf-secrets"
 # Hack for GH Actions
 ARG GITHUB_ACTIONS="false"
@@ -38,10 +40,12 @@ ENV LANGUAGE en_US.UTF-8
 
 # Install all OS dependencies for notebook server that starts but lacks all
 # features (e.g., download as all possible file formats)
-RUN yum -y update \
+RUN yum install -y https://repo.osg-htc.org/osg/24-main/osg-24-main-el9-release-latest.rpm \
+ && yum -y update \
  && yum -y group install "Development Tools" \
  && yum -y install \
     wget \
+    osg-ca-certs \
     epel-release \
     gettext \
     bzip2 \
@@ -50,6 +54,7 @@ RUN yum -y update \
     langpacks-en \
     glibc-langpack-en \
     glibc-all-langpacks \
+    glibc-headers \
     liberation-fonts \
     wget \
     nss_wrapper \
@@ -78,11 +83,6 @@ RUN chmod +x /usr/bin/tini
 COPY jupyterhub/fix-permissions /usr/local/bin/fix-permissions
 RUN chmod a+rx /usr/local/bin/fix-permissions
 
-RUN rm -rf /etc/grid-security && \
-    ln -s /usr/local/etc/grid-security /etc/grid-security && \
-    chmod 755 /etc/grid-security/certificates && \
-    chmod g-w /etc/grid-security/certificates
-
 # Enable prompt color in the skeleton .bashrc before creating the default NB_USER
 # hadolint ignore=SC2016
 RUN sed -i 's/^#force_color_prompt=yes/force_color_prompt=yes/' /etc/skel/.bashrc && \
@@ -113,20 +113,25 @@ RUN mkdir $HOME/work && \
     mkdir -p $HOME/.condor/tokens.d && \
     fix-permissions $HOME
 
+# FIXME:
+# Terrible bug in all .r0 not allowing to use our xcache +
+# + wrongly activated conda base environment in base image
+RUN conda init && \
+    source /home/cms-jovyan/.bashrc && \
+    mamba uninstall -y ca-policy-lcg
+
 #Dask dependencies and HTCondor
 RUN mamba install --yes \
     -c conda-forge \
     xgboost \
-    pyhf \
-    xrootd \
-    scipy>=1.8.1 \
     cabinetry \
-    vector \
-    hist \
-    mplhep \
-    iminuit \
+    pyhf \
+    atlas-schema \
     cmake \
     ndcctools \
+    # last working version with x509
+    #htcondor=10.8.0 \
+    #openssl=3.3.1 \
     && mamba clean \
         --all \
         --force-pkgs-dirs \
@@ -135,15 +140,14 @@ RUN mamba install --yes \
 RUN pip install --no-cache-dir \
     aiostream \
     supervisor \
-    correctionlib \
-    funcx \
+    #funcx \ outdated dependencies
+    pixi-kernel \
+    scikit-hep-testdata \
     pyyaml \
-    # ML packages
-    dask-ml \
-    dask-gateway \
     prometheus_client \
     comm>=0.1.2 \
-    mlflow
+    mlflow \ 
+    s3fs
 
 #RUN if [ "${TAG:-}" == "development" ]; then pip install --no-cache-dir git+https://github.com/CoffeaTeam/coffea-casa.git#egg=coffea_casa ; else pip install --no-cache-dir coffea_casa -U ; fi
 RUN pip install --no-cache-dir git+https://github.com/CoffeaTeam/coffea-casa.git#egg=coffea_casa
@@ -154,17 +158,13 @@ RUN cd /tmp && \
     cd xrdcl-authz-plugin && \
     mkdir build && \
     cd  build && \
-    cmake /tmp/xrdcl-authz-plugin -DCMAKE_INSTALL_PREFIX=${CONDA_DIR} && \
+    cmake /tmp/xrdcl-authz-plugin -DCMAKE_INSTALL_PREFIX=${CONDA_DIR} -DCMAKE_POLICY_VERSION_MINIMUM=3.5 && \
     make && \
     make install
 
 ENV XRD_PLUGINCONFDIR="${CONDA_DIR}/etc/xrootd/client.plugins.d/"
 ENV XRD_PLUGIN="${CONDA_DIR}/lib/libXrdClXcachePlugin-5.so"
 
-# Include additional CA certificates beyond ca-policy-lcg
-COPY certs/* /etc/grid-security/certificates/
-RUN openssl rehash /etc/grid-security/certificates/
-
 # TODO: RETEST IF WE STILL NEED THIS 
 ENV LD_LIBRARY_PATH="${CONDA_DIR}/lib/:$LD_LIBRARY_PATH"
 ENV PATH="${CONDA_DIR}/bin/:$PATH"
@@ -172,21 +172,35 @@ ENV PATH="${CONDA_DIR}/bin/:$PATH"
 USER root
 # Setup supervisord files
 COPY k8s-worker/supervisord.conf  /etc/supervisor/
+
+# Fix permission after all packages installations are done
+RUN fix-permissions "${CONDA_DIR}"
+
+# Include additional CA certificates beyond ca-policy-lcg
+COPY certs/* /etc/grid-security/certificates/
+RUN openssl rehash /etc/grid-security/certificates/
+
+RUN chmod -R g-w /usr/local/etc/grid-security/ && chmod -R g-w /etc/grid-security/
+    #chown -h "${NB_USER}:${NB_GID}" /etc/grid-security && \
+    #test -d /usr/local/etc/grid-security && chmod -R 755 /usr/local/etc/grid-security && \
+    #find /usr/local/etc/grid-security -type f -exec chmod g-w {} + && \
+    #test -d /etc/grid-security && chmod -R 755 /etc/grid-security
 # Setup HTCondor user/group and change group for user $NB_USER
 # Fix error (submitting jobs as user/group 0 (root) is not allowed for security reasons) and
 # it configured from kubernetes side and updated in docker container to match it
-RUN groupadd -r condor && \
-    useradd -r -g condor -d /var/lib/condor -s /sbin/nologin condor
+
+RUN groupadd -g 989 condor && \
+    useradd -u 989 -g 989 -d /var/lib/condor -s /sbin/nologin condor && \
+    mkdir -p /var/lib/condor/spool && \
+    #chown -R "${CONDOR_USER}:${CONDOR_GID}" /var/lib/condor && \
+    chmod -R 755 /var/lib/condor
 
 # FIXME: merge PRs open in distributed.git (oshadura)
 # Distributed: we need to install patched version of distributed version
-COPY dask/distributed ${CONDA_DIR}/lib/python3.10/site-packages/distributed
-RUN cd ${CONDA_DIR}/lib/python3.10/site-packages/distributed && \
+COPY dask/distributed ${CONDA_DIR}/lib/python3.12/site-packages/distributed
+RUN cd ${CONDA_DIR}/lib/python3.12/site-packages/distributed && \
     patch -p2 < 0001-Patch-from-bbockelman-adaptive-scaling.patch && \
     patch -p2 < 0002-Allow-scheduler-to-preserve-worker-hostnames.patch
-    # && patch -p2 < 0003-Activate-patch.patch
-    # && patch -p2 < 0004-Add-possibility-to-setup-external_adress-for-schedul.patch
-    # && patch -p2 < 0005-Add-nanny-patch.patch
 
 # FIXME: we have a wrong path, let's make a link.
 # cms-jovyan@jupyter-oksana-2eshadura-40cern-2ech:~$ echo $PATH
@@ -200,7 +214,7 @@ RUN rm -rf /tmp/* \
     && find ${CONDA_DIR} -type f -name '*.a' -delete \
     && find ${CONDA_DIR} -type f -name '*.pyc' -delete \
     && find ${CONDA_DIR} -type f -name '*.js.map' -delete \
-    && (find ${CONDA_DIR}/lib/python3.10/site-packages/bokeh/server/static -type f,l -name '*.js' -not -name '*.min.js' -delete || echo "no bokeh static files to cleanup") \
+    && (find ${CONDA_DIR}/lib/python3.12/site-packages/bokeh/server/static -type f,l -name '*.js' -not -name '*.min.js' -delete || echo "no bokeh static files to cleanup") \
     && rm -rf ${CONDA_DIR}/pkgs
 
 # Mkdir CVMFS mount directory.  Mount done upstream in configs. Harmless