dh-cli 0.8.3__tar.gz → 0.8.4__tar.gz

{dh_cli-0.8.3 → dh_cli-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dh-cli
-Version: 0.8.3
+Version: 0.8.4
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0

{dh_cli-0.8.3 → dh_cli-0.8.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.8.3"
+version = "0.8.4"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"

{dh_cli-0.8.3 → dh_cli-0.8.4}/src/dh_cli/batch/aws_batch.py

@@ -17,6 +17,11 @@ from dh_cli.batch.manifest import (
 
 logger = logging.getLogger(__name__)
 
+_ECR_IMAGE_RE = re.compile(
+    r"^\d{12}\.dkr\.ecr\.[a-z0-9-]+\.amazonaws\.com/[^:@\s]+"
+    r"(?::[^\s]+|@sha256:[a-f0-9]{64})?$"
+)
+
 
 class BatchError(Exception):
     """Error interacting with AWS Batch."""
@@ -165,14 +170,27 @@ class BatchClient:
         create a new revision of the base definition with only the image
         changed, preserving all other containerProperties (roles, volumes, etc.).
 
-        Returns the ARN of the new revision.
+        Returns the ARN of the new revision, or the ARN of the latest existing
+        revision if its image already matches.
         """
+        if not _ECR_IMAGE_RE.match(image):
+            raise BatchError(
+                f"Image override must be a fully-qualified ECR URL "
+                f"(<account>.dkr.ecr.<region>.amazonaws.com/<repo>[:tag|@digest]); "
+                f"got: {image!r}"
+            )
+
         resp = self.batch.describe_job_definitions(jobDefinitionName=base_definition, status="ACTIVE")
         definitions = resp.get("jobDefinitions", [])
         if not definitions:
             raise BatchError(f"Job definition not found: {base_definition}")
 
         latest = sorted(definitions, key=lambda d: d["revision"])[-1]
+        if latest["containerProperties"].get("image") == image:
+            arn = latest["jobDefinitionArn"]
+            logger.info(f"Reusing job definition {arn}; image already matches {image}")
+            return arn
+
         container_props = latest["containerProperties"].copy()
         container_props["image"] = image
 

{dh_cli-0.8.3 → dh_cli-0.8.4}/src/dh_cli/batch/commands/submit.py

@@ -4,7 +4,7 @@ import click
 import yaml
 from click.core import ParameterSource
 
-from ..aws_batch import BatchClient, BatchError, resolve_dependency
+from ..aws_batch import _ECR_IMAGE_RE, BatchClient, BatchError, resolve_dependency
 from ..job_id import generate_job_id, get_aws_username
 from ..manifest import (
     BATCH_JOBS_BASE,
@@ -114,6 +114,13 @@ def submit(
     job_retry = _pick("retry", retry)
     job_timeout = _pick("timeout", timeout)
     job_image = image or config.get("image")
+    if job_image and not _ECR_IMAGE_RE.match(job_image):
+        raise click.BadParameter(
+            f"--image must be a fully-qualified ECR URL "
+            f"(<account>.dkr.ecr.<region>.amazonaws.com/<repo>[:tag|@digest]); "
+            f"got: {job_image!r}",
+            param_hint="--image",
+        )
 
     # Parse environment variables
     job_env = dict(config.get("env", {}))

dh_cli-0.8.4/tests/batch/test_image_override.py

@@ -0,0 +1,141 @@
+"""Tests for BatchClient._register_image_override.
+
+Pins two contracts:
+
+1. Bare names (anything not a fully-qualified ECR URL) are rejected, so
+   typos like ``dh batch submit --image dayhoff-generic`` cannot drift the
+   floating ref by registering a revision pointing at Docker Hub.
+2. When the latest active revision already carries the requested image,
+   no new revision is registered — the existing ARN is returned. Without
+   this, every override invocation bumps the JD revision counter.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+
+def _make_client():
+    with patch("dh_cli.batch.aws_batch.boto3") as mock_boto3:
+        mock_batch = MagicMock()
+        mock_logs = MagicMock()
+        mock_boto3.client.side_effect = [mock_batch, mock_logs]
+
+        from dh_cli.batch.aws_batch import BatchClient
+
+        return BatchClient(), mock_batch
+
+
+_ECR_URL = "123456789012.dkr.ecr.us-east-1.amazonaws.com/dayhoff-generic:abc123"
+
+
+class TestImageValidation:
+    """Bare image names must be rejected before any AWS call."""
+
+    @pytest.mark.parametrize(
+        "bad_image",
+        [
+            "dayhoff-generic",
+            "dayhoff-generic:latest",
+            "docker.io/library/python:3.12",
+            "ghcr.io/foo/bar:1.0",
+            "123456789012.dkr.ecr.us-east-1.amazonaws.com/dayhoff-generic with-space",
+        ],
+    )
+    def test_rejects_non_ecr_image(self, bad_image):
+        from dh_cli.batch.aws_batch import BatchError
+
+        client, mock_batch = _make_client()
+        with pytest.raises(BatchError, match="fully-qualified ECR URL"):
+            client._register_image_override("dayhoff-generic", bad_image)
+
+        mock_batch.describe_job_definitions.assert_not_called()
+        mock_batch.register_job_definition.assert_not_called()
+
+    @pytest.mark.parametrize(
+        "good_image",
+        [
+            "123456789012.dkr.ecr.us-east-1.amazonaws.com/dayhoff-generic:abc123",
+            "123456789012.dkr.ecr.us-west-2.amazonaws.com/foo/bar:latest",
+            "123456789012.dkr.ecr.us-east-1.amazonaws.com/x@sha256:"
+            + "a" * 64,
+        ],
+    )
+    def test_accepts_ecr_url(self, good_image):
+        client, mock_batch = _make_client()
+        mock_batch.describe_job_definitions.return_value = {
+            "jobDefinitions": [
+                {
+                    "jobDefinitionArn": "arn:aws:batch:...:job-definition/dayhoff-generic:1",
+                    "revision": 1,
+                    "type": "container",
+                    "containerProperties": {"image": "old-image"},
+                }
+            ]
+        }
+        mock_batch.register_job_definition.return_value = {
+            "jobDefinitionArn": "arn:aws:batch:...:job-definition/dayhoff-generic:2"
+        }
+
+        client._register_image_override("dayhoff-generic", good_image)
+        mock_batch.register_job_definition.assert_called_once()
+
+
+class TestNoOpReuse:
+    """If latest revision already matches the requested image, reuse it."""
+
+    def test_reuses_latest_when_image_matches(self):
+        client, mock_batch = _make_client()
+        mock_batch.describe_job_definitions.return_value = {
+            "jobDefinitions": [
+                {
+                    "jobDefinitionArn": "arn:...:job-definition/dayhoff-generic:42",
+                    "revision": 42,
+                    "type": "container",
+                    "containerProperties": {"image": _ECR_URL},
+                },
+                {
+                    "jobDefinitionArn": "arn:...:job-definition/dayhoff-generic:41",
+                    "revision": 41,
+                    "type": "container",
+                    "containerProperties": {"image": "older"},
+                },
+            ]
+        }
+
+        arn = client._register_image_override("dayhoff-generic", _ECR_URL)
+
+        assert arn == "arn:...:job-definition/dayhoff-generic:42"
+        mock_batch.register_job_definition.assert_not_called()
+
+    def test_registers_new_revision_when_image_differs(self):
+        client, mock_batch = _make_client()
+        mock_batch.describe_job_definitions.return_value = {
+            "jobDefinitions": [
+                {
+                    "jobDefinitionArn": "arn:...:job-definition/dayhoff-generic:42",
+                    "revision": 42,
+                    "type": "container",
+                    "containerProperties": {"image": "different-image"},
+                }
+            ]
+        }
+        mock_batch.register_job_definition.return_value = {
+            "jobDefinitionArn": "arn:...:job-definition/dayhoff-generic:43"
+        }
+
+        arn = client._register_image_override("dayhoff-generic", _ECR_URL)
+
+        assert arn == "arn:...:job-definition/dayhoff-generic:43"
+        mock_batch.register_job_definition.assert_called_once()
+        kwargs = mock_batch.register_job_definition.call_args[1]
+        assert kwargs["containerProperties"]["image"] == _ECR_URL
+
+    def test_raises_when_no_active_definition(self):
+        from dh_cli.batch.aws_batch import BatchError
+
+        client, mock_batch = _make_client()
+        mock_batch.describe_job_definitions.return_value = {"jobDefinitions": []}
+
+        with pytest.raises(BatchError, match="Job definition not found"):
+            client._register_image_override("dayhoff-generic", _ECR_URL)

dh_cli-0.8.4/tests/batch/test_submit_image_validation.py

@@ -0,0 +1,90 @@
+"""CLI-layer image validation tests for `dh batch submit`.
+
+Pins the contract: a non-ECR --image (or YAML image: ...) is rejected at
+parse time, before any AWS call. Without this, bare names like
+``--image dayhoff-generic`` reach BatchClient and silently mint a JD
+revision pointing at Docker Hub.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+import yaml
+from click.testing import CliRunner
+
+
+@pytest.fixture
+def cli_runner():
+    return CliRunner()
+
+
+def _invoke(cli_runner, args, tmp_path):
+    base = tmp_path / "jobs"
+    with (
+        patch("dh_cli.batch.commands.submit.get_aws_username", return_value="jason"),
+        patch("dh_cli.batch.commands.submit.BatchClient") as mock_batch_cls,
+        patch(
+            "dh_cli.batch.commands.submit.generate_job_id",
+            return_value="jason-batch-20260519-img00001",
+        ),
+    ):
+        mock_client = MagicMock()
+        mock_client.submit_job.return_value = "aws-uuid-img"
+        mock_batch_cls.return_value = mock_client
+
+        from dh_cli.batch.commands.submit import submit
+
+        result = cli_runner.invoke(submit, args + ["--base-path", str(base)])
+        return result, mock_client, mock_batch_cls
+
+
+class TestCliImageValidation:
+    @pytest.mark.parametrize(
+        "bad_image",
+        ["dayhoff-generic", "dayhoff-generic:latest", "ghcr.io/foo/bar:1.0"],
+    )
+    def test_bare_image_rejected_before_submit(self, cli_runner, tmp_path, bad_image):
+        result, _, mock_batch_cls = _invoke(
+            cli_runner,
+            ["--command", "echo hi", "--image", bad_image],
+            tmp_path,
+        )
+        assert result.exit_code != 0
+        assert "fully-qualified ECR URL" in result.output
+        mock_batch_cls.assert_not_called()
+
+    def test_yaml_bare_image_rejected_before_submit(self, cli_runner, tmp_path):
+        config_path = tmp_path / "job.yaml"
+        config_path.write_text(
+            yaml.dump(
+                {
+                    "command": "echo hi",
+                    "image": "dayhoff-generic",
+                }
+            )
+        )
+        result, _, mock_batch_cls = _invoke(
+            cli_runner, ["-f", str(config_path)], tmp_path
+        )
+        assert result.exit_code != 0
+        assert "fully-qualified ECR URL" in result.output
+        mock_batch_cls.assert_not_called()
+
+    def test_valid_ecr_url_accepted(self, cli_runner, tmp_path):
+        good = "123456789012.dkr.ecr.us-east-1.amazonaws.com/dayhoff-generic:abc"
+        result, mock_client, _ = _invoke(
+            cli_runner,
+            ["--command", "echo hi", "--image", good],
+            tmp_path,
+        )
+        assert result.exit_code == 0, result.output
+        call_kwargs = mock_client.submit_job.call_args[1]
+        assert call_kwargs["image_override"] == good
+
+    def test_no_image_skips_validation(self, cli_runner, tmp_path):
+        result, mock_client, _ = _invoke(
+            cli_runner, ["--command", "echo hi"], tmp_path
+        )
+        assert result.exit_code == 0, result.output
+        call_kwargs = mock_client.submit_job.call_args[1]
+        assert call_kwargs.get("image_override") is None

{dh_cli-0.8.3 → dh_cli-0.8.4}/tests/test_finalize_boltz_tar.py

@@ -32,9 +32,7 @@ def _build_essential_tar(tar_path: Path, complex_name: str) -> None:
         pred_subdir = src_p / f"boltz_results_{complex_name}" / "predictions" / complex_name
         pred_subdir.mkdir(parents=True)
         (pred_subdir / f"{complex_name}_model_0.cif").write_text(f"CIF {complex_name}\n")
-        (pred_subdir / f"confidence_{complex_name}_model_0.json").write_text(
-            f'{{"cx":"{complex_name}"}}'
-        )
+        (pred_subdir / f"confidence_{complex_name}_model_0.json").write_text(f'{{"cx":"{complex_name}"}}')
         with tarfile.open(tar_path, mode="w") as tf:
             root = src_p / f"boltz_results_{complex_name}"
             for f in sorted(root.rglob("*")):
@@ -188,12 +186,8 @@ class TestFinalizeDispatches:
         runner = CliRunner()
 
         with patch("dh_cli.batch.commands.finalize.load_manifest", return_value=manifest):
-            with patch(
-                "dh_cli.batch.commands.finalize._download_boltz_s3_output"
-            ) as mock_tar_download:
-                with patch(
-                    "dh_cli.batch.commands.finalize._check_completion", return_value=[]
-                ):
+            with patch("dh_cli.batch.commands.finalize._download_boltz_s3_output") as mock_tar_download:
+                with patch("dh_cli.batch.commands.finalize._check_completion", return_value=[]):
                     with patch("dh_cli.batch.commands.finalize._finalize_boltz") as mock_fb:
                         with patch("dh_cli.batch.commands.finalize.save_manifest_s3"):
                             result = runner.invoke(
@@ -230,16 +224,10 @@ class TestFinalizeDispatches:
         runner = CliRunner()
 
         with patch("dh_cli.batch.commands.finalize.load_manifest", return_value=manifest):
-            with patch(
-                "dh_cli.batch.commands.finalize._download_boltz_s3_output"
-            ) as mock_tar_download:
+            with patch("dh_cli.batch.commands.finalize._download_boltz_s3_output") as mock_tar_download:
                 with patch("dh_cli.batch.s3_transport.download_directory") as mock_dd:
-                    with patch(
-                        "dh_cli.batch.commands.finalize._check_completion", return_value=[]
-                    ):
-                        with patch(
-                            "dh_cli.batch.commands.finalize._finalize_embeddings"
-                        ) as mock_fe:
+                    with patch("dh_cli.batch.commands.finalize._check_completion", return_value=[]):
+                        with patch("dh_cli.batch.commands.finalize._finalize_embeddings") as mock_fe:
                             with patch("dh_cli.batch.commands.finalize.save_manifest_s3"):
                                 result = runner.invoke(
                                     finalize_cmd,