modelaudit 0.2.36__tar.gz → 0.2.38__tar.gz

modelaudit-0.2.38/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+# Summary
+
+Describe the change and user impact.
+
+## Validation
+
+- [ ] `uv run ruff format --check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/`
+- [ ] `uv run ruff check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/`
+- [ ] `uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/`
+- [ ] `uv run pytest -n auto -m "not slow and not integration" --maxfail=1`
+
+## Checklist
+
+- [ ] I followed the security-first guidelines in `AGENTS.md`.
+- [ ] I did not weaken detection behavior.
+- [ ] I added/updated tests when behavior changed.
+- [ ] I updated docs where needed.

modelaudit-0.2.38/.github/workflows/README.md

@@ -0,0 +1,17 @@
+# GitHub Actions Workflows
+
+| Workflow                   | File                    | Triggers                                  |
+| -------------------------- | ----------------------- | ----------------------------------------- |
+| **Python CI**              | `test.yml`              | Python, workflow, and dependency changes  |
+| **Performance Benchmarks** | `perf.yml`              | PRs, pushes to main, manual dispatch      |
+| **Documentation Check**    | `docs-check.yml`        | Markdown/text/RST/license changes         |
+| **Docker Image CI**        | `docker-image-test.yml` | Dockerfile or Python code changes         |
+| **Validate PR Title**      | `validate-pr-title.yml` | PR open/edit events                       |
+| **CodeQL**                 | `codeql.yml`            | Pushes, PRs, weekly schedule, manual runs |
+| **Nightly CI**             | `nightly.yml`           | Nightly schedule and manual dispatch      |
+| **Release**                | `release-please.yml`    | Pushes to main and manual dispatch        |
+| **Docker Publish**         | `docker-publish.yml`    | Published releases and manual dispatch    |
+
+Python CI ignores documentation-only PRs, which are handled by the documentation check workflow. Code PRs run fast feedback on Python 3.12, root matrix coverage on Python 3.10 and 3.13, the NumPy compatibility lane on Python 3.10 and 3.11, Windows tests on Python 3.11, and the standalone pickle package matrix on Python 3.10-3.13. Pushes to `main` run the full root and NumPy matrices across Python 3.10-3.13.
+
+The performance workflow posts a sticky benchmark summary comment on same-repo PRs, uploads benchmark JSON plus Markdown summaries as workflow artifacts, and reports regressions or missing benchmarks without blocking the PR.

modelaudit-0.2.38/.github/workflows/codeql.yml

@@ -0,0 +1,63 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Run weekly on Monday at 06:00 UTC
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze-python:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        with:
+          languages: python
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        with:
+          category: "/language:python"
+          upload: ${{ github.event.pull_request.head.repo.fork == true && 'never' || 'always' }}
+
+  analyze-actions:
+    name: Analyze GitHub Actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        with:
+          languages: actions
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        with:
+          category: "/language:actions"
+          upload: ${{ github.event.pull_request.head.repo.fork == true && 'never' || 'always' }}

modelaudit-0.2.38/.github/workflows/docker-image-test.yml

@@ -0,0 +1,200 @@
+name: Docker Image CI
+
+on:
+  pull_request:
+    paths:
+      - "Dockerfile*"
+      - ".dockerignore"
+      - "modelaudit/**"
+      - "packages/modelaudit-picklescan/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/docker-image-test.yml"
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  # Detect what changed to optimize Docker builds
+  changes:
+    name: Detect Docker Changes
+    runs-on: ubuntu-latest
+    outputs:
+      docker: ${{ steps.filter.outputs.docker }}
+      full-image: ${{ steps.filter.outputs.full-image }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            docker:
+              - 'Dockerfile*'
+              - '.dockerignore'
+              - 'modelaudit/**'
+              - 'packages/modelaudit-picklescan/**'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - '.github/workflows/docker-image-test.yml'
+            full-image:
+              - 'Dockerfile.full'
+              - 'packages/modelaudit-picklescan/**'
+              - '.github/workflows/docker-image-test.yml'
+
+  build-test-lightweight:
+    name: Build and Test Lightweight Docker Image
+    needs: changes
+    # Only run if Docker-related files changed
+    if: needs.changes.outputs.docker == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30 # Increased for reliability
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Build lightweight image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          file: Dockerfile
+          tags: modelaudit:lightweight
+          load: true
+          cache-from: type=gha,scope=lightweight
+          cache-to: type=gha,mode=max,scope=lightweight
+          build-args: |
+            BUILDKIT_INLINE_CACHE=1
+
+      - name: Test lightweight container help command
+        run: |
+          docker run --rm modelaudit:lightweight --help
+
+      - name: Test lightweight container scan help
+        run: |
+          docker run --rm modelaudit:lightweight scan --help
+
+      - name: Test lightweight container version
+        run: |
+          # Test that the package is properly installed
+          docker run --rm modelaudit:lightweight --version
+
+      - name: Test lightweight container with invalid command
+        run: |
+          # This should fail gracefully
+          docker run --rm modelaudit:lightweight invalid-command && exit 1 || echo "Command properly rejected invalid input"
+
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        with:
+          # Pin an explicit released Trivy binary to avoid setup failures when
+          # auto-resolved tags exist without matching release assets.
+          version: v0.69.2
+          image-ref: modelaudit:lightweight
+          format: table
+          exit-code: "1"
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+
+      - name: Test lightweight container with actual scan
+        run: |
+          # Create a test model file using Docker to ensure Python is available
+          docker run --rm -v $(pwd):/data python:3.11-slim@sha256:543d6cace00ffc96bc95d332493bb28a4332c6dd614aab5fcbd649ae8a7953d9 sh -c "python -c \"import pickle; pickle.dump({'test': 'data'}, open('/data/test.pkl', 'wb'))\""
+          # Now scan the created file
+          docker run --rm -v $(pwd):/data modelaudit:lightweight /data/test.pkl
+
+  build-test-full:
+    name: Build and Test Full Docker Image
+    needs: [changes, build-test-lightweight]
+    runs-on: ubuntu-latest
+    timeout-minutes: 90 # Increased for large ML dependency builds
+    # Only run if Dockerfile.full specifically changed
+    if: needs.changes.outputs.full-image == 'true'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Build full image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          file: Dockerfile.full
+          tags: modelaudit:full
+          load: true
+          cache-from: type=gha,scope=full
+          cache-to: type=gha,mode=max,scope=full
+          build-args: |
+            BUILDKIT_INLINE_CACHE=1
+        timeout-minutes: 60 # Increased timeout for ML dependency build
+
+      - name: Test full container help command
+        run: |
+          docker run --rm modelaudit:full --help
+
+      - name: Test full container scan help
+        run: |
+          docker run --rm modelaudit:full scan --help
+
+      - name: Test full container version
+        run: |
+          # Test that the package is properly installed
+          docker run --rm modelaudit:full --version
+
+      - name: Test full container runs as non-root
+        run: |
+          docker run --rm modelaudit:full python -c "import os; uid = os.getuid(); print(f'Container UID: {uid}'); assert uid == 10001"
+
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        with:
+          # Keep full-image scan on the same pinned released Trivy version.
+          version: v0.69.2
+          image-ref: modelaudit:full
+          format: table
+          exit-code: "1"
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+
+      - name: Verify ML dependencies in full image
+        run: |
+          # Test that ML dependencies are available
+          docker run --rm modelaudit:full python -c "import tensorflow, torch, onnx; print('All ML dependencies available')" || echo "Warning: Some ML dependencies missing"
+
+      - name: Test full container with ML model scan
+        run: |
+          # Create the fixture with a root Python image because the full image intentionally runs as UID 10001.
+          docker run --rm -v $(pwd):/data python:3.11-slim@sha256:543d6cace00ffc96bc95d332493bb28a4332c6dd614aab5fcbd649ae8a7953d9 sh -c "python -c \"import pickle; pickle.dump({'test': 'data', 'numbers': [1, 2, 3]}, open('/data/test_numpy.pkl', 'wb')); print('Created test model')\""
+          # Scan the bind-mounted model as the non-root full image.
+          docker run --rm -v $(pwd):/data modelaudit:full /data/test_numpy.pkl
+
+  docker-ci-success:
+    name: Docker CI Success
+    needs: [build-test-lightweight]
+    # Don't require full image test to pass since it's conditional
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if required jobs succeeded
+        run: |
+          LIGHTWEIGHT_RESULT="${{ needs.build-test-lightweight.result }}"
+          echo "Lightweight Docker build result: $LIGHTWEIGHT_RESULT"
+
+          # Success or skipped are both acceptable
+          # (skipped means the path filters determined the job wasn't needed)
+          if [[ "$LIGHTWEIGHT_RESULT" == "success" || "$LIGHTWEIGHT_RESULT" == "skipped" ]]; then
+            echo "Docker CI checks passed (or were skipped due to path filters)!"
+            exit 0
+          else
+            echo "Docker CI checks failed!"
+            exit 1
+          fi

modelaudit-0.2.38/.github/workflows/docker-publish.yml

@@ -0,0 +1,70 @@
+name: Docker Publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag (e.g., 0.2.26)"
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  publish:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+            type=raw,value=${{ inputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      - name: Build and push lightweight image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=publish-lightweight
+          cache-to: type=gha,mode=max,scope=publish-lightweight
+
+      - name: Verify published image
+        run: |
+          # Pull and verify the image works
+          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${GITHUB_SHA::7}
+          docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${GITHUB_SHA::7} --version

modelaudit-0.2.38/.github/workflows/docs-check.yml

@@ -0,0 +1,75 @@
+name: Documentation Check
+
+on:
+  pull_request:
+    paths:
+      - "**.md"
+      - "**.txt"
+      - "**.rst"
+      - "LICENSE*"
+      - ".github/workflows/docs-check.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "**.md"
+      - "**.txt"
+      - "**.rst"
+      - "LICENSE*"
+      - ".github/workflows/docs-check.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  format-check:
+    name: Check Documentation Formatting
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47
+        with:
+          files: |
+            **.md
+            **.yaml
+            **.yml
+            **.json
+
+      - name: Setup Node.js
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "24"
+
+      - name: Install Node dependencies
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: npm ci --ignore-scripts
+
+      - name: Check markdown formatting with prettier
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "Checking formatting for changed files:"
+          echo "${{ steps.changed-files.outputs.all_changed_files }}"
+          npx prettier --check ${{ steps.changed-files.outputs.all_changed_files }} || (
+            echo "Documentation is not properly formatted. Run:"
+            echo "npm ci --ignore-scripts && npx prettier --write '**/*.{md,yaml,yml,json}'"
+            exit 1
+          )
+
+      - name: Skip if no relevant files changed
+        if: steps.changed-files.outputs.any_changed == 'false'
+        run: echo "No documentation files changed, skipping formatting check"
+
+      - name: Check for broken links in markdown
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
+        with:
+          use-quiet-mode: "yes"
+          use-verbose-mode: "no"
+          config-file: ".github/markdown-link-check-config.json"
+        continue-on-error: true # Don't fail on broken external links

modelaudit-0.2.38/.github/workflows/nightly.yml

@@ -0,0 +1,81 @@
+name: Nightly CI
+
+on:
+  schedule:
+    # Run daily at 04:00 UTC
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  full-matrix:
+    name: Full Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          enable-cache: true
+
+      - name: Pin Python version
+        run: |
+          uv python pin ${{ matrix.python-version }}
+
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+
+      - name: Sync dependencies
+        run: |
+          uv sync --extra all-ci
+
+      - name: Run standalone picklescan Rust tests
+        run: |
+          cargo test --manifest-path packages/modelaudit-picklescan/Cargo.toml
+
+      - name: Run all tests (fast + slow + integration + performance)
+        run: |
+          uv run pytest -n auto --tb=short --durations=20
+
+  windows-full:
+    name: Windows Full Tests (Python 3.11)
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+
+      - name: Pin Python version
+        run: |
+          uv python pin 3.11
+
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+
+      - name: Sync dependencies
+        run: |
+          uv sync --extra all-ci-windows
+
+      - name: Run standalone picklescan Rust tests
+        run: |
+          cargo test --manifest-path packages/modelaudit-picklescan/Cargo.toml
+
+      - name: Run all tests
+        run: |
+          uv run pytest -n auto --tb=short --durations=20