modelaudit 0.2.44__tar.gz → 0.2.46__tar.gz

{modelaudit-0.2.44 → modelaudit-0.2.46}/.github/workflows/README.md

@@ -14,4 +14,9 @@
 
 Python CI ignores documentation-only PRs, which are handled by the documentation check workflow. Code PRs run fast feedback on Python 3.12, root matrix coverage on Python 3.10 and 3.13, the NumPy compatibility lane on Python 3.10 and 3.11, Windows tests on Python 3.11, and the standalone pickle package matrix on Python 3.10-3.13. Pushes to `main` run the full root and NumPy matrices across Python 3.10-3.13.
 
-The performance workflow posts a sticky benchmark summary comment on same-repo PRs, uploads benchmark JSON plus Markdown summaries as workflow artifacts, and reports regressions or missing benchmarks without blocking the PR.
+The performance workflow compares workload-oriented benchmarks between the PR
+base and head, posts a sticky summary comment on same-repo PRs, uploads JSON and
+Markdown artifacts, and reports comparative regressions without blocking the
+PR. It separately runs the cache-disabled retained-memory stability guard from
+`tests/test_performance_benchmarks.py`, which fails the workflow if repeat scans
+retain excessive memory.

{modelaudit-0.2.44 → modelaudit-0.2.46}/.github/workflows/docker-image-test.yml

@@ -8,6 +8,7 @@ on:
       - "modelaudit/**"
       - "packages/modelaudit-picklescan/**"
       - "pyproject.toml"
+      - "requirements-tensorflow.txt"
       - "uv.lock"
       - ".github/workflows/docker-image-test.yml"
   push:
@@ -27,6 +28,7 @@ jobs:
     outputs:
       docker: ${{ steps.filter.outputs.docker }}
       full-image: ${{ steps.filter.outputs.full-image }}
+      tensorflow-image: ${{ steps.filter.outputs.tensorflow-image }}
     steps:
       - uses: actions/checkout@v6
       - uses: dorny/paths-filter@v4
@@ -45,6 +47,12 @@ jobs:
               - 'Dockerfile.full'
               - 'packages/modelaudit-picklescan/**'
               - '.github/workflows/docker-image-test.yml'
+            tensorflow-image:
+              - 'Dockerfile.tensorflow'
+              - 'requirements-tensorflow.txt'
+              - 'modelaudit/**'
+              - 'pyproject.toml'
+              - '.github/workflows/docker-image-test.yml'
 
   build-test-lightweight:
     name: Build and Test Lightweight Docker Image
@@ -177,9 +185,49 @@ jobs:
           # Scan the bind-mounted model as the non-root full image.
           docker run --rm -v $(pwd):/data modelaudit:full /data/test_numpy.pkl
 
+  build-test-tensorflow:
+    name: Build and Test TensorFlow Docker Image
+    needs: changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    if: needs.changes.outputs.tensorflow-image == 'true'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Build TensorFlow image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          file: Dockerfile.tensorflow
+          tags: modelaudit:tensorflow
+          load: true
+          cache-from: type=gha,scope=tensorflow
+          cache-to: type=gha,mode=max,scope=tensorflow
+
+      - name: Test TensorFlow container help command
+        run: |
+          docker run --rm modelaudit:tensorflow --help
+
+      - name: Verify TensorFlow dependency and non-root runtime
+        run: |
+          docker run --rm --entrypoint python modelaudit:tensorflow -c "import os, tensorflow; print(tensorflow.__version__); assert os.getuid() == 10001"
+
+      - name: Scan TensorFlow image for vulnerabilities
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        with:
+          version: v0.69.2
+          image-ref: modelaudit:tensorflow
+          format: table
+          exit-code: "1"
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+
   docker-ci-success:
     name: Docker CI Success
-    needs: [build-test-lightweight, build-test-full]
+    needs: [build-test-lightweight, build-test-full, build-test-tensorflow]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -187,13 +235,16 @@ jobs:
         run: |
           LIGHTWEIGHT_RESULT="${{ needs.build-test-lightweight.result }}"
           FULL_RESULT="${{ needs.build-test-full.result }}"
+          TENSORFLOW_RESULT="${{ needs.build-test-tensorflow.result }}"
           echo "Lightweight Docker build result: $LIGHTWEIGHT_RESULT"
           echo "Full Docker build result: $FULL_RESULT"
+          echo "TensorFlow Docker build result: $TENSORFLOW_RESULT"
 
           # Success or skipped are both acceptable
           # (skipped means the path filters determined the job wasn't needed)
           if [[ ("$LIGHTWEIGHT_RESULT" == "success" || "$LIGHTWEIGHT_RESULT" == "skipped") && \
-                ("$FULL_RESULT" == "success" || "$FULL_RESULT" == "skipped") ]]; then
+                ("$FULL_RESULT" == "success" || "$FULL_RESULT" == "skipped") && \
+                ("$TENSORFLOW_RESULT" == "success" || "$TENSORFLOW_RESULT" == "skipped") ]]; then
             echo "Docker CI checks passed (or were skipped due to path filters)!"
             exit 0
           else

{modelaudit-0.2.44 → modelaudit-0.2.46}/.github/workflows/nightly.yml

@@ -76,6 +76,6 @@ jobs:
         run: |
           cargo test --manifest-path packages/modelaudit-picklescan/Cargo.toml
 
-      - name: Run all tests
+      - name: Run all Windows tests except performance benchmarks
         run: |
-          uv run pytest -n auto --tb=short --durations=20
+          uv run pytest -n auto -m "not performance" --tb=short --durations=20

{modelaudit-0.2.44 → modelaudit-0.2.46}/.github/workflows/perf.yml

@@ -9,6 +9,7 @@ on:
       - "tests/helpers/**"
       - "tests/conftest.py"
       - "tests/test_benchmark_report.py"
+      - "tests/test_performance_benchmarks.py"
       - "scripts/benchmark_report.py"
       - "pyproject.toml"
       - "uv.lock"
@@ -23,6 +24,7 @@ on:
       - "tests/helpers/**"
       - "tests/conftest.py"
       - "tests/test_benchmark_report.py"
+      - "tests/test_performance_benchmarks.py"
       - "scripts/benchmark_report.py"
       - "pyproject.toml"
       - "uv.lock"
@@ -153,6 +155,14 @@ jobs:
           cat "$BENCHMARK_ARTIFACT_DIR/benchmark-current.md" >> "$BENCHMARK_ARTIFACT_DIR/benchmark-summary.md"
           cat "$BENCHMARK_ARTIFACT_DIR/benchmark-summary.md" >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Run retained-memory stability guard
+        env:
+          PROMPTFOO_DISABLE_TELEMETRY: "1"
+        run: |
+          uv run --locked --with psutil pytest \
+            tests/test_performance_benchmarks.py::TestPerformanceBenchmarks::test_memory_usage_stability \
+            -q
+
       - name: Comment benchmark summary on PR
         if: >
           always() &&

{modelaudit-0.2.44 → modelaudit-0.2.46}/.github/workflows/test.yml

@@ -380,7 +380,9 @@ jobs:
     # Always run for fastest feedback
     if: github.ref == 'refs/heads/main' || needs.changes.outputs.python == 'true' || needs.changes.outputs.workflows == 'true'
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    # The full fast suite can approach 30 minutes on hosted runners when the
+    # bounded-replay security regressions land on the long-running worker.
+    timeout-minutes: 35
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -424,7 +426,7 @@ jobs:
     needs: changes
     if: github.ref == 'refs/heads/main' || needs.changes.outputs.python == 'true' || needs.changes.outputs.workflows == 'true'
     runs-on: windows-latest
-    timeout-minutes: 30
+    timeout-minutes: 40
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -455,7 +457,7 @@ jobs:
     # Only run if Python files changed
     if: github.ref == 'refs/heads/main' || needs.changes.outputs.python == 'true' || needs.changes.outputs.workflows == 'true'
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 35
     strategy:
       matrix:
         # For PRs, only test min and max Python versions to save time

modelaudit-0.2.46/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.46",
+  "packages/modelaudit-picklescan": "0.1.6"
+}

{modelaudit-0.2.44 → modelaudit-0.2.46}/AGENTS.md

@@ -18,7 +18,7 @@ This repo publishes **two PyPI packages with independent versions**:
 | `modelaudit`            | `./` (root)                       | `pyproject.toml` + `uv.lock`    | `CHANGELOG.md`                                |
 | `modelaudit-picklescan` | `packages/modelaudit-picklescan/` | `pyproject.toml` + `Cargo.toml` | `packages/modelaudit-picklescan/CHANGELOG.md` |
 
-Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.0,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
+Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.4,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
 
 ## Mission & Principles