vivarium-workbench 0.3.88__tar.gz

vivarium_workbench-0.3.88/.dockerignore

@@ -0,0 +1,35 @@
+# Keep the build context small — the image installs the workbench package (built
+# by hatchling from pyproject), not the whole repo. Exclude VCS, envs, caches,
+# and material not needed to build/run the workbench.
+.git
+.github
+.venv
+venv
+**/__pycache__
+**/*.pyc
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.idea
+.vscode
+.claude
+.superpowers
+
+# Docs, demos, and the deploy manifests are not part of the runtime image.
+docs
+demos
+deploy
+
+# Test fixtures can be large and are not needed at runtime.
+tests/_fixtures
+
+# Local scratch / build artifacts
+*.egg-info
+dist
+build
+
+# Vendored bigraph-loom (Task 8) build outputs — rebuilt in-image by
+# scripts/build_loom.sh; a host-built copy would bloat the context and could
+# be stale/platform-mismatched.
+vivarium_workbench/loom/node_modules
+vivarium_workbench/loom/_dist

vivarium_workbench-0.3.88/.github/workflows/build-and-push.yml

@@ -0,0 +1,133 @@
+name: Build and Push Image
+
+# Builds the vivarium-workbench server image (linux/amd64, for the EKS nodes) and
+# pushes it to ghcr.io.
+#
+# Since #932 the image contains only the workbench and its own locked
+# dependencies -- no workspace package, no science stack. That removed the two
+# things that made this workflow unusable:
+#
+#   * It no longer copies a venv out of a per-commit sms-ecoli/v2ecoli image, so
+#     there is nothing to pull from GovCloud ECR -- for which this runner has no
+#     credential (no OIDC federation from GitHub Actions into that account
+#     exists, and building one is real, separate infra work). The
+#     `workspace_image` input is therefore GONE, not merely optional.
+#   * The build no longer imports v2ecoli -> polars, so it does not need AVX and
+#     is not tied to a native amd64 runner for correctness (it still runs on one,
+#     which is simply faster than emulation).
+#
+# Release-triggering is still deliberately absent. v0.3.38 shipped a real,
+# confirmed-broken tag+Release from an automatic run; cutting a Release here is
+# documentation, and the image is published by this manual dispatch (or by
+# `deploy/build-and-push.sh`, the same command this workflow runs).
+#
+# Version provenance (#1114): a semver `version` input is gated -- it must be
+# dispatched from `main`, match `pyproject.toml` exactly, and have an existing
+# `v<version>` tag pointing at the exact checked-out commit, and the ghcr tag
+# must not already exist. `deploy/bump-and-release.sh` produces all of this
+# correctly in one command; a bare `version` input typed into the dispatch form
+# by hand will fail this gate unless it already satisfies it. An empty
+# `version` (short-sha build) is exempt -- it is self-describing already.
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag to build+push (default: git short sha)"
+        required: false
+        default: ""
+      pbg_ptools_ref:
+        description: "git ref for the pbg-ptools Omics-Viewer plugin (default: main)"
+        required: false
+        default: "main"
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write   # push to ghcr.io
+    steps:
+      # Kept but no longer critical: the image is ~744 MB since #932 (was ~15 GB).
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: true
+          large-packages: true
+          docker-images: false
+          swap-storage: false
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Both required for the provenance gate below: fetch-depth:0 for the
+          # full commit history (v<version> may not be a recent commit), and
+          # fetch-tags explicitly since actions/checkout does not reliably
+          # fetch tags from fetch-depth alone.
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          # Reuse the org GHCR_PAT (as sms-api does); fall back to GITHUB_TOKEN.
+          password: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Enforce version provenance (#1114)
+        run: |
+          set -euo pipefail
+          VERSION="${{ inputs.version }}"
+          VERSION="${VERSION#v}"
+
+          if [[ -z "${VERSION}" ]]; then
+            echo "no version given -- short-sha build, self-describing, provenance rule does not apply"
+            exit 0
+          fi
+
+          if [[ ! "${VERSION}" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "'${VERSION}' is not strict X.Y.Z semver -- omit version for a short-sha build, or use deploy/bump-and-release.sh" >&2
+            exit 1
+          fi
+
+          if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then
+            echo "a semver version must be dispatched from main (this run's ref: ${GITHUB_REF}) -- deploy/bump-and-release.sh does this for you" >&2
+            exit 1
+          fi
+
+          PYPROJECT_VERSION="$(grep -m1 '^version = ' pyproject.toml | sed -E 's/^version = "(.*)"$/\1/')"
+          if [[ "${PYPROJECT_VERSION}" != "${VERSION}" ]]; then
+            echo "pyproject.toml says ${PYPROJECT_VERSION}, dispatch asked for ${VERSION} -- these must match exactly" >&2
+            exit 1
+          fi
+
+          TAG_SHA="$(git rev-list -n1 "v${VERSION}" 2>/dev/null || true)"
+          if [[ -z "${TAG_SHA}" ]]; then
+            echo "tag v${VERSION} does not exist -- deploy/bump-and-release.sh creates it before dispatching" >&2
+            exit 1
+          fi
+          HEAD_SHA="$(git rev-parse HEAD)"
+          if [[ "${TAG_SHA}" != "${HEAD_SHA}" ]]; then
+            echo "tag v${VERSION} (${TAG_SHA}) does not point at the checked-out commit (${HEAD_SHA}) -- the tag and the build would be provably different things" >&2
+            exit 1
+          fi
+
+          if docker manifest inspect "ghcr.io/${{ github.repository_owner }}/vivarium-workbench:${VERSION}" >/dev/null 2>&1; then
+            echo "ghcr.io/${{ github.repository_owner }}/vivarium-workbench:${VERSION} already exists -- never silently overwrite a published image" >&2
+            exit 1
+          fi
+
+          echo "provenance OK: v${VERSION} == pyproject.toml == HEAD (${HEAD_SHA}), ghcr tag unused"
+
+      - name: Build + push (linux/amd64)
+        env:
+          PBG_PTOOLS_REF: ${{ inputs.pbg_ptools_ref }}
+        run: |
+          set -euo pipefail
+          chmod +x deploy/build-and-push.sh
+          VERSION="${{ inputs.version }}"
+          VERSION="${VERSION#v}"   # strip a leading v -> matches sms-api newTag (e.g. 0.1.0)
+          deploy/build-and-push.sh "$VERSION"

vivarium_workbench-0.3.88/.github/workflows/js.yml

@@ -0,0 +1,30 @@
+name: js
+
+# Frontend unit tests (tests/js/). The dashboard's static/*.js has no bundler
+# and no framework — these are plain Node scripts (require + assert). The audit
+# flagged that the one existing JS test was never wired to run at all; this is
+# that wiring. Fast (seconds), so it's its own check rather than folded into the
+# Python suite.
+#
+# Scope is deliberately small for now: run the existing tests/js/ files. Broader
+# coverage of the large unverified frontend (walkthrough.js et al.) is later
+# hardening work, not this job.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  js:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      # node is preinstalled on ubuntu-latest; setup-node pins it and makes the
+      # version explicit/upgradable rather than implicit.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: run JS tests
+        run: bash scripts/run_js_tests.sh

vivarium_workbench-0.3.88/.github/workflows/pytest.yml

@@ -0,0 +1,102 @@
+name: pytest
+
+# The full test suite as a PR gate.
+#
+# Until now CI ran `types.yml` only: mypy, import-linter, and FOUR named test
+# files out of 285. The other ~98% of the suite never ran on a PR, so it rotted
+# silently — switching it on surfaced 77 failures that predated any single
+# change, including a companion-library API drift that had been broken for
+# weeks and a feature that was inert in production.
+#
+# This gate runs everything except the tests listed in tests/known_failures.txt
+# (see that file: the list is documented, justified, and meant to shrink). A
+# second, non-blocking job runs exactly the quarantined set so that a test which
+# starts passing becomes visible instead of sitting on the list forever.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  suite:
+    # 4 shards x 4 cores each = ~16-way parallelism. Two levels, because each
+    # alone leaves time on the table: a single job caps at the runner's 4 cores
+    # (~6 min), while sharding without xdist wastes 3 of every 4 cores. Shards
+    # are duration-balanced via .test_durations — see scripts/pytest_gate.sh.
+    name: suite ${{ matrix.group }}/4
+    runs-on: ubuntu-latest
+    strategy:
+      # Run every shard even when one fails: a single red shard should still
+      # tell you about failures in the other three, or you fix them one round
+      # trip at a time.
+      fail-fast: false
+      matrix:
+        group: [1, 2, 3, 4]
+    timeout-minutes: 20
+    # Same interpreter pin as types.yml: the demo extra pulls v2ecoli, which is
+    # pinned ==3.12.12, so the lock resolves for that one environment.
+    env:
+      UV_PYTHON: "3.12.12"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install (locked)
+        # --frozen: install straight from uv.lock without re-resolving, so the
+        # `demo` extra's editable path sources (../v2ecoli, ../pbg-ptools) — not
+        # checked out in CI — are never touched.
+        #
+        # `test` (polars/pyarrow/zarr) is REQUIRED here, unlike in types.yml:
+        # without it 11 tests fail rather than skip, because the parquet/zarr
+        # readers are missing entirely.
+        run: uv sync --frozen --extra dev --extra test
+      - name: pytest (shard ${{ matrix.group }}/4, quarantine deselected)
+        # Serial single-job was ~14 min, xdist-only ~6 min. Sharding divides the
+        # remaining test time by 4; the ~45s of checkout+sync is paid per shard
+        # but runs concurrently, so it does not add to wall time.
+        env:
+          PYTEST_SPLITS: "4"
+          PYTEST_GROUP: ${{ matrix.group }}
+        run: uv run --frozen bash scripts/pytest_gate.sh
+
+  suite-result:
+    # Single stable check for branch protection to require. Without this you'd
+    # have to require each `suite N/4` by name, and changing the shard count
+    # would silently un-require the ones that no longer exist — the gate would
+    # look configured while enforcing nothing.
+    name: suite
+    needs: suite
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check shard results
+        run: |
+          if [[ "${{ needs.suite.result }}" != "success" ]]; then
+            echo "::error::one or more test shards failed (${{ needs.suite.result }})"
+            exit 1
+          fi
+          echo "all shards passed"
+
+  quarantined:
+    name: quarantine watch
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    # Reports on the known-failing set. Deliberately GREEN when they all still
+    # fail, because a check that is red on every PR by design teaches everyone
+    # to ignore red — which would defeat the gate above. It surfaces the
+    # actionable case instead: a quarantined test that starts PASSING, and can
+    # therefore be deleted from tests/known_failures.txt. Details land in the
+    # job summary.
+    env:
+      UV_PYTHON: "3.12.12"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install (locked)
+        run: uv sync --frozen --extra dev --extra test
+      - name: pytest (quarantined only)
+        run: uv run --frozen bash scripts/pytest_gate.sh --only-known

vivarium_workbench-0.3.88/.github/workflows/release.yml

@@ -0,0 +1,29 @@
+name: release
+on:
+  push:
+    tags: ["v*"]
+permissions:
+  id-token: write   # for PyPI trusted publishing
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Node is needed because the hatchling build hook (hatch_build.py) builds
+      # the vendored bigraph-loom bundle (vivarium_workbench/loom/_dist) into the
+      # wheel. VIVARIUM_WORKBENCH_REQUIRE_LOOM=1 (below) makes a missing bundle a
+      # hard error on the publish path, so the shipped Explorer is never blank.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        run: pip install uv
+      - name: Build (loom bundle required)
+        env:
+          VIVARIUM_WORKBENCH_REQUIRE_LOOM: "1"
+        run: uv build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

vivarium_workbench-0.3.88/.github/workflows/types.yml

@@ -0,0 +1,43 @@
+name: types
+
+# Keeps the pydantic payload models honest: mypy on the typed modules + the
+# model tests that validate real handler output against them. Scoped, fast gate;
+# broader pytest CI can be added as a separate workflow later.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  types:
+    runs-on: ubuntu-latest
+    # Pin the interpreter to 3.12.12: the demo track adds
+    # `[tool.uv] environments = "python_full_version == '3.12.12'"` (the demo
+    # extra pulls v2ecoli, which is pinned ==3.12.12), so the lock resolves for
+    # that one environment. uv fetches this managed CPython automatically.
+    env:
+      UV_PYTHON: "3.12.12"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install (locked)
+        # --frozen: install straight from uv.lock without re-resolving, so the
+        # `demo` extra's editable path sources (../v2ecoli, ../pbg-ptools) — not
+        # checked out in CI — are never touched. This gate only needs `dev`.
+        run: uv sync --frozen --extra dev
+      - name: ruff (F + E722 correctness gate, shipped packages)
+        # Behaviour-only lint (pyflakes + bare-except): undefined names, unused
+        # imports/vars, duplicate defs. Config in [tool.ruff.lint]. Scoped to the
+        # shipped packages; the test tree is not yet under the gate.
+        # `--with` layers a pinned ruff onto the frozen env without adding it to
+        # uv.lock (re-locking this repo needs a sandbox worktree — avoided here).
+        run: uv run --frozen --with "ruff==0.16.2" ruff check vivarium_workbench vivarium_dashboard
+      - name: mypy (typed modules)
+        run: uv run --frozen mypy
+      - name: import-linter (ports & adapters layering)
+        run: uv run --frozen lint-imports
+      - name: Payload-model + generated-TS + API + lib tests
+        run: uv run --frozen pytest tests/test_payload_models.py tests/test_generate_ts.py tests/test_api_app.py tests/test_investigation_status.py -q

vivarium_workbench-0.3.88/.gitignore

@@ -0,0 +1,36 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+*.egg
+.eggs/
+build/
+dist/
+wheels/
+.venv/
+venv/
+env/
+
+# Tests
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+
+# Editor
+.idea/
+.vscode/
+*.swp
+.DS_Store
+todo.md
+.superpowers/
+.perspective.md
+.claude/*
+*/node_modules/*
+.todo/_backlog.md
+.todo/backlog/
+
+# Vendored bigraph-loom (Task 8): build outputs, not source.
+vivarium_workbench/loom/node_modules/
+vivarium_workbench/loom/_dist

vivarium_workbench-0.3.88/.python-version

@@ -0,0 +1 @@
+3.12.12