Skip to content

Commit 6fe663b

Browse files
saichandrapandrajusaichandrapandraju
authored
Merge pull request trustyai-explainability#138 from trustyai-explainability/update-containerfile
Chore: Update CI and dependency management
2 parents 0079b6d + ccf9fac commit 6fe663b

File tree

10 files changed

+877
-35
lines changed

10 files changed

+877
-35
lines changed

‎.github/workflows/run-tests.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Run Tests
1+
name: Tier 1 - Unit Tests
22

33
on:
44
pull_request:
@@ -7,26 +7,32 @@ on:
77
branches: [main]
88

99
jobs:
10-
test:
11-
name: Run Tests
10+
unit-tests:
11+
name: Unit Tests
1212
runs-on: ubuntu-latest
13-
13+
1414
steps:
1515
- name: Checkout code
1616
uses: actions/checkout@v4
1717

1818
- name: Set up Python
1919
uses: actions/setup-python@v5
2020
with:
21-
python-version: '3.12'
21+
python-version: "3.12"
2222

2323
- name: Install dependencies
2424
run: |
2525
python -m pip install --upgrade pip
26-
python -m pip install -e ".[dev,inline,server]"
26+
python -m pip install --no-cache-dir -e ".[test]"
27+
28+
- name: Smoke-test imports
29+
run: |
30+
python -c "import numpy; print('numpy OK')"
31+
python -c "import pandas; print('pandas OK')"
32+
python -c "import llama_stack_provider_trustyai_garak; print('provider OK')"
2733
2834
- name: Run tests
2935
env:
3036
PYTHONPATH: src
3137
run: |
32-
pytest tests -v
38+
pytest tests -v

‎.github/workflows/security.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,25 @@ jobs:
1010
trivy-scan:
1111
name: Trivy Security Scan
1212
runs-on: ubuntu-latest
13+
container:
14+
image: registry.access.redhat.com/ubi9/python-312:latest
15+
options: --user root
1316
permissions:
1417
contents: read
1518
security-events: write
1619
actions: read
1720

1821
steps:
22+
1923
- name: Checkout code
2024
uses: actions/checkout@v4
2125

22-
- name: Set up Python
23-
uses: actions/setup-python@v4
24-
with:
25-
python-version: '3.12'
26-
27-
- name: Install dependencies
26+
- name: Install runtime deps
2827
run: |
2928
python -m pip install --upgrade pip
30-
python -m pip install -e ".[dev]"
29+
python -m pip install --no-cache-dir \
30+
-r requirements.txt
31+
python -m pip install --no-cache-dir --no-deps .
3132
3233
- name: Run Trivy filesystem scan
3334
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0

‎.github/workflows/validate-deps.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Validate Dependencies
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
push:
7+
branches: [main]
8+
9+
permissions:
10+
contents: write
11+
12+
jobs:
13+
sync-requirements:
14+
name: Auto-sync requirements.txt
15+
if: github.event_name == 'pull_request'
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout PR branch
20+
uses: actions/checkout@v4
21+
with:
22+
ref: ${{ github.head_ref }}
23+
token: ${{ secrets.GITHUB_TOKEN }}
24+
25+
- name: Set up Python
26+
uses: actions/setup-python@v4
27+
with:
28+
python-version: '3.12'
29+
30+
- name: Install uv
31+
run: python -m pip install --upgrade pip uv
32+
33+
- name: Regenerate requirements.txt
34+
run: |
35+
uv pip compile \
36+
--python-platform linux \
37+
--extra inline \
38+
--emit-index-url \
39+
--default-index https://console.redhat.com/api/pypi/public-rhai/rhoai/3.4/cpu-ubi9-test/simple/ \
40+
pyproject.toml \
41+
--index-url https://console.redhat.com/api/pypi/public-rhai/rhoai/3.4/cpu-ubi9-test/simple/ \
42+
-o requirements.txt
43+
44+
- name: Commit if changed
45+
run: |
46+
git diff --quiet requirements.txt && exit 0
47+
git config user.name "github-actions[bot]"
48+
git config user.email "github-actions[bot]@users.noreply.github.com"
49+
git add requirements.txt
50+
git commit -m "chore: auto-sync requirements.txt from pyproject.toml"
51+
git push
52+
53+
check-garak-drift:
54+
name: Check garak midstream version drift
55+
runs-on: ubuntu-latest
56+
57+
steps:
58+
- name: Checkout code
59+
uses: actions/checkout@v4
60+
61+
- name: Compare pyproject.toml garak version with latest midstream tag
62+
run: |
63+
PYPROJECT_VER=$(grep -oP 'garak==\K[^\s"]+' pyproject.toml)
64+
echo "pyproject.toml garak version: $PYPROJECT_VER"
65+
66+
LATEST_TAG=$(git ls-remote --tags \
67+
https://github.com/trustyai-explainability/garak.git \
68+
| grep 'refs/tags/v' \
69+
| grep -v '\^{}' \
70+
| sed 's|.*refs/tags/v||' \
71+
| sort -V \
72+
| tail -1)
73+
echo "Latest midstream tag: $LATEST_TAG"
74+
75+
if [ "$PYPROJECT_VER" != "$LATEST_TAG" ]; then
76+
echo "::error::Garak version drift detected!"
77+
echo " pyproject.toml pins: $PYPROJECT_VER"
78+
echo " Latest midstream: $LATEST_TAG"
79+
echo "Update pyproject.toml, regenerate requirements.txt, and commit."
80+
exit 1
81+
fi
82+
83+
echo "Garak version is up-to-date with midstream."
84+
85+
container-build:
86+
name: Container Build + Import Validation
87+
runs-on: ubuntu-latest
88+
89+
steps:
90+
- name: Checkout code
91+
uses: actions/checkout@v4
92+
93+
- name: Build container image
94+
run: |
95+
docker build -f Containerfile -t provider-smoke-test:ci .
96+
97+
- name: Verify full import chain
98+
run: |
99+
docker run --rm provider-smoke-test:ci bash -c "\
100+
python -c \"import numpy; print('numpy OK')\" && \
101+
python -c \"import pandas; print('pandas OK')\" && \
102+
python -c \"import garak; print('garak OK')\" && \
103+
python -c \"import sdg_hub; print('sdg-hub OK')\" && \
104+
python -c \"import llama_stack_provider_trustyai_garak; print('provider OK')\""
105+
106+
- name: Verify garak version matches pyproject.toml
107+
run: |
108+
EXPECTED=$(grep -oP 'garak==\K[^\s"]+' pyproject.toml)
109+
INSTALLED=$(docker run --rm provider-smoke-test:ci python -c "from importlib.metadata import version; print(version('garak'))")
110+
echo "Expected: $EXPECTED"
111+
echo "Installed: $INSTALLED"
112+
if [ "$EXPECTED" != "$INSTALLED" ]; then
113+
echo "::error::Garak version mismatch! Containerfile installs $INSTALLED but pyproject.toml expects $EXPECTED"
114+
exit 1
115+
fi
116+
echo "Garak version in container matches pyproject.toml."

‎.pre-commit-config.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
repos:
2+
- repo: local
3+
hooks:
4+
- id: sync-requirements
5+
name: Regenerate requirements.txt from pyproject.toml
6+
entry: bash -c 'uv pip compile --python-platform linux --extra inline --emit-index-url --default-index https://console.redhat.com/api/pypi/public-rhai/rhoai/3.4/cpu-ubi9-test/simple/ pyproject.toml --index-url https://console.redhat.com/api/pypi/public-rhai/rhoai/3.4/cpu-ubi9-test/simple/ -o requirements.txt'
7+
language: system
8+
files: ^pyproject\.toml$
9+
pass_filenames: false
210
- repo: https://github.com/astral-sh/ruff-pre-commit
311
rev: v0.11.4
412
hooks:

‎Containerfile‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,19 @@ WORKDIR /opt/app-root
44
# Switch to root only for installing packages
55
USER root
66

7-
COPY . .
7+
COPY pyproject.toml .
8+
COPY src src
89

910
# Install cpu torch to reduce image size
1011
RUN pip install torch --index-url https://download.pytorch.org/whl/cpu
1112

12-
# Install the package itself
13-
# Use [inline] to get garak dependency
14-
RUN pip install --no-cache-dir ".[inline]"
15-
# Install midstream garak and sdg-hub dependencies (tmp fix till we get release versions)
16-
RUN pip install --no-cache-dir -r requirements-inline-extra.txt
13+
# Install the package + sdg deps (everything except garak, which comes from git)
14+
RUN pip install --no-cache-dir ".[sdg]"
15+
# Install garak from midstream git (tag derived from pyproject.toml)
16+
RUN GARAK_VER=$(grep -oP 'garak==\K[^\s"]+' pyproject.toml) && \
17+
pip install --no-cache-dir \
18+
"garak @ git+https://github.com/trustyai-explainability/garak.git@v${GARAK_VER}"
19+
1720
# Set XDG environment variables to use /tmp (always writable) for garak to write to
1821
ENV XDG_CACHE_HOME=/tmp/.cache
1922
ENV XDG_DATA_HOME=/tmp/.local/share

‎pyproject.toml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ dependencies = [
2222
"eval-hub-sdk[adapter]>=0.1.2",
2323
"pandas>=2.3.3",
2424
"Jinja2>=3.1.6",
25-
# "pytest>=9.0.2", # included in 'dev' extra
2625
]
2726

2827
[project.urls]
@@ -40,15 +39,16 @@ where = ["src"]
4039
"llama_stack_provider_trustyai_garak" = ["resources/*"]
4140

4241
[project.optional-dependencies]
43-
inline = [
44-
"pyasn1==0.6.2", # trivy high vul fix
45-
"protobuf==6.33.5", # trivy high vul fix
42+
sdg = [
4643
"nest_asyncio>=1.6.0",
47-
"garak>=0.14.0"
44+
"sdg-hub>=0.8.8",
45+
]
46+
inline = [
47+
"llama-stack-provider-trustyai-garak[sdg]",
48+
"garak==0.14.1+rhaiv.6",
4849
]
49-
# For intents, install:
50-
# pip install -r requirements-inline-extra.txt
51-
dev = ["pytest", "pytest-cov", "pytest-asyncio", "ruff", "pre-commit"]
50+
test = ["pytest", "pytest-cov", "pytest-asyncio"]
51+
dev = ["llama-stack-provider-trustyai-garak[test]", "ruff", "pre-commit"]
5252
server = ["llama-stack>=0.5.0"]
5353

5454
[tool.pytest.ini_options]

‎requirements-inline-extra.txt‎

Lines changed: 0 additions & 2 deletions
This file was deleted.

0 commit comments

Comments
 (0)