chore(deps): migrate from Poetry to Rye for dependency management

[mldangelo]

Summary

Migrates the project from Poetry to Rye for dependency management and build tooling.

Changes Made

Build System Migration

• Replaced Poetry with Rye: Updated pyproject.toml to use Rye configuration
• Removed poetry.lock: No longer needed with Rye's lockfile system
• Updated CI/CD: GitHub Actions workflow now uses Rye instead of Poetry

Dependency Management

• Preserved all existing dependencies: Core and optional dependencies maintained
• Added new optional dependencies:
  • joblib>=1.0.0 for Joblib scanner support
  • Updated all extra to include new dependencies
• Enhanced dev dependencies: Added dill>=0.4.0 for testing

Documentation Updates

• README.md: Updated installation and development instructions to use Rye
• CLAUDE.md: Updated development commands to use Rye syntax
• CI/CD examples: Updated to show Rye usage patterns

New Features Merged

• Joblib Scanner: Security scanning for .joblib files
• NumPy Scanner: Security scanning for .npy/.npz files
• Enhanced Security: Additional detection capabilities

Benefits

• Faster dependency resolution: Rye provides faster dependency installation
• Better Python version management: Simplified Python version pinning
• Modern tooling: Uses latest Python packaging standards
• Maintained compatibility: All existing functionality preserved

Testing

• All existing tests continue to pass
• CI/CD pipeline updated and functional
• Docker builds remain compatible

Breaking Changes

None - this is purely a build system migration that doesn't affect end users.

Migration Notes

For developers:

• Use rye sync --features all instead of poetry install
• Use rye run <command> instead of poetry run <command>
• Use rye build instead of poetry build

[cursor]

Bug: Docker Build Fails Due to Incorrect Dependency Installation Order

The Dockerfiles (Dockerfile.full, Dockerfile.tensorflow) attempt to install dependencies from requirements.lock (line 7) before copying the application source code (line 10). This causes the Docker build to fail because requirements.lock includes an editable install (-e file:.) that requires the source code to be present. Additionally, a subsequent pip install command (line 13) attempts to install the application again with specific extras, which is redundant and could lead to conflicts.

Dockerfile.tensorflow#L4-L13

modelaudit/Dockerfile.tensorflow

Lines 4 to 13 in baac873

	# Copy requirements lock file and install dependencies
	COPY requirements.lock ./
	RUN pip install --no-cache-dir -r requirements.lock
	# Copy source code
	COPY . .
	# Install the application with TensorFlow extras using pip
	RUN pip install --no-cache-dir .[tensorflow]

Dockerfile.full#L5-L13

modelaudit/Dockerfile.full

Lines 5 to 13 in baac873

	# Copy requirements lock file and install all dependencies
	COPY requirements.lock ./
	RUN pip install --no-cache-dir -r requirements.lock
	# Copy source code
	COPY . .
	# Install the application with all extras using pip
	RUN pip install --no-cache-dir .[all]

Fix in Cursor

---

Bug: Editable Install Fails Before Source Code

The Dockerfile attempts to install dependencies from requirements.lock before copying the source code. Since requirements.lock contains an editable install entry (-e file:.), pip fails because the project's source code (e.g., pyproject.toml) is not yet present in the current directory to perform the editable installation.

Dockerfile.full#L4-L13

modelaudit/Dockerfile.full

Lines 4 to 13 in baac873

	# Copy requirements lock file and install all dependencies
	COPY requirements.lock ./
	RUN pip install --no-cache-dir -r requirements.lock
	# Copy source code
	COPY . .
	# Install the application with all extras using pip
	RUN pip install --no-cache-dir .[all]

Fix in Cursor

---

Was this report helpful? Give feedback by reacting with 👍 or 👎