Skip to content

Revert "CU-869az43jq: MedCAT v2: Distribute cogstack-es and medcat-scripts" #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 30, 2025
Merged

Revert "CU-869az43jq: MedCAT v2: Distribute cogstack-es and medcat-scripts" #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions .github/workflows/submodule_sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
name: submodules-sync

on:
push:
branches: ['**']
tags: ['v*.*.*']
pull_request:
branches: ['**']
release:
types: [published]
workflow_dispatch:

jobs:
sync:
name: 'Submodules Sync'
runs-on: ubuntu-22.04
if: github.actor != 'github-actions[bot]'

defaults:
run:
shell: bash

steps:
- name: Checkout repository with submodules
uses: actions/checkout@v5
with:
token: ${{ secrets.GITHUB_TOKEN }}
submodules: recursive
persist-credentials: false

- name: Sync submodule URLs
run: |
git submodule sync --recursive

- name: Update submodules
run: |
git -c protocol.version=2 submodule update --init --remote --recursive --jobs 8

- name: Commit and push submodule updates
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
set -euo pipefail
git config user.name 'github-actions[bot]'
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
git remote set-url origin https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}
# Stage only submodule pointer updates and .gitmodules
git add .gitmodules $(git config -f .gitmodules --get-regexp path | awk '{print $2}') || true
if git diff --cached --quiet; then
echo "No submodule pointer changes to commit"
exit 0
fi
git commit -m "chore(submodules): auto-update pointers [skip ci]"
git push
Comment on lines +15 to +54

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 30 days ago

To fix the problem, we must add a permissions: block to the workflow to restrict the GitHub Actions GITHUB_TOKEN permissions as tightly as possible, following the principle of least privilege. The workflow commits changes and pushes updates, so it needs contents: write, but no other elevated permissions. This block should be added either at the workflow root (top level) or at the job level; since there is only one job shown, either approach is fine. The simplest fix is to add the following block near the top (before jobs:):

permissions:
  contents: write

This will ensure that the workflow has only the necessary permissions for repository contents and disallow unnecessary privileges.

Suggested changeset 1
.github/workflows/submodule_sync.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/submodule_sync.yml b/.github/workflows/submodule_sync.yml
--- a/.github/workflows/submodule_sync.yml
+++ b/.github/workflows/submodule_sync.yml
@@ -1,5 +1,8 @@
 name: submodules-sync
 
+permissions:
+  contents: write
+
 on:
   push:
     branches: ['**']
EOF
@@ -1,5 +1,8 @@
name: submodules-sync

permissions:
contents: write

on:
push:
branches: ['**']
Copilot is powered by AI and may make mistakes. Always verify output.
6 changes: 6 additions & 0 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

[submodule "notebooks/demo_working_with_cogstack"]
path = notebooks/demo_working_with_cogstack
url = https://github.com/CogStack/working_with_cogstack.git
branch = main
ignore = all
17 changes: 5 additions & 12 deletions Dockerfile_singleuser
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,6 @@ ARG http_proxy
ARG https_proxy
ARG no_proxy

# NOTE: set to ES8 or Elasticsearch 8 or OS for Opensearch
ARG COGSTACK_BACKEND=ES9

# set to "true" for the GPU build
ARG GPU_BUILD=false

Expand Down Expand Up @@ -215,20 +212,16 @@ RUN uv pip install --upgrade --system pip setuptools wheel

# install the rest of the packages including medcat
COPY ./requirements.txt /srv/jupyterhub/
# install requirements for working with cogstack scripts
COPY notebooks/demo_working_with_cogstack/requirements.txt /srv/jupyterhub/working_with_cogstack_requirements.txt

RUN if [ "$GPU_BUILD" = "true" ] && [ "$CPU_ARCHITECTURE" = "amd64" ]; then \
uv pip install --system --no-cache-dir -r /srv/jupyterhub/requirements.txt && \
# NOTE: it'll create the medcat-scripts folder within
uv run python -m medcat download-scripts /srv/jupyterhub/ && \
uv pip install --system --no-cache-dir -r /srv/jupyterhub/medcat-scripts/requirements.txt ; \
uv pip install --system --no-cache-dir -r /srv/jupyterhub/working_with_cogstack_requirements.txt ; \
else \
uv pip install --system --no-cache-dir -r /srv/jupyterhub/requirements.txt --extra-index-url https://download.pytorch.org/whl/cpu/ && \
uv run python -m medcat download-scripts /srv/jupyterhub/ && \
uv pip install --system --no-cache-dir -r /srv/jupyterhub/medcat-scripts/requirements.txt --extra-index-url https://download.pytorch.org/whl/cpu/ ; \
fi && \
# install cogstack-es (Cogstack class)
uv pip install "cogstack-es[$COGSTACK_BACKEND]" && \
mv /srv/jupyterhub/medcat-scripts/notebooks/* /home/jovyan/work/. # move notebooks
uv pip install --system --no-cache-dir -r /srv/jupyterhub/working_with_cogstack_requirements.txt --extra-index-url https://download.pytorch.org/whl/cpu/ ; \
fi

#######################################################################################################

Expand Down
2 changes: 0 additions & 2 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
wheel==0.45.1
medcat==2.2.0
# TODO: cogstack-es
virtualenv==20.31.2
ipywidgets==8.1.7
requests>=2.32.2
Expand Down
Loading