Chore/reproducible dependencies - #35
Merged
Merged
Conversation
Runtime deps were declared independently in pyproject.toml, setup.cfg, and requirements.txt with no version floors, and dev tooling was pinned to years-old versions with tox's flake8 env drifting from requirements_dev.txt entirely. Make pyproject.toml the single source of truth for the install spec (with version floors from a verified working install), turn requirements.txt into an actual pinned lock file, and refresh/align dev tool pins across requirements_dev.txt and tox.ini. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The logo's relative src path resolves fine on GitHub but 404s in PyPI's README renderer, which has no repo base path to resolve against.
np.bool was removed in NumPy >=1.24, crashing sashimi_plot() whenever select_transcripts is passed. Closes #20.
Complements dependency-review.yml, which only checks new dependencies introduced in a PR for known CVEs -- it doesn't scan our own code. Runs on push/PR to master and weekly on a schedule.
ReadTheDocs only builds docs/ after merge (and fail_on_warning is False there), so nothing previously caught a broken Sphinx build before it landed on master. Builds with -W --keep-going to fail on any warning; skips executing tutorial notebooks (nbsphinx_execute=never) since they need real long-read data files not available in CI.
Covers the np.bool fix in this branch.
Floors were set from a Python-3.12-only test environment; some of the latest resolved versions (e.g. scipy 1.18.0) require Python >=3.12 themselves, so pip found no matching version on the 3.10/3.11 runners. The abstract dependency spec doesn't need version floors to achieve reproducibility -- requirements.txt (the pinned lock file) already covers that for a specific verified environment.
Dependency ReviewThe following issues were found:
License Issues.github/workflows/docs-build.yml
requirements_dev.txt
OpenSSF Scorecard
Scanned Files
|
":parm overlap_only" (missing "a") meant that parameter never rendered in the API docs, and the unescaped "**filter_kwargs" was parsed by Sphinx as unterminated bold markup, both surfaced by the new docs-build CI check.
-W surfaced 43 pre-existing broken relative links in tutorial notebooks (content debt RTD never caught either, since fail_on_warning is False there). Keep the check for genuine build errors; revisit -W once the notebook links are fixed separately.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pyproject.tomlas the single source of truth; turnrequirements.txtinto a real pinned lock file; refresh/align dev tool pins.np.boolcrash insashimi_plot(select_transcripts=...)under NumPy >=1.24 (closes Deprecated aliasnp.bool#20).add_domains_to_tablesurfaced by the new docs-build check.Test plan
python -m build+twine check dist/*passflake8andblack --checkpass on latest pinned tool versionspytestsuite passes (13 passed)