Skip to content

chore: stop passing GCP secrets to Claude workflows#311

Merged
olivermeyer merged 2 commits intomainfrom
chore/claude-code-cannot-access-secrets
Dec 3, 2025
Merged

chore: stop passing GCP secrets to Claude workflows#311
olivermeyer merged 2 commits intomainfrom
chore/claude-code-cannot-access-secrets

Conversation

@olivermeyer
Copy link
Collaborator

@olivermeyer olivermeyer commented Dec 3, 2025

We should stop injecting GCP secrets into Claude workflows to prevent leaks.

As a result, the Create .env file and Set up GCP credentials for bucket access steps can no longer run so we remove them; in turn this means we can remove the now-unused platform_environment variable.

@github-actions
Copy link
Contributor

github-actions bot commented Dec 3, 2025 •
edited
Loading

Claude finished @olivermeyer's task —— View job

✅ Review Complete: Security-focused removal of GCP secrets from Claude workflows

🎯 Summary

This PR correctly removes GCP credentials and Aignostics API access from Claude Code workflows to prevent potential secret leaks. The changes are security-focused, well-scoped, and consistent across all four affected workflow files.

Assessment: ✅ Approve (with one documentation update required)

📋 Review Findings

✅ PASSING - Workflow Changes (All 4 Files)

Files Changed:

  1. .github/workflows/_claude-code.yml (reusable workflow)
  2. .github/workflows/claude-code-automation-pr-review.yml
  3. .github/workflows/claude-code-automation-operational-excellence-weekly.yml
  4. .github/workflows/claude-code-interactive.yml

What was removed (consistent across all files):

  • ✅ platform_environment input parameter (staging/production selector)
  • ✅ .env file creation step with Aignostics credentials
  • ✅ GCP credentials setup step with base64 decoding
  • ✅ Secret parameters: AIGNOSTICS_CLIENT_ID_DEVICE_*, AIGNOSTICS_REFRESH_TOKEN_*, GCP_CREDENTIALS_*

Security Impact: ✅ Positive

  • Claude Code workflows can no longer access staging/production API credentials
  • Claude Code workflows can no longer access GCP bucket credentials
  • Reduces attack surface for credential leaks through Claude Code logs/outputs

Functionality Preserved: ✅ Correct

  • These secrets are still properly configured in test workflows (_test.yml, _scheduled-test-*.yml)
  • Test workflows that actually need API access retain proper credential handling
  • Claude Code retains access to: file operations, git commands, uv/make commands, GitHub API (via GITHUB_TOKEN)

✅ PASSING - Conventional Commit Format

chore: stop passing GCP secrets to Claude workflows

✅ Correct format: chore: prefix
✅ Clear, concise description
✅ Appropriate for infrastructure/security change

✅ PASSING - No Breaking Changes

Verified:

  • ✅ No code changes (only workflow YAML)
  • ✅ No test changes required
  • ✅ No impact on SDK functionality
  • ✅ Other workflows (_test.yml, scheduled tests) still have proper credential access

Searched for references:

# No tests reference Claude workflows or platform_environment
grep -r "claude.*code|_claude-code" tests/ # No matches

⚠️ DOCUMENTATION UPDATE REQUIRED

Location: .github/CLAUDE.md

The documentation still references the removed platform_environment input and credential configuration. The following sections need updates:

Line 512 (Trigger section):

# CURRENT (OUTDATED):
#   - platform_environment: staging (default) or production

# SHOULD BE REMOVED (no longer exists)

Lines 529-534 (Configuration section):

# CURRENT (OUTDATED):
platform_environment: 'staging' | 'production'  # Default: staging
mode: 'interactive' | 'automation'               # Required
prompt: 'string'                                 # For automation mode
max_turns: '200'                                 # Default: 200
allowed_tools: 'comma,separated,list'            # Default: Read,Write,Edit,Glob,Grep,Bash(git:*),Bash(uv:*),Bash(make:*)

# SHOULD BE:
mode: 'interactive' | 'automation'               # Required
prompt: 'string'                                 # For automation mode
max_turns: '200'                                 # Default: 200
allowed_tools: 'comma,separated,list'            # Default: Read,Write,Edit,Glob,Grep,Bash(git:*),Bash(uv:*),Bash(make:*)

Lines 536-544 (Environment Setup section):

# CURRENT (OUTDATED):
**Environment Setup** (same as test environment):

1. Installs `uv` package manager
2. Installs dev tools (`.github/workflows/_install_dev_tools.bash`)
3. Syncs Python dependencies (`uv sync --all-extras`)
4. Sets up headless display (for GUI tests)
5. Creates `.env` with Aignostics credentials (staging or production)  ← REMOVE
6. Configures GCP credentials for bucket access  ← REMOVE

# SHOULD BE:
**Environment Setup**:

1. Installs `uv` package manager
2. Installs dev tools (`.github/workflows/_install_dev_tools.bash`)
3. Syncs Python dependencies (`uv sync --all-extras`)
4. Sets up headless display (for GUI tests)

Lines 556-562 (Secrets Required section):

# CURRENT (OUTDATED):
**Secrets Required**:

* `ANTHROPIC_API_KEY` - For Claude Code
* `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING|PRODUCTION}`  ← REMOVE
* `AIGNOSTICS_REFRESH_TOKEN_{STAGING|PRODUCTION}`  ← REMOVE
* `GCP_CREDENTIALS_{STAGING|PRODUCTION}`  ← REMOVE

# SHOULD BE:
**Secrets Required**:

* `ANTHROPIC_API_KEY` - For Claude Code

Line 603 (Manual Claude Sessions):

# CURRENT (OUTDATED):
**Inputs**:

* `prompt`: What you want Claude to work on
* `max_turns`: How many iterations (default 200)
* `platform_environment`: staging (default) or production  ← REMOVE

# SHOULD BE:
**Inputs**:

* `prompt`: What you want Claude to work on
* `max_turns`: How many iterations (default 200)

Lines 621-630 (Best Practices):

# CURRENT (OUTDATED):
**DO**:

* ✅ Use `--system-prompt` referencing CLAUDE.md
* ✅ Limit tool access (`--allowed-tools`)
* ✅ Set reasonable `--max-turns`
* ✅ Use staging environment for development  ← REMOVE or UPDATE
* ✅ Review Claude's changes before merging
* ✅ Let Claude explore workflows and test strategies

**DON'T**:

* ❌ Grant unrestricted tool access
* ❌ Skip CLAUDE.md system prompt
* ❌ Test against production without approval  ← REMOVE (no longer applicable)
* ❌ Merge without human review

# SUGGESTED UPDATE for "DON'T":
**DON'T**:

* ❌ Grant unrestricted tool access
* ❌ Skip CLAUDE.md system prompt
* ❌ Merge without human review
* ❌ Expect Claude Code to run E2E tests requiring API credentials

Lines 766-767, 785-786, 802-803 (Environment Configuration sections):

Multiple references to AIGNOSTICS_REFRESH_TOKEN_* and GCP_CREDENTIALS_* in the Environment Configuration and Secrets Management sections should note that these are NOT available in Claude Code workflows (only in test workflows).

Suggested addition after line 562:

**Note**: Claude Code workflows do NOT have access to Aignostics API credentials or GCP credentials. These secrets are only available in test workflows (`_test.yml`, `_scheduled-test-*.yml`) to prevent credential leaks through Claude Code logs/outputs.

🏆 What This PR Does Well

  1. ✅ Consistent changes across all 4 workflow files
  2. ✅ Security-focused - Reduces credential exposure risk
  3. ✅ Minimal scope - Only removes what's necessary
  4. ✅ No breaking changes - Test workflows retain proper credential access
  5. ✅ Clean git history - Single atomic commit
  6. ✅ Proper commit message - Conventional commits format

📝 Action Items

Required Before Merge:

  • Update .github/CLAUDE.md documentation to remove references to:
    • platform_environment input parameter
    • Aignostics credentials setup in Claude workflows
    • GCP credentials setup in Claude workflows
    • Add note that Claude Code workflows do NOT have API/GCP access (by design)

Verification Commands:

# Verify no other references exist
grep -rn "platform_environment" .github/workflows/
# Should only return: (none after doc update)

# Verify secrets still configured for test workflows
grep -rn "AIGNOSTICS_CLIENT_ID_DEVICE" .github/workflows/_test.yml
grep -rn "GCP_CREDENTIALS" .github/workflows/_test.yml
# Should return: matches in _test.yml and scheduled test workflows

🔍 Security Analysis

Risk Assessment: ✅ Low Risk

Before this PR:

  • Claude Code had access to staging/production API credentials
  • Claude Code had access to GCP bucket credentials
  • Risk: Credentials could leak via Claude Code outputs, logs, or GitHub Actions artifacts

After this PR:

  • Claude Code has NO access to API or GCP credentials
  • Claude Code retains: file system access, git commands, uv/make commands, GitHub API (GITHUB_TOKEN)
  • Risk mitigation: ✅ Significantly reduced - Claude Code cannot leak Aignostics/GCP secrets

Residual Risks: ⚠️ Minimal

  • Claude Code still has ANTHROPIC_API_KEY (required for functionality)
  • Claude Code still has GITHUB_TOKEN (required for PR/issue operations)
  • These are acceptable risks with proper scoping

💡 Recommendations

Optional Enhancements (Not Blocking):

  1. Consider adding a security section to .github/CLAUDE.md explaining:

    • Why Claude Code doesn't have API access
    • Which workflows have which credentials
    • Security boundaries and isolation

  2. Add comment in workflow files explaining the security decision:

    # NOTE: This workflow intentionally does NOT have access to Aignostics API
# or GCP credentials to prevent potential credential leaks through Claude Code
# outputs. Only test workflows (_test.yml, _scheduled-test-*.yml) have these credentials.

  3. Update root CLAUDE.md if it mentions Claude Code having API access

🎓 References

  • ✅ Conventional Commits: chore: prefix appropriate
  • ✅ Security Best Practice: Principle of least privilege
  • ✅ Workflow Architecture: .github/CLAUDE.md lines 485-631

Verdict: ✅ LGTM with documentation update

Once .github/CLAUDE.md is updated to reflect the removed platform_environment input and credential configuration, this PR is ready to merge.

Great security-focused change! 🔒

@github-actions
Copy link
Contributor

github-actions bot commented Dec 3, 2025 •
edited
Loading

Claude finished @olivermeyer's task —— View job

PR Review: Security-focused GCP Secret Removal ✅

Reviewing PR #311: Removal of GCP secrets from Claude Code workflows

Todo List:

  • Read repository CLAUDE.md and .github/CLAUDE.md for context
  • Analyze changed workflow files
  • Verify documentation updates are complete
  • Check for any remaining references to removed functionality
  • Verify test workflows still have proper credential access
  • Provide comprehensive review feedback

✅ Review Complete - All Documentation Updates Applied

Summary

This PR successfully removes GCP credentials and Aignostics API access from Claude Code workflows to prevent potential secret leaks. All documentation has been updated to reflect the changes. The PR is ready to merge.

📋 Changes Verified

1. ✅ Workflow Files (4 files) - Consistent Removal

All four Claude Code workflows have correctly removed:

  • _claude-code.yml (reusable workflow)
  • claude-code-automation-pr-review.yml
  • claude-code-automation-operational-excellence-weekly.yml
  • claude-code-interactive.yml

Removed from all files:

  • ✅ platform_environment input parameter
  • ✅ .env file creation step with Aignostics credentials
  • ✅ GCP credentials setup step with base64 decoding
  • ✅ Secret parameters: AIGNOSTICS_CLIENT_ID_DEVICE_*, AIGNOSTICS_REFRESH_TOKEN_*, GCP_CREDENTIALS_*

2. ✅ Documentation Updates - Complete

The .github/CLAUDE.md file has been properly updated with all recommended changes:

✅ Removed platform_environment references:

  • Line 512: Removed from trigger section inputs list
  • Line 528: Removed from Configuration inputs section
  • Line 598: Removed from Manual Claude Sessions inputs

✅ Updated Environment Setup section (lines 534-541):

  • Removed step 5: "Creates .env with Aignostics credentials"
  • Removed step 6: "Configures GCP credentials for bucket access"
  • Added security note: "Claude Code workflows intentionally do NOT have access to Aignostics platform credentials or GCP credentials to prevent accidental credential leakage."

✅ Updated Secrets Required section (line 556):

  • Removed: AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING|PRODUCTION}
  • Removed: AIGNOSTICS_REFRESH_TOKEN_{STAGING|PRODUCTION}
  • Removed: GCP_CREDENTIALS_{STAGING|PRODUCTION}
  • Updated to: ANTHROPIC_API_KEY - For Claude Code (only secret available to Claude Code workflows)

✅ Updated Best Practices section (lines 612-623):

  • Removed: "✅ Use staging environment for development"
  • Removed: "❌ Test against production without approval"
  • Added: "❌ Add platform/GCP credentials to Claude Code workflows (security risk)"

🔍 Verification Checks

✅ No Remaining References in Claude Code Workflows

# Verified: No Claude Code workflows reference AIGNOSTICS credentials
grep -l "claude-code" .github/workflows/*.yml | xargs grep -l "AIGNOSTICS_CLIENT_ID_DEVICE"
# Result: No files found ✅

✅ Test Workflows Still Have Proper Credential Access

The following workflows correctly retain credentials (as expected):

  • _test.yml
  • _scheduled-test-*.yml
  • ci-cd.yml
  • All scheduled testing workflows (staging/production, hourly/daily)

This is the correct behavior - only Claude Code workflows lost access to credentials.

🎯 Commit Messages - Conventional Commits ✅

Both commits follow proper conventional commit format:

  1. ✅ chore: stop passing GCP secrets to Claude workflows
  2. ✅ docs: adjust CLAUDE.md

🔒 Security Impact Assessment

Before this PR:

  • ❌ Claude Code had access to staging/production API credentials
  • ❌ Claude Code had access to GCP bucket credentials
  • ❌ Risk: Credentials could leak via Claude Code outputs, logs, or GitHub Actions artifacts

After this PR:

  • ✅ Claude Code has NO access to API or GCP credentials
  • ✅ Claude Code retains: file system access, git commands, uv/make commands, GitHub API (GITHUB_TOKEN)
  • ✅ Risk mitigation: Significantly reduced - Claude Code cannot leak Aignostics/GCP secrets
  • ✅ Documentation clearly explains security boundary

Residual Risks (Acceptable):

  • ⚠️ Claude Code still has ANTHROPIC_API_KEY (required for functionality)
  • ⚠️ Claude Code still has GITHUB_TOKEN (required for PR/issue operations)
  • ✅ These are acceptable risks with proper scoping

💡 Recommendations for Future (Optional)

These are not blocking but could enhance the security posture further:

  1. Add inline comments in workflow files explaining the security decision:

    # NOTE: This workflow intentionally does NOT have access to Aignostics API
# or GCP credentials to prevent potential credential leaks through Claude Code
# outputs. Only test workflows (_test.yml, _scheduled-test-*.yml) have these credentials.

  2. Consider a security architecture section in .github/CLAUDE.md:

    • Document which workflows have which credentials
    • Explain security boundaries and isolation
    • Provide troubleshooting guide if Claude Code needs to test against API

  3. Audit other workflows for similar credential exposure risks (outside scope of this PR)

✅ Final Verdict: LGTM - Ready to Merge

What This PR Does Well:

  1. ✅ Security-focused - Reduces credential exposure risk
  2. ✅ Consistent changes across all 4 workflow files
  3. ✅ Complete documentation updates - All previous review comments addressed
  4. ✅ Clean git history - Two atomic commits with proper conventional commit format
  5. ✅ Minimal scope - Only removes what's necessary
  6. ✅ No breaking changes - Test workflows retain proper credential access
  7. ✅ Clear security boundary - Documentation explains why Claude Code doesn't have credentials

Checklist for Merge:

  • All workflow files updated consistently
  • Documentation updated to reflect changes
  • No remaining references to removed functionality in Claude Code workflows
  • Test workflows still have proper credential access
  • Security note added to documentation
  • Conventional commit format followed
  • No breaking changes to functionality

🎓 Key Takeaways

This PR exemplifies security best practices for CI/CD pipelines:

  • Principle of Least Privilege: Claude Code only has access to tools it needs
  • Defense in Depth: Removing credentials prevents entire classes of security incidents
  • Clear Documentation: Security boundaries are explicitly documented
  • Minimal Impact: Functionality preserved while security improved

Great work on this security improvement! 🔒

@codecov
Copy link

codecov bot commented Dec 3, 2025

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
616 1 615 7
View the full list of 1 ❄️ flaky test(s) 
tests.aignostics.docker_test::test_core_docker_cli_help_with_love

Flake rate in main: 20.00% (Passed 8 times, Failed 2 times)

Stack Traces | 30.5s run time 
fixturedef = <FixtureDef argname='docker_services' scope='session' baseid=''>
request = <SubRequest 'docker_services' for <Function test_core_docker_cli_help_with_love>>

    @pytest.hookimpl(wrapper=True)
    def pytest_fixture_setup(fixturedef: FixtureDef, request) -> object | None:
        asyncio_mode = _get_asyncio_mode(request.config)
        if not _is_asyncio_fixture_function(fixturedef.func):
            if asyncio_mode == Mode.STRICT:
                # Ignore async fixtures without explicit asyncio mark in strict mode
                # This applies to pytest_trio fixtures, for example
                return (yield)
            if not _is_coroutine_or_asyncgen(fixturedef.func):
>               return (yield)
                        ^^^^^

..../test-3-13-9/lib/python3.13.../site-packages/pytest_asyncio/plugin.py:730: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
..../test-3-13-9/lib/python3.13............/site-packages/pytest_docker/plugin.py:238: in docker_services
    with get_docker_services(
../...../_temp/uv-python-dir/cpython-3.13.9-linux-x86_64-gnu/lib/python3.13/contextlib.py:141: in __enter__
    return next(self.gen)
           ^^^^^^^^^^^^^^
..../test-3-13-9/lib/python3.13............/site-packages/pytest_docker/plugin.py:212: in get_docker_services
    docker_compose.execute(command)
..../test-3-13-9/lib/python3.13............/site-packages/pytest_docker/plugin.py:140: in execute
    return execute(command, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

command = 'docker compose -f ".../python-sdk/python-sdk/compose.yaml" -p "pytest6218" up --build -d'
success_codes = (0,), ignore_stderr = False

    def execute(command: str, success_codes: Iterable[int] = (0,), ignore_stderr: bool = False) -> Union[bytes, Any]:
        """Run a shell command."""
        try:
            stderr_pipe = subprocess.DEVNULL if ignore_stderr else subprocess.STDOUT
            output = subprocess.check_output(command, stderr=stderr_pipe, shell=True)
            status = 0
        except subprocess.CalledProcessError as error:
            output = error.output or b""
            status = error.returncode
            command = error.cmd
    
        if status not in success_codes:
>           raise Exception(
                'Command {} returned {}: """{}""".'.format(command, status, output.decode("utf-8"))
            )
E           Exception: Command docker compose -f ".../python-sdk/python-sdk/compose.yaml" -p "pytest6218" up --build -d returned 1: """#1 [internal] load local bake definitions
E           #1 reading from stdin 446B done
E           #1 DONE 0.0s
E           
E           #2 [internal] load build definition from Dockerfile
E           #2 transferring dockerfile: 3.52kB done
E           #2 DONE 0.0s
E           
E           #3 [internal] load metadata for docker.io/library/python:3.13-slim-bookworm
E           #3 ...
E           
E           #4 [auth] library/python:pull token for registry-1.docker.io
E           #4 DONE 0.0s
E           
E           #5 [internal] load metadata for ghcr.io/astral-sh/uv:0.9.14
E           #5 DONE 0.9s
E           
E           #3 [internal] load metadata for docker.io/library/python:3.13-slim-bookworm
E           #3 DONE 0.9s
E           
E           #6 [internal] load .dockerignore
E           #6 transferring context: 1.07kB done
E           #6 DONE 0.0s
E           
E           #7 [base 1/1] FROM docker.io/library/python:3.13-slim-bookworm@sha256:d3fef00fbd9ab948d206fe74c1bdd8105f535e5bd90a6074558c31c328ae48b7
E           #7 resolve docker.io/library/python:3.13-slim-bookworm@sha256:d3fef00fbd9ab948d206fe74c1bdd8105f535e5bd90a6074558c31c328ae48b7 done
E           #7 sha256:b6cd69eec6b21bdf94e569b18ffbbd2ee934f0aa37b060037803f36bf6fb1419 5.54kB / 5.54kB done
E           #7 sha256:8e44f01296e3a6fdc31a671bee1c2259c5d5ee8b49f29aec42b5d2af15600296 0B / 28.23MB 0.1s
E           #7 sha256:d3fef00fbd9ab948d206fe74c1bdd8105f535e5bd90a6074558c31c328ae48b7 9.13kB / 9.13kB done
E           #7 sha256:12fc14bddfdbf774231210f1ec826cd85c0cbfaf1a5615ecf2521320d8df4057 1.75kB / 1.75kB done
E           #7 ...
E           
E           #8 [internal] load build context
E           #8 transferring context: 12.24MB 0.1s done
E           #8 DONE 0.1s
E           
E           #9 FROM ghcr.io/astral-sh/uv:0.9.14@sha256:fef8e5fb8809f4b57069e919ffcd1529c92b432a2c8d8ad1768087b0b018d840
E           #9 resolve ghcr.io/astral-sh/uv:0.9.14@sha256:fef8e5fb8809f4b57069e919ffcd1529c92b432a2c8d8ad1768087b0b018d840 done
E           #9 sha256:fef8e5fb8809f4b57069e919ffcd1529c92b432a2c8d8ad1768087b0b018d840 2.19kB / 2.19kB done
E           #9 sha256:ad3f022815822ee5124d1e3d77169ba4420ed8906815ecb486164a48fdba360b 669B / 669B done
E           #9 sha256:4824900e6164a8800cbc040e3de2dce8af61f166f2e68b493a7ebf341ddc89e9 1.30kB / 1.30kB done
E           #9 sha256:2dabd3b9d8a572d630b75bb32e004d7ff1b28df5a2a331d5c28dab2ae4115174 0B / 21.95MB 0.3s
E           #9 sha256:4f09d4a68eb7ca6c1e4c19f15d3385ee9cc20c51e947a944db10ee8fb0b062d4 98B / 98B 0.2s done
E           #9 sha256:2dabd3b9d8a572d630b75bb32e004d7ff1b28df5a2a331d5c28dab2ae4115174 9.44MB / 21.95MB 0.4s
E           #9 sha256:2dabd3b9d8a572d630b75bb32e004d7ff1b28df5a2a331d5c28dab2ae4115174 17.83MB / 21.95MB 0.5s
E           #9 extracting sha256:2dabd3b9d8a572d630b75bb32e004d7ff1b28df5a2a331d5c28dab2ae4115174
E           #9 sha256:2dabd3b9d8a572d630b75bb32e004d7ff1b28df5a2a331d5c28dab2ae4115174 21.95MB / 21.95MB 0.5s done
E           #9 extracting sha256:2dabd3b9d8a572d630b75bb32e004d7ff1b28df5a2a331d5c28dab2ae4115174 0.4s done
E           #9 extracting sha256:4f09d4a68eb7ca6c1e4c19f15d3385ee9cc20c51e947a944db10ee8fb0b062d4 done
E           #9 DONE 1.0s
E           
E           #7 [base 1/1] FROM docker.io/library/python:3.13-slim-bookworm@sha256:d3fef00fbd9ab948d206fe74c1bdd8105f535e5bd90a6074558c31c328ae48b7
E           #7 sha256:8e44f01296e3a6fdc31a671bee1c2259c5d5ee8b49f29aec42b5d2af15600296 28.23MB / 28.23MB 0.2s done
E           #7 extracting sha256:8e44f01296e3a6fdc31a671bee1c2259c5d5ee8b49f29aec42b5d2af15600296 0.7s
E           #7 sha256:1531b2cd2260a21320d84edaadce399f6d16c2d79d24cedc8fb82f0c5397f43b 3.52MB / 3.52MB 0.3s done
E           #7 sha256:cb6fc5a445286cf221641ad90df28d8997c7e7cef6cab302e3ea12c2ed01fb70 12.47MB / 12.47MB 0.4s done
E           #7 sha256:4af252baaf636418207dc490d433d45841662d1f2d09554852a2c5a52c69c9f4 251B / 251B 0.5s done
E           #7 extracting sha256:8e44f01296e3a6fdc31a671bee1c2259c5d5ee8b49f29aec42b5d2af15600296 1.5s done
E           #7 extracting sha256:1531b2cd2260a21320d84edaadce399f6d16c2d79d24cedc8fb82f0c5397f43b
E           #7 extracting sha256:1531b2cd2260a21320d84edaadce399f6d16c2d79d24cedc8fb82f0c5397f43b 0.2s done
E           #7 extracting sha256:cb6fc5a445286cf221641ad90df28d8997c7e7cef6cab302e3ea12c2ed01fb70 0.1s
E           #7 extracting sha256:cb6fc5a445286cf221641ad90df28d8997c7e7cef6cab302e3ea12c2ed01fb70 0.6s done
E           #7 extracting sha256:4af252baaf636418207dc490d433d45841662d1f2d09554852a2c5a52c69c9f4 done
E           #7 DONE 2.7s
E           
E           #10 [builder 1/2] COPY --from=ghcr.io/astral-sh/uv:0.9.14 /uv /bin/uv
E           #10 DONE 0.1s
E           
E           #11 [builder 2/2] WORKDIR /app
E           #11 DONE 0.0s
E           
E           #12 [builder-all  1/12] RUN --mount=type=cache,target=/root/.cache/uv     --mount=type=bind,source=uv.lock,target=uv.lock     --mount=type=bind,source=pyproject.toml,target=pyproject.toml     uv sync --frozen --no-install-project --all-extras --no-dev --no-editable
E           #12 ...
E           
E           #13 [target 1/1] RUN <<EOT (groupadd -r app...)
E           #13 DONE 0.3s
E           
E           #12 [builder-all  1/12] RUN --mount=type=cache,target=/root/.cache/uv     --mount=type=bind,source=uv.lock,target=uv.lock     --mount=type=bind,source=pyproject.toml,target=pyproject.toml     uv sync --frozen --no-install-project --all-extras --no-dev --no-editable
E           #12 0.467 Using CPython 3.13.10 interpreter at: .../local/bin/python3
E           #12 0.467 Creating virtual environment at: .venv
E           #12 0.521 Downloading babel (9.7MiB)
E           #12 0.522 Downloading cryptography (4.3MiB)
E           #12 0.522 Downloading shapely (2.9MiB)
E           #12 0.523 Downloading widgetsnbextension (2.1MiB)
E           #12 0.523 Downloading aiohttp (1.7MiB)
E           #12 0.525 Downloading jedi (1.5MiB)
E           #12 0.532 Downloading pandas (11.7MiB)
E           #12 0.532 Downloading numpy (15.9MiB)
E           #12 0.533 Downloading grpcio (6.3MiB)
E           #12 0.533 Downloading uvloop (4.2MiB)
E           #12 0.534 Downloading debugpy (4.1MiB)
E           #12 0.534 Downloading cramjam (1.9MiB)
E           #12 0.535 Downloading idc-index-data (81.5MiB)
E           #12 0.535 Downloading botocore (13.6MiB)
E           #12 0.536 Downloading s5cmd (4.7MiB)
E           #12 0.536 Downloading nicegui (20.0MiB)
E           #12 0.537 Downloading marimo (32.4MiB)
E           #12 0.537 Downloading loro (3.1MiB)
E           #12 0.537 Downloading pydicom (2.3MiB)
E           #12 0.538 Downloading highdicom (1.1MiB)
E           #12 0.538 Downloading pygments (1.2MiB)
E           #12 0.539 Downloading pydantic-core (2.0MiB)
E           #12 0.539 Downloading setuptools (1.1MiB)
E           #12 0.540 Downloading openslide-bin (4.1MiB)
E           #12 0.540 Downloading pillow (6.7MiB)
E           #12 0.541 Downloading notebook (13.7MiB)
E           #12 0.541 Downloading fonttools (4.7MiB)
E           #12 0.542 Downloading lxml (4.7MiB)
E           #12 0.542 Downloading kiwisolver (1.4MiB)
E           #12 0.543 Downloading matplotlib (8.3MiB)
E           #12 0.543 Downloading jupyterlab (11.7MiB)
E           #12 0.544 Downloading duckdb (19.6MiB)
E           #12 0.544 Downloading fastparquet (1.7MiB)
E           #12 0.545 Downloading faker (1.9MiB)
E           #12 1.424  Downloaded highdicom
E           #12 1.651  Downloaded kiwisolver
E           #12 1.910  Downloaded aiohttp
E           #12 2.182  Downloaded fastparquet
E           #12 2.242  Downloaded pygments
E           #12 2.332  Downloaded cramjam
E           #12 2.385  Downloaded pydantic-core
E           #12 2.432  Downloaded widgetsnbextension
E           #12 2.570  Downloaded pydicom
E           #12 2.834  Downloaded shapely
E           #12 3.023  Downloaded loro
E           #12 3.071  Downloaded setuptools
E           #12 3.424    Building uptime==3.0.1
E           #12 3.428    Building proxy-tools==0.1.0
E           #12 3.736  Downloaded openslide-bin
E           #12 3.788  Downloaded uvloop
E           #12 3.890  Downloaded s5cmd
E           #12 3.973  Downloaded cryptography
E           #12 4.121  Downloaded debugpy
E           #12 4.255  Downloaded fonttools
E           #12 4.262  Downloaded lxml
E           #12 4.472  Downloaded grpcio
E           #12 4.589  Downloaded pillow
E           #12 4.898  Downloaded faker
E           #12 5.260  Downloaded matplotlib
E           #12 5.397  Downloaded babel
E           #12 5.734       Built proxy-tools==0.1.0
E           #12 5.792       Built uptime==3.0.1
E           #12 5.930  Downloaded jupyterlab
E           #12 6.171  Downloaded notebook
E           #12 6.247  Downloaded numpy
E           #12 6.424  Downloaded jedi
E           #12 6.439  Downloaded duckdb
E           #12 6.490  Downloaded nicegui
E           #12 6.733  Downloaded botocore
E           #12 6.965  Downloaded idc-index-data
E           #12 7.014  Downloaded pandas
E           #12 7.312  Downloaded marimo
E           #12 7.312 Prepared 233 packages in 6.81s
E           #12 10.88 Installed 233 packages in 3.56s
E           #12 23.75 Bytecode compiled 11791 files in 12.87s
E           #12 23.75  + aiofiles==25.1.0
E           #12 23.75  + aiohappyeyeballs==2.6.1
E           #12 23.75  + aiohttp==3.13.2
E           #12 23.75  + aiosignal==1.4.0
E           #12 23.75  + altgraph==0.17.4
E           #12 23.75  + annotated-doc==0.0.4
E           #12 23.75  + annotated-types==0.7.0
E           #12 23.75  + anyio==4.11.0
E           #12 23.75  + argon2-cffi==25.1.0
E           #12 23.75  + argon2-cffi-bindings==25.1.0
E           #12 23.75  + arrow==1.4.0
E           #12 23.75  + asgiref==3.10.0
E           #12 23.75  + asttokens==3.0.0
E           #12 23.75  + async-lru==2.0.5
E           #12 23.75  + attrs==25.4.0
E           #12 23.75  + babel==2.17.0
E           #12 23.75  + beautifulsoup4==4.14.2
E           #12 23.75  + bidict==0.23.1
E           #12 23.75  + bleach==6.3.0
E           #12 23.75  + boto3==1.41.0
E           #12 23.75  + botocore==1.41.0
E           #12 23.75  + bottle==0.13.4
E           #12 23.75  + cachetools==6.2.1
E           #12 23.75  + certifi==2025.11.12
E           #12 23.75  + cffi==2.0.0
E           #12 23.75  + charset-normalizer==3.4.4
E           #12 23.75  + click==8.2.1
E           #12 23.75  + cloudpathlib==0.23.0
E           #12 23.75  + comm==0.2.3
E           #12 23.75  + contourpy==1.3.3
E           #12 23.75  + cramjam==2.11.0
E           #12 23.75  + croniter==6.0.0
E           #12 23.75  + cryptography==46.0.3
E           #12 23.75  + cycler==0.12.1
E           #12 23.75  + debugpy==1.8.17
E           #12 23.75  + decorator==5.2.1
E           #12 23.75  + defusedxml==0.7.1
E           #12 23.75  + dicom-validator==0.7.3
E           #12 23.75  + dicomweb-client==0.59.3
E           #12 23.75  + dnspython==2.8.0
E           #12 23.75  + docutils==0.21.2
E           #12 23.75  + duckdb==1.4.1
E           #12 23.75  + email-validator==2.3.0
E           #12 23.75  + executing==2.2.1
E           #12 23.75  + faker==38.0.0
E           #12 23.75  + fastapi==0.121.3
E           #12 23.75  + fastapi-cli==0.0.16
E           #12 23.75  + fastapi-cloud-cli==0.3.1
E           #12 23.75  + fastjsonschema==2.21.2
E           #12 23.75  + fastparquet==2024.11.0
E           #12 23.75  + fonttools==4.61.0
E           #12 23.75  + fqdn==1.5.1
E           #12 23.75  + frozenlist==1.8.0
E           #12 23.75  + fsspec==2025.10.0
E           #12 23.75  + google-api-core==2.28.1
E           #12 23.75  + google-auth==2.43.0
E           #12 23.75  + google-cloud-bigquery==3.38.0
E           #12 23.75  + google-cloud-core==2.5.0
E           #12 23.75  + google-cloud-storage==3.6.0
E           #12 23.75  + google-crc32c==1.7.1
E           #12 23.75  + google-resumable-media==2.7.2
E           #12 23.75  + googleapis-common-protos==1.72.0
E           #12 23.75  + grpcio==1.76.0
E           #12 23.75  + grpcio-status==1.76.0
E           #12 23.75  + h11==0.16.0
E           #12 23.75  + highdicom==0.27.0
E           #12 23.75  + html-sanitizer==2.6.0
E           #12 23.75  + httpcore==1.0.9
E           #12 23.75  + httptools==0.7.1
E           #12 23.75  + httpx==0.28.1
E           #12 23.75  + humanize==4.14.0
E           #12 23.75  + idc-index-data==23.0.1
E           #12 23.75  + idna==3.11
E           #12 23.75  + ifaddr==0.2.0
E           #12 23.75  + ijson==3.4.0.post0
E           #12 23.75  + ipykernel==7.1.0
E           #12 23.75  + ipython==9.7.0
E           #12 23.75  + ipython-pygments-lexers==1.1.1
E           #12 23.75  + ipywidgets==8.1.8
E           #12 23.75  + isoduration==20.11.0
E           #12 23.75  + itsdangerous==2.2.0
E           #12 23.75  + jedi==0.19.2
E           #12 23.75  + jinja2==3.1.6
E           #12 23.75  + jmespath==1.0.1
E           #12 23.75  + jsf==0.11.2
E           #12 23.75  + json5==0.12.1
E           #12 23.75  + jsonpointer==3.0.0
E           #12 23.75  + jsonschema==4.25.1
E           #12 23.75  + jsonschema-specifications==2025.9.1
E           #12 23.75  + jupyter==1.1.1
E           #12 23.75  + jupyter-client==8.6.3
E           #12 23.75  + jupyter-console==6.6.3
E           #12 23.75  + jupyter-core==5.9.1
E           #12 23.75  + jupyter-events==0.12.0
E           #12 23.75  + jupyter-lsp==2.3.0
E           #12 23.75  + jupyter-server==2.17.0
E           #12 23.75  + jupyter-server-terminals==0.5.3
E           #12 23.75  + jupyterlab==4.4.10
E           #12 23.75  + jupyterlab-pygments==0.3.0
E           #12 23.75  + jupyterlab-server==2.28.0
E           #12 23.75  + jupyterlab-widgets==3.0.16
E           #12 23.75  + kiwisolver==1.4.9
E           #12 23.75  + lark==1.3.1
E           #12 23.75  + loguru==0.7.3
E           #12 23.75  + loro==1.8.2
E           #12 23.75  + lxml==5.4.0
E           #12 23.75  + lxml-html-clean==0.4.3
E           #12 23.75  + marimo==0.17.8
E           #12 23.75  + markdown==3.10
E           #12 23.75  + markdown-it-py==4.0.0
E           #12 23.75  + markdown2==2.5.4
E           #12 23.75  + markupsafe==3.0.3
E           #12 23.75  + marshmallow==3.26.1
E           #12 23.75  + matplotlib==3.10.7
E           #12 23.75  + matplotlib-inline==0.2.1
E           #12 23.75  + mdurl==0.1.2
E           #12 23.75  + mistune==3.1.4
E           #12 23.75  + msgspec-m==0.19.2
E           #12 23.75  + multidict==6.7.0
E           #12 23.75  + narwhals==2.11.0
E           #12 23.75  + nbclient==0.10.2
E           #12 23.75  + nbconvert==7.16.6
E           #12 23.75  + nbformat==5.10.4
E           #12 23.75  + nest-asyncio==1.6.0
E           #12 23.75  + nicegui==3.1.0
E           #12 23.75  + notebook==7.4.7
E           #12 23.75  + notebook-shim==0.2.4
E           #12 23.75  + numpy==2.3.4
E           #12 23.75  + oauthlib==3.3.1
E           #12 23.75  + openslide-bin==4.0.0.8
E           #12 23.75  + openslide-python==1.4.2
E           #12 23.75  + orjson==3.11.4
E           #12 23.75  + packaging==25.0
E           #12 23.75  + pandas==2.3.3
E           #12 23.75  + pandocfilters==1.5.1
E           #12 23.75  + parso==0.8.5
E           #12 23.75  + pexpect==4.9.0
E           #12 23.75  + pillow==12.0.0
E           #12 23.75  + platformdirs==4.5.0
E           #12 23.75  + procrastinate==3.5.3
E           #12 23.75  + prometheus-client==0.23.1
E           #12 23.75  + prompt-toolkit==3.0.52
E           #12 23.75  + propcache==0.4.1
E           #12 23.75  + proto-plus==1.26.1
E           #12 23.75  + protobuf==6.33.0
E           #12 23.75  + proxy-tools==0.1.0
E           #12 23.75  + psutil==7.1.3
E           #12 23.75  + psycopg==3.2.12
E           #12 23.75  + psycopg-pool==3.2.7
E           #12 23.75  + ptyprocess==0.7.0
E           #12 23.75  + pure-eval==0.2.3
E           #12 23.75  + pyasn1==0.6.1
E           #12 23.75  + pyasn1-modules==0.4.2
E           #12 23.75  + pycparser==2.23
E           #12 23.75  + pydantic==2.12.4
E           #12 23.75  + pydantic-core==2.41.5
E           #12 23.75  + pydantic-extra-types==2.10.6
E           #12 23.75  + pydantic-settings==2.12.0
E           #12 23.75  + pydicom==3.0.1
E           #12 23.75  + pygments==2.19.2
E           #12 23.75  + pyinstaller==6.16.0
E           #12 23.75  + pyinstaller-hooks-contrib==2025.9
E           #12 23.75  + pyjwt==2.10.1
E           #12 23.75  + pymdown-extensions==10.17.1
E           #12 23.75  + pyparsing==3.2.5
E           #12 23.75  + python-dateutil==2.9.0.post0
E           #12 23.75  + python-dotenv==1.2.1
E           #12 23.75  + python-engineio==4.12.3
E           #12 23.75  + python-json-logger==4.0.0
E           #12 23.75  + python-multipart==0.0.20
E           #12 23.75  + python-socketio==5.14.3
E           #12 23.75  + pytz==2025.2
E           #12 23.75  + pywebview==5.4
E           #12 23.75  + pyyaml==6.0.3
E           #12 23.75  + pyzmq==27.1.0
E           #12 23.75  + referencing==0.37.0
E           #12 23.75  + requests==2.32.5
E           #12 23.75  + requests-oauthlib==2.0.0
E           #12 23.75  + retrying==1.4.2
E           #12 23.75  + rfc3339-validator==0.1.4
E           #12 23.75  + rfc3986-validator==0.1.1
E           #12 23.75  + rfc3987-syntax==1.1.0
E           #12 23.75  + rich==14.2.0
E           #12 23.75  + rich-toolkit==0.15.1
E           #12 23.75  + rignore==0.7.6
E           #12 23.75  + rpds-py==0.28.0
E           #12 23.75  + rsa==4.9.1
E           #12 23.75  + rstr==3.2.2
E           #12 23.75  + s3transfer==0.14.0
E           #12 23.75  + s5cmd==0.3.3
E           #12 23.75  + semver==3.0.4
E           #12 23.75  + send2trash==1.8.3
E           #12 23.75  + sentry-sdk==2.45.0
E           #12 23.75  + setuptools==80.9.0
E           #12 23.75  + shapely==2.1.2
E           #12 23.75  + shellingham==1.5.4
E           #12 23.75  + simple-websocket==1.1.0
E           #12 23.75  + six==1.17.0
E           #12 23.75  + smart-open==7.5.0
E           #12 23.75  + sniffio==1.3.1
E           #12 23.75  + soupsieve==2.8
E           #12 23.75  + stack-data==0.6.3
E           #12 23.75  + starlette==0.50.0
E           #12 23.75  + tenacity==9.1.2
E           #12 23.75  + terminado==0.18.1
E           #12 23.75  + tinycss2==1.4.0
E           #12 23.75  + tomlkit==0.13.3
E           #12 23.75  + tornado==6.5.2
E           #12 23.75  + tqdm==4.67.1
E           #12 23.75  + traitlets==5.14.3
E           #12 23.75  + truststore==0.10.4
E           #12 23.75  + typer==0.20.0
E           #12 23.75  + typing-extensions==4.15.0
E           #12 23.75  + typing-inspection==0.4.2
E           #12 23.75  + tzdata==2025.2
E           #12 23.75  + ujson==5.11.0
E           #12 23.75  + universal-pathlib==0.2.6
E           #12 23.75  + uptime==3.0.1
E           #12 23.75  + uri-template==1.3.0
E           #12 23.75  + urllib3==2.5.0
E           #12 23.75  + uvicorn==0.38.0
E           #12 23.75  + uvloop==0.22.1
E           #12 23.75  + watchfiles==1.1.1
E           #12 23.75  + wcwidth==0.2.14
E           #12 23.75  + webcolors==25.10.0
E           #12 23.75  + webencodings==0.5.1
E           #12 23.75  + websocket-client==1.9.0
E           #12 23.75  + websockets==15.0.1
E           #12 23.75  + widgetsnbextension==4.0.15
E           #12 23.75  + wrapt==1.17.3
E           #12 23.75  + wsidicom==0.28.1
E           #12 23.75  + wsproto==1.3.1
E           #12 23.75  + yarl==1.22.0
E           #12 DONE 25.0s
E           
E           #14 [builder-all  2/12] COPY pyproject.toml /app
E           #14 DONE 0.0s
E           
E           #15 [builder-all  3/12] COPY .python-version /app
E           #15 DONE 0.0s
E           
E           #16 [builder-all  4/12] COPY uv.lock /app
E           #16 DONE 0.0s
E           
E           #17 [builder-all  5/12] COPY src /app/src
E           #17 DONE 0.0s
E           
E           #18 [builder-all  6/12] COPY LICENSE /app
E           #18 DONE 0.0s
E           
E           #19 [builder-all  7/12] COPY *.md /app
E           #19 DONE 0.0s
E           
E           #20 [builder-all  8/12] COPY .env.example /app/.env.example
E           #20 DONE 0.0s
E           
E           #21 [builder-all  9/12] COPY tests /app/tests
E           #21 DONE 0.0s
E           
E           #22 [builder-all 10/12] COPY examples /app/examples
E           #22 DONE 0.0s
E           
E           #23 [builder-all 11/12] COPY codegen/out/aignx .../codegen/out/aignx
E           #23 DONE 0.0s
E           
E           #24 [builder-all 12/12] RUN --mount=type=cache,target=/root/.cache/uv     uv sync --frozen --all-extras --no-dev --no-editable
E           #24 0.320 error: No interpreter found for Python 3.13.9 in managed installations or search path
E           #24 0.320 
E           #24 0.320 hint: A managed Python download is available for Python 3.13.9, but Python downloads are set to 'never'
E           #24 ERROR: process "/bin/sh -c uv sync --frozen --all-extras --no-dev --no-editable" did not complete successfully: exit code: 2
E           ------
E            > [builder-all 12/12] RUN --mount=type=cache,target=/root/.cache/uv     uv sync --frozen --all-extras --no-dev --no-editable:
E           0.320 error: No interpreter found for Python 3.13.9 in managed installations or search path
E           0.320 
E           0.320 hint: A managed Python download is available for Python 3.13.9, but Python downloads are set to 'never'
E           ------
E           Dockerfile:77
E           
E           --------------------
E           
E             76 |     
E           
E             77 | >>> RUN --mount=type=cache,target=/root/.cache/uv \
E           
E             78 | >>>     uv sync --frozen --all-extras --no-dev --no-editable
E           
E             79 |     
E           
E           --------------------
E           
E           failed to solve: process "/bin/sh -c uv sync --frozen --all-extras --no-dev --no-editable" did not complete successfully: exit code: 2
E           
E           """.

..../test-3-13-9/lib/python3.13............/site-packages/pytest_docker/plugin.py:37: Exception

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Dec 3, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@olivermeyer olivermeyer merged commit fe9149f into main Dec 3, 2025
21 of 25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@helmut-hoffer-von-ankershoffen helmut-hoffer-von-ankershoffen helmut-hoffer-von-ankershoffen approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@olivermeyer @helmut-hoffer-von-ankershoffen