Parapred environment by mzueva · Pull Request #55 · platforma-open/runenv-python-3

mzueva · 2026-02-06T15:47:56Z

Support git references in dependencies, add new parapred environment

gemini-code-assist · 2026-02-06T15:48:18Z

Summary of Changes

Hello @mzueva, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the Python environment builder by introducing support for Git-based package dependencies and providing more granular control over the 'pip download' process. It also integrates a new 'parapred' environment, streamlining the setup for projects requiring this specific configuration.

Highlights

Git URL Package Name Extraction: The build process can now correctly extract package names from 'git+https' URLs, enabling direct installation of packages from Git repositories.
Overwrite Existing Files during Download: 'pip download' commands now use '--exists-action w' to ensure that existing package files are overwritten, preventing potential issues with stale or incomplete downloads.
Configurable '--no-deps' for Packages: A new 'noDeps' configuration option allows specifying packages that should be installed without their transitive dependencies, offering greater control over the dependency graph.
Introduction of 'parapred' Python Environment: A new Python 3.12.10 environment, 'parapred', has been added, configured to include 'parapred-pytorch' from a Git reference and other specific dependencies.

Changelog

builder/src/build.ts
- Enhanced 'getPackageName' to parse package names from 'git+https' URLs.
- Added '--exists-action w' to 'pip download' arguments for overwriting existing files.
- Implemented conditional '--no-deps' flag for 'pip download' based on package configuration.
builder/src/config-merger.ts
- Introduced 'noDeps' array in package configuration to manage transitive dependency installation.
catalogue/package.json
- Registered the new '3.12.10-parapred' environment.
- Added 'milaboratories.runenv-python-3.12.10-parapred' as a dependency.
checker/whitelists/python-3.12.10-parapred/macosx-aarch64.json
- Added a new whitelist file for 'torch' in the 'parapred' environment on macOS AArch64.
pnpm-lock.yaml
- Updated the lockfile to reflect the addition of the 'parapred' environment.
pnpm-workspace.yaml
- Included 'python-3.12.10-parapred' in the workspace definition.
python-3.12.10-parapred/config.json
- Created a new configuration file for the 'parapred' environment, defining its dependencies, including 'parapred-pytorch' from a Git URL, and specifying 'parapred-pytorch' for '--no-deps'.
python-3.12.10-parapred/package.json
- Created a new package definition file for the 'parapred' environment, detailing its metadata and build scripts.

Activity

The pull request was initiated by mzueva with the goal of supporting Git references in dependencies and adding a new 'parapred' environment.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces support for git references in dependencies, adds a new parapred environment, and includes a --no-deps option for package installation. A critical security vulnerability was identified in the package name extraction logic for git URLs, which could lead to command injection on Windows systems due to insecure command execution. This issue requires immediate sanitization. Additionally, the review focused on improving code efficiency and maintainability in the build script.

builder/src/build.ts

gemini-code-assist · 2026-02-06T15:51:33Z

pnpm-lock.yaml


  glob@10.4.5:
    resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me


The glob@10.4.5 package is marked as deprecated and contains known security vulnerabilities. This should be addressed by updating the dependency tree. You can find which package depends on it by running pnpm why glob and then update the responsible parent dependency.

builder/src/build.ts

rfiskov · 2026-02-06T16:14:01Z

builder/src/build.ts


    const packageName = getPackageName(depSpecClean);
    const packageNameNorm = normalizePackageName(packageName);
+    const noDepsList = (config.packages.noDeps || []).map(normalizePackageName);


noDepsList doesn’t depend on the current package, but it’s being recomputed on every iteration of for (const depSpec of allDeps). It’s better to move its computation outside the loop (similar to how resolution is computed once on line 258).

Moved outside of loop

rfiskov · 2026-02-06T16:50:13Z

builder/src/build.ts

          // Only force source for this package, not its dependencies
          pipArgs.push('--no-binary', packageName);
+          if (shouldNoDeps) {
+            pipArgs.push('--no-deps');


--no-deps logic is duplicated in three separate branches

The same pattern appears three times. If a fourth download path is added in the future, it's easy to miss. Consider extracting this into buildPipArgs() by passing the package name and the noDeps set, or adding a helper that decorates pip args.

added to buildPipArgs()

rfiskov · 2026-02-06T16:53:25Z

builder/src/build.ts

    '--dest',
-    destinationDir
+    destinationDir,
+    '--exists-action', 'w'


--exists-action w is a global behavioral change affecting all environments

This flag tells pip to wipe and re-download when a file already exists in the destination directory. Previously, pip would error or prompt in non-interactive mode, which would surface issues like duplicate/conflicting downloads.

With w, conflicts are silently resolved by overwriting. Applying it globally could mask legitimate issues in other environments. Consider either:

Adding a comment explaining why this is needed globally

Making it conditional (only for git URL deps)

made conditional

rfiskov · 2026-02-06T16:59:21Z

python-3.12.10-parapred/config.json

+    "overrides": {},
+    "platformSpecific": {},
+    "resolution": {
+      "allowSourceList": ["parapred-pytorch"]


The allowSourceList entry here is easy to miss but actually critical — without it git deps just silently don't get installed.

What happens: pip tries to fetch a binary wheel for git+https://... → obviously fails → checks allowSourceList → package not there → skips it. And since strictMissing is false in shared config, there's no error — it just moves on like nothing
happened.

Feels like a trap for the next person who adds a git dependency. They won't know they need to also add it to allowSourceList until they debug why the package is missing at runtime. Maybe worth adding a check in the builder: if a dep starts with
git+ and isn't covered by allowSourceList or forceSource, fail early with a clear message?

added check

rfiskov · 2026-02-06T17:03:58Z

checker/whitelists/python-3.12.10-parapred/macosx-aarch64.json

@@ -0,0 +1,5 @@
+{


What about linux* ?

… built from source

rfiskov · 2026-02-09T09:14:30Z

builder/src/build.ts

+  // Validate that git URL deps are covered by source-allowing resolution policy.
+  // Without allowSourceList/allowSourceAll/forceSource, git deps silently get skipped
+  // because the binary wheel attempt always fails and strictMissing defaults to false.
+  for (const depSpec of allDeps) {
+    const spec = depSpec.trim();
+    if (!spec || !isGitUrl(spec)) continue;
+
+    const name = getPackageName(spec);
+    const nameNorm = normalizePackageName(name);
+    const coveredByForceSource = shouldForceSource(name, osType, archType)
+      || resolution.forceNoBinaryList?.includes(nameNorm);
+    const coveredByAllowSource = resolution.allowSourceAll
+      || resolution.allowSourceList?.includes(nameNorm);
+
+    if (!coveredByForceSource && !coveredByAllowSource) {
+      throw new Error(
+        `Git dependency "${spec}" is not in allowSourceList or forceSource. ` +
+        `Without this, the package will be silently skipped after binary wheel lookup fails. ` +
+        `Add "${name}" to packages.resolution.allowSourceList in config.json.`
+      );
+    }
+  }


nit: Please extract the validation logic into a separate function.

Support git references in dependencies, add new parapred environment

2f6fe6c

mzueva requested a review from DenKoren February 6, 2026 15:48

mzueva requested a review from rfiskov February 6, 2026 15:50

gemini-code-assist bot reviewed Feb 6, 2026

View reviewed changes

rfiskov reviewed Feb 6, 2026

View reviewed changes

Add new env to CI, review fix

b7e8b28

rfiskov reviewed Feb 6, 2026

View reviewed changes

Review fix

99026a3

rfiskov reviewed Feb 6, 2026

View reviewed changes

Review fix

716c8f6

rfiskov reviewed Feb 6, 2026

View reviewed changes

Add missing whitelist entries, add check that git dependencies can be…

c07b015

… built from source

rfiskov approved these changes Feb 6, 2026

View reviewed changes

rfiskov reviewed Feb 9, 2026

View reviewed changes

mzueva added 2 commits February 9, 2026 11:19

Code style review

b487d17

Changeset

928b6ab

mzueva merged commit 5e18bda into main Feb 9, 2026
75 of 76 checks passed

Conversation

mzueva commented Feb 6, 2026

Uh oh!

gemini-code-assist bot commented Feb 6, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist bot Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants