Skip to content
Open

D->M #274

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
75 commits
Select commit Hold shift + click to select a range
87aa50e
tw
Mar 4, 2021
a817c4e
Add prefix to alias name for generic index (#207)
scanon Apr 19, 2021
38339ca
Add docker build to GHA
scanon Apr 20, 2021
93ed134
Add import to GHA
scanon Apr 20, 2021
edb9046
Fix docker build
scanon Apr 20, 2021
e4deab2
Create release images
scanon Apr 20, 2021
15cbb18
Rename GHA tasks
scanon Apr 21, 2021
d71fc9a
Forgot steps
scanon Apr 21, 2021
a255f4a
Have to checkout again
scanon Apr 21, 2021
44b189f
Add poll timeout config for kafka consumer
scanon Apr 23, 2021
9bce46b
Add optional narrative reindex
scanon Jun 16, 2022
bbeedff
Bump version info
scanon Jun 16, 2022
4daf4aa
Add options for large workspaces
scanon Jun 29, 2022
71bab72
Missing key
scanon Jun 29, 2022
ea9a64a
Merge branch 'optional_narr_reindex' into skip_workspace
scanon Jul 8, 2022
1b375c1
Update CHANGELOG
scanon Jul 8, 2022
1748f62
skip_workspaces needs to be a list of integers not strings
scanon Jul 8, 2022
f469bb4
Option to skip es indexing and re conifg
scanon Aug 8, 2022
c8ca36b
add missing required field
scanon Aug 8, 2022
b144d32
add missing required field
scanon Aug 8, 2022
e92a3a2
Fix action
scanon Aug 9, 2022
9e882b1
Tweak action
scanon Aug 9, 2022
dafd31d
Tweak action
scanon Aug 9, 2022
0123ce4
Merge pull request #218 from kbase/optional_narr_reindex
scanon Aug 22, 2022
4edd5b0
Duplicate poll_timeout
scanon Aug 22, 2022
a373eac
Merge branch 'skip_workspace' of github.com:kbase/index_runner into s…
scanon Aug 22, 2022
76eda25
Merge pull request #219 from kbase/skip_workspace
scanon Aug 25, 2022
b3225c2
tw
Mar 4, 2021
cf9c334
Rebase and key fixes.
dakotablair Aug 25, 2022
20459de
Merge pull request #205 from slebras/sample_timetravel_error
scanon Aug 27, 2022
d7593d3
Merge branch 'develop' into sample_timetravel_error_fix
scanon Aug 27, 2022
b895ec9
Fix tests and flake8 issues.
scanon Aug 28, 2022
adf3aba
Merge branch 'develop' into skip_es
scanon Aug 28, 2022
907cf22
Bump version
scanon Aug 28, 2022
00bf143
Merge pull request #221 from kbase/sample_timetravel_error_fix
scanon Aug 30, 2022
d0dc404
Fix tests
scanon Sep 11, 2022
1a02422
Merge branch 'develop' into skip_es
scanon Sep 11, 2022
16fb127
Add lint step to unit tests.
dakotablair Aug 18, 2022
57b8493
Updated readme.
dakotablair Sep 12, 2022
eb48a7c
Merge pull request #222 from kbase/add-lint-to-unit-tests
scanon Sep 12, 2022
21e0449
add gha workflows
Xiangs18 Mar 26, 2025
9a2f604
update python version
Xiangs18 Mar 27, 2025
3b1ff3b
simplify test.yml script
Xiangs18 Mar 27, 2025
2b84efe
update test.yml
Xiangs18 Mar 27, 2025
0103fa2
remove ref
Xiangs18 Mar 27, 2025
90c9f6e
update python version and confluent-kafka version
Xiangs18 Apr 2, 2025
cbdfd3e
update poetry version and remove libressl-dev
Xiangs18 Apr 2, 2025
f0fca9e
fix '--no-dev' option does not exist
Xiangs18 Apr 2, 2025
e423ea2
add missing librdkafka-dev dep
Xiangs18 Apr 2, 2025
b8933dc
revert dep update
Xiangs18 Apr 2, 2025
3b279f3
add pytest-cov dep
Xiangs18 Apr 2, 2025
8b59409
add .coveragerc file
Xiangs18 Apr 2, 2025
8706835
fix docker image
Xiangs18 Apr 4, 2025
6ad9ec8
add run integration tests step
Xiangs18 Apr 10, 2025
87e676d
start the services in the background
Xiangs18 Apr 10, 2025
e7a4f9d
switch to docker compose from docker-compose
Xiangs18 Apr 10, 2025
a8e1652
fix docker-compose
Xiangs18 Apr 10, 2025
40eda2b
run docker compose up -d in GHA
Xiangs18 Apr 10, 2025
32a8d40
remove -d to produce verbose logs
Xiangs18 Apr 10, 2025
077cc78
reproduce logs
Xiangs18 Apr 10, 2025
8bad2af
update docker-compose
Xiangs18 Apr 10, 2025
7768ca8
rerun integration tests
Xiangs18 Apr 10, 2025
79e7ab5
add long timeout
Xiangs18 Apr 10, 2025
c5b707d
add timeout to integration tests
Xiangs18 Apr 10, 2025
3553db5
add a blank line
Xiangs18 Apr 10, 2025
706e611
retry with 1800s timeout
Xiangs18 Apr 10, 2025
93410bf
add display docker compose logs step
Xiangs18 Apr 11, 2025
6bdf92a
add if failure()
Xiangs18 Apr 11, 2025
e2963dd
remove the logging: {driver: none}
Xiangs18 Apr 11, 2025
8f0edaa
Update README.md
bio-boris Apr 11, 2025
6f1af73
use env vars in CI
Xiangs18 Apr 14, 2025
277a70a
Merge branch 'dev-add_workflows' of github.com:kbase/index_runner int…
Xiangs18 Apr 14, 2025
a39a4ab
revert docker-compose.yaml file && add comments
Xiangs18 Apr 14, 2025
e075f63
fix docker-compose file obsolete version && pyproject.toml file
Xiangs18 Apr 14, 2025
e4f0360
Merge pull request #225 from kbase/dev-add_workflows
Xiangs18 Apr 16, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .coveragerc
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
[coverage:report]
omit =
*/test_*
52 changes: 52 additions & 0 deletions .github/codeql.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
name: "Code scanning - action"

on:
push:
pull_request:
schedule:
- cron: '0 19 * * 0'

jobs:
CodeQL-Build:

# CodeQL runs on ubuntu-latest and windows-latest
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
fetch-depth: 2

# If this run was triggered by a pull request event, then checkout
# the head of the pull request instead of the merge commit.
- run: git checkout HEAD^2
if: ${{ github.event_name == 'pull_request' }}

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
# Override language selection by uncommenting this and choosing your languages
# with:
# languages: go, javascript, csharp, python, cpp, java

# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v3

# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl

# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
# and modify them (or add more) to build your code if your project
# uses a compiled language

#- run: |
# make bootstrap
# make release

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
23 changes: 23 additions & 0 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
version: 2
updates:

# Docker
- package-ecosystem: docker
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 25

# Python
- package-ecosystem: "pip" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "monthly"
open-pull-requests-limit: 25

# GitHub Actions
- package-ecosystem: "github-actions"
directory: ".github/workflows"
schedule:
interval: "monthly"
open-pull-requests-limit: 25
11 changes: 11 additions & 0 deletions .github/workflows/manual-build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
---
name: Manual Build & Push
on:
workflow_dispatch:
Copy link

Copilot AI Oct 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space in YAML syntax - should be 'workflow_dispatch:' with proper indentation.

Suggested change
workflow_dispatch:
workflow_dispatch:

Copilot uses AI. Check for mistakes.
jobs:
build-push:
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
with:
name: '${{ github.event.repository.name }}-develop'
tags: br-${{ github.ref_name }}
secrets: inherit
Comment on lines +7 to +11

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix this problem, we should add a permissions block to the workflow file, .github/workflows/manual-build.yml. Since the workflow's main activity is building and pushing, and it uses a reusable workflow, we should grant only the minimal permissions required for the workflow to operate. If we are uncertain what permissions are needed for the reusable workflow, a good minimal starting point (as recommended by CodeQL) is to set all permissions to read. You can define the permissions block at the top level, so it applies to all jobs, unless jobs set their own restrictions.
Changes needed:

  • Add a permissions: block before the jobs: key in .github/workflows/manual-build.yml.
  • The block should specify contents: read as the baseline least privilege.
    No additional methods, definitions, or imports are needed—the change is the addition of a simple YAML block.
Suggested changeset 1
.github/workflows/manual-build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/manual-build.yml b/.github/workflows/manual-build.yml
--- a/.github/workflows/manual-build.yml
+++ b/.github/workflows/manual-build.yml
@@ -1,5 +1,7 @@
 ---
 name: Manual Build & Push
+permissions:
+  contents: read
 on:
  workflow_dispatch:
 jobs:
EOF
@@ -1,5 +1,7 @@
---
name: Manual Build & Push
permissions:
contents: read
on:
workflow_dispatch:
jobs:
Copilot is powered by AI and may make mistakes. Always verify output.
43 changes: 43 additions & 0 deletions .github/workflows/pr_build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
---
name: Pull Request Build, Tag, & Push
on:
pull_request:
branches:
- develop
- main
- master
types:
- opened
- reopened
- synchronize
- closed
jobs:
build-develop-open:
if: github.base_ref == 'develop' && github.event.pull_request.merged == false
uses: kbase/.github/.github/workflows/reusable_build.yml@main
secrets: inherit
build-develop-merge:
Comment on lines +16 to +19

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix the issue, add a permissions block at the top level of the workflow (global to all jobs), specifying the minimal set of permissions required by the jobs. If most jobs only need to read repository contents, you can set contents: read; if you know a subset of jobs (such as those pushing code or tags) require additional permissions (contents: write or pull-requests: write), you should consider setting those on those jobs individually, or broaden at the root if all need them. Based on the file's described jobs (building, tagging, pushing, scanning), the minimal starting point can be contents: read globally, but review or testing may require adding contents: write, pull-requests: write, or similar on jobs that push code, images, or create tags. In this fix, introduce at the workflow root:

permissions:
  contents: read

You may wish to expand this as you confirm job-level requirements.

The change needed is:

  • Insert a permissions: block after the workflow name (line 2).
    No new packages or imports are required; the fix is made only in .github/workflows/pr_build.yml.
Suggested changeset 1
.github/workflows/pr_build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
--- a/.github/workflows/pr_build.yml
+++ b/.github/workflows/pr_build.yml
@@ -1,5 +1,7 @@
 ---
 name: Pull Request Build, Tag, & Push
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Pull Request Build, Tag, & Push
permissions:
contents: read
on:
pull_request:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
if: github.base_ref == 'develop' && github.event.pull_request.merged == true
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
with:
name: '${{ github.event.repository.name }}-develop'
tags: pr-${{ github.event.number }},latest
secrets: inherit
build-main-open:
Comment on lines +20 to +26

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix this problem, add an explicit permissions block to the workflow. This can be done at the root level (so all jobs inherit it), or individually per job if some jobs require more or fewer privileges. Since the jobs here primarily build, tag, push, and scan on pull requests, it's safest to set a minimal contents: read at the workflow level, and expand only if any jobs require more privilege (for example, if pushing to releases, writing commit statuses, or posting comments on pull requests). As a starting point, set:

permissions:
  contents: read

at the top after the name: field. This gives all jobs access only to read repository contents. If a job (such as one that needs to comment on a pull request) needs more, you would expand only that job's permissions.

Files/regions/lines to change:

  • Edit .github/workflows/pr_build.yml
  • Add the permissions: block just below the name: on line 2 (i.e., as line 3), pushing the rest of the content down by one.

What is needed:

  • A single YAML block.
  • No imports or other code changes are needed.

Suggested changeset 1
.github/workflows/pr_build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
--- a/.github/workflows/pr_build.yml
+++ b/.github/workflows/pr_build.yml
@@ -1,5 +1,7 @@
 ---
 name: Pull Request Build, Tag, & Push
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Pull Request Build, Tag, & Push
permissions:
contents: read
on:
pull_request:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
if: (github.base_ref == 'main' || github.base_ref == 'master') && github.event.pull_request.merged == false
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
with:
name: '${{ github.event.repository.name }}'
tags: pr-${{ github.event.number }}
secrets: inherit
build-main-merge:
Comment on lines +27 to +33

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix this issue, add a permissions key at the top level of .github/workflows/pr_build.yml (just below the name: and before on:) to restrict the permissions of the GITHUB_TOKEN that runs this workflow. Since this workflow is triggered by pull requests and delegates actual work to reusable workflows, it's safest to start with the minimal recommended permissions: contents: read only. This allows the workflow to read repository contents, but not push, create, or modify anything. If this workflow (including the reusable workflows it calls) needs to create or modify pull requests (for example, update statuses or post comments), you could add pull-requests: write. Otherwise, stay as restrictive as possible.

Region to change:

  • File: .github/workflows/pr_build.yml
  • Add the following block near the top, below name: and before on:

No imports, definitions, or methods required; just add the YAML block.

Suggested changeset 1
.github/workflows/pr_build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
--- a/.github/workflows/pr_build.yml
+++ b/.github/workflows/pr_build.yml
@@ -1,5 +1,7 @@
 ---
 name: Pull Request Build, Tag, & Push
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Pull Request Build, Tag, & Push
permissions:
contents: read
on:
pull_request:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
if: (github.base_ref == 'main' || github.base_ref == 'master') && github.event.pull_request.merged == true
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
with:
name: '${{ github.event.repository.name }}'
tags: pr-${{ github.event.number }},latest-rc
secrets: inherit
trivy-scans:
Comment on lines +34 to +40

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix the problem, explicitly add a permissions block at the top level of the workflow so that all jobs launched in this workflow (unless they declare their own permissions) inherit these minimal privileges. The safest starting point is to grant only read access to repository contents with:

permissions:
  contents: read

This ensures any job in the workflow or in a downstream called reusable workflow will not receive write access to the repository from the GITHUB_TOKEN, unless they explicitly request more in their own scope.
The change should be made by adding the permissions block directly below the name key, and above the on key, at the top of the file.


Suggested changeset 1
.github/workflows/pr_build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
--- a/.github/workflows/pr_build.yml
+++ b/.github/workflows/pr_build.yml
@@ -1,5 +1,7 @@
 ---
 name: Pull Request Build, Tag, & Push
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Pull Request Build, Tag, & Push
permissions:
contents: read
on:
pull_request:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
if: (github.base_ref == 'develop' || github.base_ref == 'main' || github.base_ref == 'master' ) && github.event.pull_request.merged == false
uses: kbase/.github/.github/workflows/reusable_trivy-scans.yml@main
secrets: inherit
Comment on lines +41 to +43

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix this problem, a permissions block should be added — ideally at the top-level of the workflow YAML file so it applies to all jobs, unless specific jobs require additional write permissions. The default should be as restrictive as possible, ideally contents: read, which is sufficient for most build/test workflows triggered by pull requests. If certain jobs require elevated permissions (such as pull-requests: write or contents: write to push changes), they can have a more permissive block on that job only. The fix is to insert a top-level permissions block after the name field, specifying the minimal required access; based on the current jobs, contents: read should be enough. If subsequent investigation shows write is needed for releases, tags, or pull requests, that can be expanded.

Suggested changeset 1
.github/workflows/pr_build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
--- a/.github/workflows/pr_build.yml
+++ b/.github/workflows/pr_build.yml
@@ -1,5 +1,7 @@
 ---
 name: Pull Request Build, Tag, & Push
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Pull Request Build, Tag, & Push
permissions:
contents: read
on:
pull_request:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
25 changes: 25 additions & 0 deletions .github/workflows/release-main.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
---
name: Release - Build & Push Image
on:
release:
branches:
- main
- master
types: [ published ]
jobs:
check-source-branch:
uses: kbase/.github/.github/workflows/reusable_validate-branch.yml@main
with:
build_branch: '${{ github.event.release.target_commitish }}'
validate-release-tag:
Comment on lines +11 to +14

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix the problem, introduce a permissions block at the workflow root (just after the name: line) in .github/workflows/release-main.yml. To observe the least-privilege principle, set contents: read, which is the minimal permission needed for most workflows, unless additional permissions are required by the jobs. Since all jobs here are simple uses calls to reusable workflows and there is no evidence they require higher privileges, starting with contents: read is appropriate. If any of the called reusable workflows need additional or write permissions, specify these as finely as possible.

Steps:

  • Insert
    permissions:
      contents: read
    after the name: line (after line 2).

No other code or dependency changes are needed.


Suggested changeset 1
.github/workflows/release-main.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-main.yml b/.github/workflows/release-main.yml
--- a/.github/workflows/release-main.yml
+++ b/.github/workflows/release-main.yml
@@ -1,5 +1,7 @@
 ---
 name: Release - Build & Push Image
+permissions:
+  contents: read
 on:
   release:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Release - Build & Push Image
permissions:
contents: read
on:
release:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
needs: check-source-branch
uses: kbase/.github/.github/workflows/reusable_validate-release-tag.yml@main
with:
release_tag: '${{ github.event.release.tag_name }}'
build-push:
Comment on lines +15 to +19

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix the problem, add an explicit permissions key at the root of the workflow file, directly under the name: or on: fields. This should grant only the minimal required permissions for the workflow to function correctly. Since the workflow uses reusable workflows for validating a branch, validating a release tag, and building/pushing an image, it's likely that read access to the repository contents (contents: read) is sufficient for most steps. If any step requires additional permissions (such as packages: write for Docker or npm registry, or pull-requests: write), these should be explicitly added at the root or per-job basis as needed.

As a minimal starting point, and unless further knowledge about the needs of the downstream reusable workflows is provided, supplying contents: read as the default is the safest option. You can adjust and expand as necessary if errors arise due to permission issues.

You need to:

  • Insert the following block after the name: field (preferably) in .github/workflows/release-main.yml:
    permissions:
      contents: read
Suggested changeset 1
.github/workflows/release-main.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-main.yml b/.github/workflows/release-main.yml
--- a/.github/workflows/release-main.yml
+++ b/.github/workflows/release-main.yml
@@ -1,5 +1,7 @@
 ---
 name: Release - Build & Push Image
+permissions:
+  contents: read
 on:
   release:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Release - Build & Push Image
permissions:
contents: read
on:
release:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
needs: validate-release-tag
uses: kbase/.github/.github/workflows/reusable_build-push.yml@main
with:
name: '${{ github.event.repository.name }}'
tags: '${{ github.event.release.tag_name }},latest'
secrets: inherit
Comment on lines +20 to +25

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix this issue, add a permissions block at the root of the workflow (just below name: and before on:), specifying the minimum required permissions for the workflow. Since this workflow only involves running checks and triggering builds/pushes (presumably via reusable workflows), it's most secure to start with contents: read. If any job or called workflow needs greater or more specific permissions (pull-requests: write, etc.), those should be explicitly set at the job or reusable workflow level. The change should be a single, simple edit near the top of the workflow file.

  • How:
    Add

    permissions:
      contents: read

    immediately after the name: line, and before the on: block.

  • What:
    Only edit .github/workflows/release-main.yml. No function/method changes are required; this is a metadata-only change in the workflow YAML file.

  • Where:
    After line 2, before line 3.


Suggested changeset 1
.github/workflows/release-main.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-main.yml b/.github/workflows/release-main.yml
--- a/.github/workflows/release-main.yml
+++ b/.github/workflows/release-main.yml
@@ -1,5 +1,7 @@
 ---
 name: Release - Build & Push Image
+permissions:
+  contents: read
 on:
   release:
     branches:
EOF
@@ -1,5 +1,7 @@
---
name: Release - Build & Push Image
permissions:
contents: read
on:
release:
branches:
Copilot is powered by AI and may make mistakes. Always verify output.
44 changes: 0 additions & 44 deletions .github/workflows/test-release.yml

This file was deleted.

60 changes: 60 additions & 0 deletions .github/workflows/test.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Index Runner test

on:
pull_request:
types:
- opened
- reopened
- synchronize
- ready_for_review
push:
# run workflow when merging to main or develop
branches:
- main
- master
- develop

jobs:
test:
runs-on: ubuntu-latest

env:
WORKSPACE_TOKEN: ${{ secrets.WORKSPACE_TOKEN }}
RE_API_TOKEN: ${{ secrets.RE_API_TOKEN }}

steps:
- name: Checkout
uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: 3.9.19

- name: Pip installation
run: python -m pip install --upgrade pip poetry

- name: Poetry installation
run: poetry install

- name: Run unit tests
run: scripts/run_unit_tests

- name: Run integration tests
run: |
echo "WORKSPACE_TOKEN=$WORKSPACE_TOKEN" > .env
echo "RE_API_TOKEN=$RE_API_TOKEN" >> .env
scripts/run_integration_tests

- name: Print Docker Compose logs
if: failure()
run: docker compose logs

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
fail_ci_if_error: true
Comment on lines +22 to +60

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium test

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 2 months ago

The recommended fix is to add a minimal permissions block specifying the least privilege necessary for the job to function. Since the workflow as shown does not require write access to the repository's contents and only performs read operations (checking out code, running tests, uploading coverage), the safest default is to set contents: read. Add a permissions: section at the top level of the workflow, immediately below the name: field, or at the job level (inside the test: job block); for workflows with simple or single jobs, top-level is preferred and more DRY. This requires editing the .github/workflows/test.yml file, inserting:

permissions:
  contents: read

immediately before the on: declaration.

No changes to imports, definitions, or other configuration are required.


Suggested changeset 1
.github/workflows/test.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,8 @@
 # For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
 
 name: Index Runner test
+permissions:
+  contents: read
 
 on:
   pull_request:
EOF
@@ -2,6 +2,8 @@
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Index Runner test
permissions:
contents: read

on:
pull_request:
Copilot is powered by AI and may make mistakes. Always verify output.
19 changes: 19 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [1.9.21] - 2022-08-28

### Added
- Configuration parameter to disable elastic indexing
- Mimimal configuration file for an RE only indexer

## [1.9.20] - 2022-06-15

### Added
- Configuration parameter for max objects in a workspace to skip narrative reindex
- Configuration option to skip narrative reindex for certain workspaces
- Configuration option for poll timeout
- Configuration option to skip narrative reindexing

## [1.9.19] - 2021-04-19

### Fixed
- Fixing Samples Releng indexer to work with RE api time-travel.
- Added prefix to default_search alias
- Removed reads_1 from reads alias
- Removed pangenome_orthologfamily from default_search

### Added
- adding narrative_config.yaml spec file for separating narrative indexing.
Expand Down
18 changes: 13 additions & 5 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
FROM python:3.7-alpine
FROM python:3.9.19-alpine

# Dockerize related args
ARG BUILD_DATE
ARG VCS_REF
ARG BRANCH=develop
ENV DOCKERIZE_VERSION v0.6.1

Check warning on line 7 in Dockerfile

View workflow job for this annotation

GitHub Actions / build-main-open / build-push-image

Legacy key/value format with whitespace separator should not be used

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/

Check warning on line 7 in Dockerfile

View workflow job for this annotation

GitHub Actions / build-push / build-push-image

Legacy key/value format with whitespace separator should not be used

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
ENV CRYPTOGRAPHY_DONT_BUILD_RUST 1

Check warning on line 8 in Dockerfile

View workflow job for this annotation

GitHub Actions / build-main-open / build-push-image

Legacy key/value format with whitespace separator should not be used

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/

Check warning on line 8 in Dockerfile

View workflow job for this annotation

GitHub Actions / build-push / build-push-image

Legacy key/value format with whitespace separator should not be used

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/

# Install dockerize
RUN apk --update add --virtual deps curl tar gzip && \
Expand All @@ -24,14 +25,21 @@
WORKDIR /app

# Dependency for confluent-kafka
RUN apk --update add librdkafka librdkafka-dev && ldconfig /usr/lib
RUN apk --update add build-base git cmake bash
RUN git clone --branch v2.6.1 https://github.com/confluentinc/librdkafka.git /tmp/librdkafka
RUN cd /tmp/librdkafka && \
./configure && \
make && \
make install && \
ldconfig /usr/lib
RUN rm -rf /tmp/librdkafka

# Install dependencies
COPY pyproject.toml poetry.lock /app/
RUN apk --update add --virtual deps python3-dev build-base libffi-dev libressl-dev && \
pip install --upgrade pip poetry==1.0.9 && \
RUN apk --update add --virtual deps python3-dev build-base libffi-dev && \
pip install --upgrade pip poetry==2.1.2 && \
poetry config virtualenvs.create false && \
poetry install --no-dev --no-interaction --no-ansi && \
poetry install --no-root --without dev --no-interaction --no-ansi && \
apk del deps

# Make the admin tools executable
Expand Down
22 changes: 19 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,27 @@ sure to partition the topic to at least the number of running workers.

## Development

### Dependencies

Note that `docker-compose` 2.3+ is required to run the tests.

In this project, python packages and dependencies are managed using poetry. To
install the development dependencies, create and activate a python virtual
environment and then run the `poetry install` command.

### Running the tests

Start the servers:

```sh
docker-compose up
```

Run the tests (servers need not be running, and will be shut down if they are):
To run all the tests the `RE_API_TOKEN` and `WORKSPACE_TOKEN` environment
variables must be set to admin tokens for the relation engine and workspace,
respectively. This project is set up to read a `.env` file, so they may be set
there. The following command will run the tests (servers need not be running,
and will be shut down if they are):

```sh
scripts/run_tests
Expand Down Expand Up @@ -45,6 +59,8 @@ You can set the following env vars:
* `SKIP_RELENG` - skip imports into the relation engine (ArangoDB)
* `SKIP_FEATURES` - skip any importing or indexing of genome features
* `SKIP_INDICES` - comma-separated list of index names that the service will not write into.
* `SKIP_WORKSPACES` - comma-separated list of workspaces that should be skipped
* `MAX_OBJECT_REINDEX` - If the number of objects in the workspace are greater than this value, then the narrative object will not automatically be reindexed.
* `ELASTICSEARCH_HOST` - host name of the elasticsearch server to use (do not prepend protocol)
* `ELASTICSEARCH_PORT` - port to use for the elasticsearch server
* `KBASE_ENDPOINT` - URL of kbase API services (default is "https://ci.kbase.us/services")
Expand Down Expand Up @@ -80,7 +96,7 @@ Examples:

Show command help: `indexer_admin -h`

_Reindex a specific object_
_Reindex a specific object_

```sh
# Reindex only if the doc does not exist
Expand Down Expand Up @@ -143,7 +159,7 @@ First, increment the versions found in `VERSION` and in `pyproject.toml`.

Then, build the image and push to docker hub with `scripts/docker_deploy`.

### Project anatomy
### Project Anatomy

* The main process and entrypoint for the app lives in `./src/index_runner/main.py`
* The entrypoint for ES indexing is in `./src/index_runner/es_indexer.py`
Expand Down
2 changes: 1 addition & 1 deletion VERSION
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.9.18
1.9.21
Loading
Loading