ci: harden ci

.archived/rats-examples-sklearn/pyproject.toml

@@ -128,6 +128,7 @@ quote-style = "double"            # Like Black, use double quotes for strings.
 indent-style = "space"            # Like Black, indent with spaces, rather than tabs.
 skip-magic-trailing-comma = false # Like Black, respect magic trailing commas.
 line-ending = "auto"              # Like Black, automatically detect the appropriate line ending.
+preview = true
 
 # Enable auto-formatting of code examples in docstrings. Markdown,
 # reStructuredText code/literal blocks and doctests are all supported.

.devcontainer/Dockerfile

@@ -0,0 +1,54 @@
+FROM nvcr.io/nvidia/cuda:13.3.0-cudnn-devel-ubuntu24.04
+
+ENV LANG=C.UTF-8 LC_ALL=C.UTF-8
+ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64
+ENV NCCL_DEBUG=INFO
+ENV HOROVOD_GPU_ALLREDUCE=NCCL
+
+RUN apt-get -qq update && \
+    apt-get upgrade -y --no-install-recommends && \
+    apt-get -qq clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /tmp/*
+
+RUN apt-get -qq update \
+    && apt-get -qq install --no-install-recommends \
+    python3-dev apt-transport-https ca-certificates curl wget gnupg lsb-release sudo git zsh \
+    openssh-server openssh-client tmux fzf direnv neovim xdg-utils \
+    && apt-get -qq clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /tmp/*
+
+RUN mkdir -p -m 755 /etc/apt/keyrings \
+    && wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
+    && curl -sLS https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/keyrings/microsoft.gpg > /dev/null \
+    && curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
+    && curl -fsSL https://packagecloud.io/github/git-lfs/gpgkey | gpg --dearmor -o /etc/apt/keyrings/github_git-lfs-archive-keyring.gpg \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /usr/share/keyrings/nodesource.gpg \
+    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+    && chmod go+r /etc/apt/keyrings/microsoft.gpg \
+    && chmod a+r /etc/apt/keyrings/docker.asc \
+    && chmod go+r /etc/apt/keyrings/github_git-lfs-archive-keyring.gpg \
+    && chmod go+r /usr/share/keyrings/nodesource.gpg \
+    && arch=$(dpkg --print-architecture) \
+    && node_version=24.x \
+    && echo "deb [arch=$arch signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/azure-cli.list > /dev/null \
+    && echo "deb [arch=$arch signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/ubuntu/$(lsb_release -rs)/prod $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/microsoft-prod.list > /dev/null \
+    && echo "deb [arch=$arch signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+    && echo "deb [arch=$arch signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null \
+    && echo "deb [arch=$arch signed-by=/etc/apt/keyrings/github_git-lfs-archive-keyring.gpg] https://packagecloud.io/github/git-lfs/ubuntu/ $(. /etc/os-release && echo "$VERSION_CODENAME") main" | tee /etc/apt/sources.list.d/github_git-lfs.list > /dev/null \
+    && cat <<EOF | tee /etc/apt/sources.list.d/nodesource.sources > /dev/null
+Types: deb
+URIs: https://deb.nodesource.com/node_$node_version
+Suites: nodistro
+Components: main
+Architectures: $arch
+Signed-By: /usr/share/keyrings/nodesource.gpg
+EOF
+
+RUN apt-get -qq update \
+    && apt-get -qq install --no-install-recommends azure-cli gh \
+    docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin git-lfs nodejs \
+    && apt-get -qq clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /tmp/*

.devcontainer/devcontainer.json

@@ -1,35 +1,44 @@
 {
-    "image": "mcr.microsoft.com/devcontainers/python:3.10",
+    "build": {
+        "dockerfile": "Dockerfile",
+        "context": ".."
+    },
     "features": {
-        "ghcr.io/devcontainers/features/git": {},
-        "ghcr.io/devcontainers/features/sshd": {},
-        "ghcr.io/devcontainers/features/github-cli": {},
-        "ghcr.io/devcontainers-contrib/features/tmux-apt-get": {},
         "ghcr.io/devcontainers/features/common-utils": {
             "configureZshAsDefaultShell": true
         },
-        "ghcr.io/devcontainers/features/docker-in-docker": {},
-        "ghcr.io/devcontainers-contrib/features/fzf": {},
-        "ghcr.io/devcontainers-contrib/features/pipx-package": {},
-        "ghcr.io/devcontainers-contrib/features/uv": {},
-        "ghcr.io/devcontainers-contrib/features/direnv": {},
-        "ghcr.io/devcontainers-contrib/features/pre-commit": {},
-        "ghcr.io/devcontainers-contrib/features/neovim-apt-get": {}
+        "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}
     },
     "onCreateCommand": ".devcontainer/on-create.sh",
     "postCreateCommand": ".devcontainer/post-create.sh",
+    "workspaceMount": "source=${localWorkspaceFolder},target=/workspace/${localWorkspaceFolderBasename},type=bind,consistency=cached",
+    "workspaceFolder": "/workspace/${localWorkspaceFolderBasename}",
+    "remoteEnv": {
+        "WANDB_API_KEY": "${localEnv:WANDB_API_KEY}",
+        "WANDB_BASE_URL": "${localEnv:WANDB_BASE_URL}"
+    },
+    "remoteUser": "vscode",
+    "hostRequirements": {
+        "gpu": "optional"
+    },
+    "runArgs": [
+        "--add-host=host.docker.internal:host-gateway"
+        // "--gpus=all"  // may need to add this if you want to use the host's GPU
+    ],
     "customizations": {
         "vscode": {
             "extensions": [
                 "ms-python.python",
-                "ms-python.vscode-pylance",
                 "ms-python.debugpy",
+                "ms-python.vscode-pylance",
+                "ms-azuretools.vscode-containers",
                 "ms-toolsai.jupyter",
+                "ms-vscode.vscode-chat-customizations-evaluations",
                 "charliermarsh.ruff",
                 "eamodio.gitlens",
                 "redhat.vscode-yaml",
                 "bierner.github-markdown-preview",
-                "GitHub.copilot",
+                "GitHub.copilot-chat",
                 "GitHub.vscode-pull-request-github"
             ]
         }

.devcontainer/direnvrc

@@ -1,16 +1,3 @@
-layout_uv() {
-  if [[ ! -f pyproject.toml ]]; then
-    log_status 'No pyproject.toml found. Will initialize poetry in no-interactive mode'
-    poetry init -n -q
-    poetry run pip install -U pip wheel setuptools
-  fi
-  poetry run echo >> /dev/null
-  local VENV=$(dirname $(poetry run which python))
-  export VIRTUAL_ENV=$(echo "$VENV" | rev | cut -d'/' -f2- | rev)
-  export POETRY_ACTIVE=1
-  PATH_add "$VENV"
-}
-
 layout_uv() {
   if [[ ! -f pyproject.toml ]]; then
     log_status 'No pyproject.toml found. Will initialize uv'
@@ -23,3 +10,37 @@ layout_uv() {
   export UV_ACTIVE=1  # or VENV_ACTIVE=1
   export VIRTUAL_ENV
 }
+
+layout_poetry() {
+  if [[ ! -f pyproject.toml ]]; then
+    log_error 'No pyproject.toml found. Use `poetry new` or `poetry init` to create one first.'
+    exit 2
+  fi
+
+  # create venv if it doesn't exist
+  poetry run true
+
+  PATH_add "$VIRTUAL_ENV/bin"
+  export VIRTUAL_ENV=$(poetry env info --path)
+  export POETRY_ACTIVE=1
+}
+
+layout_pdm() {
+  PYPROJECT_TOML="${PYPROJECT_TOML:-pyproject.toml}"
+  if [ ! -f "$PYPROJECT_TOML" ]; then
+    log_error 'No pyproject.toml found. Use `pdm init` to create one first.'
+    exit 2
+  fi
+
+  VIRTUAL_ENV=$(pdm venv list | grep "^\*"  | awk -F" " '{print $3}')
+
+  if [ -z "$VIRTUAL_ENV" ] || [ ! -d "$VIRTUAL_ENV" ]; then
+    log_status "No virtual environment exists. Executing \`pdm info\` to create one."
+	  pdm info
+    VIRTUAL_ENV=$(pdm venv list | grep "^\*"  | awk -F" " '{print $3}')
+  fi
+
+  PATH_add "$VIRTUAL_ENV/bin"
+  export PDM_ACTIVE=1
+  export VIRTUAL_ENV
+}

.devcontainer/on-create.sh

@@ -1,26 +1,25 @@
 #! /bin/bash
-# this runs ONCE at devcontainer creation time, and it runs during pre-build phase which
-# means it does not have access to user context
-# ===========================
-
-# finish config of direnv settings (would be nice to improve the devcontainer "feature")
 echo "CONFIGURING DIRENV..."
-echo 'eval "$(direnv hook zsh)"' >> ~/.zshrc
 echo 'eval "$(direnv hook bash)"' >> ~/.bashrc
+echo 'eval "$(direnv hook zsh)"' >> ~/.zshrc
 eval "$(direnv hook bash)"
 mkdir -p ~/.config/direnv/
-cp /workspaces/rats/.devcontainer/direnvrc ~/.config/direnv/direnvrc
+cp /workspace/$(basename "$(pwd)")/.devcontainer/direnvrc ~/.config/direnv/direnvrc
 
-echo "UPDATE PIP"
-pip install --upgrade pip
+echo "UV INSTALL"
+curl -LsSf https://astral.sh/uv/install.sh | sh
+echo 'eval "$(uv generate-shell-completion bash)"' >> ~/.bashrc
+echo 'eval "$(uvx --generate-shell-completion bash)"' >> ~/.bashrc
+echo 'eval "$(uv generate-shell-completion zsh)"' >> ~/.zshrc
+echo 'eval "$(uvx --generate-shell-completion zsh)"' >> ~/.zshrc
 
-echo "INSTALLING COMMITIZEN"
-pipx install commitizen
-pipx inject commitizen cz-conventional-gitmoji
-echo 'eval "$(register-python-argcomplete cz)"' >> ~/.zshrc
-echo 'eval "$(register-python-argcomplete cz)"' >> ~/.bashrc
+echo "INSTALLING COPILOT CLI"
+curl -fsSL https://gh.io/copilot-install | bash
+mkdir -p ~/.copilot/
+cp /workspace/$(basename "$(pwd)")/.devcontainer/mcp-config.json ~/.copilot/mcp-config.json
 
-direnv allow .
+echo "export DISPLAY=:0" >> ~/.bashrc
+echo "export DISPLAY=:0" >> ~/.zshrc
 
 directories=("rats-apps" "rats-devtools")
 # Loop through each directory

.devcontainer/post-create.sh

@@ -1,8 +1,6 @@
 #! /bin/bash
-# this runs ONCE after the container is created, and runs in the user's context inside the container
-# ===========================
-
-git config -–global core.editor "nano"
+echo "CONFIGURING GIT"
+git config --global core.editor "nano"
 git config --global pager.branch false
 git config --global alias.ba branch
 git config --global alias.co checkout
@@ -11,3 +9,35 @@ git config --global alias.sa stash
 git config --global alias.cp cherry-pick
 git config --global alias.mt mergetool
 git config --global alias.pl pull --rebase
+
+echo "GIT USER NAME"
+read -r -p "Enter your git user.name: " GIT_USER_NAME
+if [ -n "$GIT_USER_NAME" ]; then
+  git config --global user.name "$GIT_USER_NAME"
+fi
+
+echo "GIT USER EMAIL"
+read -r -p "Enter your git user.email: " GIT_USER_EMAIL
+if [ -n "$GIT_USER_EMAIL" ]; then
+  git config --global user.email "$GIT_USER_EMAIL"
+fi
+
+echo "GH LOGIN"
+echo "Click or copy the link to authenticate with your GitHub account."
+echo "This will configure your repo for pushing code and creating issues/pull requests."
+gh auth login --web
+
+echo "INSTALLING PACKAGES"
+uv sync --link-mode copy
+direnv allow .
+
+echo "INSTALLING COMMITIZEN"
+uv tool install commitizen --with cz-conventional-gitmoji --link-mode copy
+
+echo "CONFIGURING PRE-COMMIT"
+if [ ! -d .git ]; then
+    echo "Initializing Git..."
+    git init
+fi
+uv tool install pre-commit --with pre-commit-uv --link-mode copy
+pre-commit install --install-hooks

.github/actions/setup-environment/action.yaml

@@ -24,7 +24,9 @@ runs:
         COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }}
         COMMIT_REF: "${{ github.head_ref || github.ref_name }}"
         RUN_ID: "${{ github.run_id }}"
-      run: |
+      # writes to GITHUB_PATH/GITHUB_OUTPUT use static or internally-derived
+      # values (not untrusted input), so the github-env audit is a false positive
+      run: | # zizmor: ignore[github-env]
         # make sure people are able to use packages installed with pipx and into the devtools
         export PATH="${HOME}/.local/bin:$PATH"
         echo "${HOME}/.local/bin" >> $GITHUB_PATH
@@ -55,7 +57,7 @@ runs:
         echo "generating context for version: $PACKAGE_VERSION"
         echo "package-version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
     - name: "install-uv"
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
       with:
         version: "0.9"
     - id: "install-devtools"

.github/dependabot.yaml

@@ -12,7 +12,10 @@ updates:
     commit-message:
       prefix: ":arrow_up: dep-bump"
       include: scope
-  - package-ecosystem: pip
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: uv
     directory: /rats/
     schedule:
       interval: weekly
@@ -24,7 +27,10 @@ updates:
     commit-message:
       prefix: ":arrow_up: rats dep-bump"
       include: scope
-  - package-ecosystem: pip
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: uv
     directory: /rats-apps/
     schedule:
       interval: weekly
@@ -36,7 +42,10 @@ updates:
     commit-message:
       prefix: ":arrow_up: rats-apps dep-bump"
       include: scope
-  - package-ecosystem: pip
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: uv
     directory: /rats-devtools/
     schedule:
       interval: weekly
@@ -48,3 +57,5 @@ updates:
     commit-message:
       prefix: ":arrow_up: rats-devtools dep-bump"
       include: scope
+    cooldown:
+      default-days: 7

.github/workflows/automerge.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Enable auto-merge for Dependabot PRs

.github/workflows/build-docs.yaml

@@ -6,16 +6,19 @@ on:
         description: 'the git sha to checkout'
         required: true
         type: string
+permissions:
+  contents: read
 jobs:
   generate-docs:
     runs-on: "ubuntu-24.04"
     name: "generate-docs"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           fetch-tags: true
+          persist-credentials: false
       - uses: ./.github/actions/setup-environment
         id: runner-context
         with:
@@ -30,6 +33,6 @@ jobs:
           rats-ci install
           rats-docs build
       - name: "upload-gh-pages"
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: "rats-devtools/dist/site"