Fix dependency conflicts, add psims, CI workflow, and end-to-end test - #18
martingarridorc wants to merge 4 commits into
Conversation
- Remove pytorch-lightning>=1.9,<2.0 (conflicts with lightning>=2.0; the lightning package already ships pytorch_lightning as a compat shim) - Widen lightning bound to <3.0 so pip resolves against current releases - Add [test] extra with pytest - Add .github/workflows/ci.yml: installs CPU-only torch first to avoid the CUDA wheel, then runs the full test suite on Python 3.10 and 3.11 - Add tests/create_mini_mzml.py: generates a 41 KB synthetic DIA mzML (5 cycles x 4 spectra) to exercise the augmentation pipeline in CI - Add tests/create_dummy_ckpt.py: saves a random-weight production-arch checkpoint (~190 MB) cached across runs via actions/cache - Add tests/test_install.py: import, mzML parsing, augment_spectra, tokenizer smoke tests (no GPU or checkpoint required) - Add tests/test_e2e.py: full cascadia sequence pipeline test using the cached dummy checkpoint (skipped if CASCADIA_DUMMY_CKPT is unset)
Two bugs from the first CI run:
1. trainer.strategy.connect() + trainer.save_checkpoint() requires
Lightning to have completed internal fit setup, which does not happen
without an actual training call. Replaced with a direct torch.save()
of the Lightning checkpoint dict (load_from_checkpoint only needs
state_dict when all hyperparams are supplied as kwargs).
2. ~ in YAML env vars is not shell-expanded, so "${{ env.CKPT_PATH }}"
passed the literal string ~/... to Python, causing mkdir to create a
directory named ~. Fixed by resolving the path via $HOME in a
dedicated workflow step that writes to GITHUB_ENV, and added
Path.expanduser() in both Python scripts as a defensive measure.
pyteomics>=4.7 requires psims for PSI format (mzML/mzXML) parsing. Was present locally as a transitive dep but missing from the declared dependencies, causing CI to fail on a clean install.
write_results is defined in cascadia/utils.py but was never imported — only .depthcharge.utils was pulled in via wildcard import. The function call on line 87 raised NameError at runtime. Exposed by CI running the full sequence() pipeline end-to-end.
📝 WalkthroughWalkthroughAdds dependency updates, deterministic mzML and checkpoint generators, installation and end-to-end tests, an explicit utility import, and a GitHub Actions matrix that runs the test suite with cached CPU checkpoints. ChangesCI and end-to-end validation
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
tests/test_e2e.py (2)
28-36: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winUse the exact
--outfileflag instead of the abbreviated--out.
cascadia/cascadia.pydefines-o/--outfile, not--out. This currently works only because argparse's default abbreviation matching resolves it unambiguously — it will silently break if a future flag starting with--outis added.♻️ Suggested fix
sys.argv = [ "cascadia", "sequence", str(mzml_file), CKPT_PATH, - "--out", out_prefix, + "--outfile", out_prefix, "--batch_size", "4", "--max_charge", "2", ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_e2e.py` around lines 28 - 36, Update the command arguments in the e2e test’s sys.argv setup to use the exact --outfile option defined by the cascadia CLI, replacing the abbreviated --out flag while preserving the existing output prefix value.
28-39: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePrefer
monkeypatchforsys.argvinstead of a raw assignment.
sys.argvis overwritten globally with no teardown/restoration;pytest'smonkeypatchfixture would auto-restore it and is the idiomatic pattern for CLI-arg tests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_e2e.py` around lines 28 - 39, Update the test invoking cascadia.cascadia.sequence to accept pytest’s monkeypatch fixture and use it to replace sys.argv, preserving the existing CLI arguments while ensuring automatic restoration after the test.tests/test_install.py (1)
24-29: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicated mzML-fixture bootstrap logic across test files. Both files repeat the same
sys.path.insert(0, str(TESTS_DIR))+from create_mini_mzml import create_mini_mzmlpattern instead of sharing one helper/fixture.
tests/test_install.py#L24-L29: keep_make_mini_mzmlhere, or better, move it into a sharedtests/conftest.pyfixture.tests/test_e2e.py#L21-L24: replace the inlinesys.path.insert+ import with the shared helper/fixture fromtests/conftest.py(or import_make_mini_mzmlfromtest_install.py) instead of duplicating the bootstrap logic.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_install.py` around lines 24 - 29, Centralize the duplicated create_mini_mzml bootstrap by moving _make_mini_mzml from tests/test_install.py into a shared tests/conftest.py helper or fixture, preserving its existing behavior. Update tests/test_e2e.py to use that shared helper/fixture instead of maintaining its own sys.path insertion and import; both affected sites require these changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 25: Update the actions/checkout@v4 step to disable credential persistence
by setting its persist-credentials option to false, while leaving the existing
checkout behavior unchanged.
---
Nitpick comments:
In `@tests/test_e2e.py`:
- Around line 28-36: Update the command arguments in the e2e test’s sys.argv
setup to use the exact --outfile option defined by the cascadia CLI, replacing
the abbreviated --out flag while preserving the existing output prefix value.
- Around line 28-39: Update the test invoking cascadia.cascadia.sequence to
accept pytest’s monkeypatch fixture and use it to replace sys.argv, preserving
the existing CLI arguments while ensuring automatic restoration after the test.
In `@tests/test_install.py`:
- Around line 24-29: Centralize the duplicated create_mini_mzml bootstrap by
moving _make_mini_mzml from tests/test_install.py into a shared
tests/conftest.py helper or fixture, preserving its existing behavior. Update
tests/test_e2e.py to use that shared helper/fixture instead of maintaining its
own sys.path insertion and import; both affected sites require these changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7ab9e380-e1e4-410a-9336-0de0ccc92b41
📒 Files selected for processing (8)
.github/workflows/ci.ymlcascadia/cascadia.pypyproject.tomltests/__init__.pytests/create_dummy_ckpt.pytests/create_mini_mzml.pytests/test_e2e.pytests/test_install.py
| CKPT_CACHE_KEY: cascadia-dummy-ckpt-arch-v1 | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable checkout credential persistence.
This workflow executes pull-request-controlled code via package installation, fixture generation, and pytest. actions/checkout@v4 otherwise stores GITHUB_TOKEN in .git/config, allowing malicious setup or test code to read and exfiltrate it. contents: read limits the token’s permissions but does not prevent credential exposure.
🔒 Proposed fix
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 25, Update the actions/checkout@v4 step to
disable credential persistence by setting its persist-credentials option to
false, while leaving the existing checkout behavior unchanged.
Source: Linters/SAST tools
|
Ran into second torch issue. Cancelling the PR |
1 participant
Summary
This PR fixes several installation issues discovered during a clean-environment install, adds a missing dependency, repairs a latent runtime bug uncovered by end-to-end testing, and introduces a GitHub Actions CI workflow that runs on every push.
Dependency fixes (
pyproject.toml)pytorch-lightning>=1.9,<2.0— this conflicted fatally withlightning>=2.0. Starting with version 2.0,pytorch-lightningwas merged into thelightningpackage, which already ships apytorch_lightningbackward-compatibility shim. Declaring both caused pip to fail on any fresh install.lightningbound to<3.0— the previous<2.1cap prevented installation of any release after 2.0.x. The public Trainer/LightningModule API used by Cascadia is stable across the 2.x series.psims— pyteomics ≥ 4.7 requirespsimsfor PSI format (mzML/mzXML) parsing. The package was absent from the declared dependencies; it happened to be present in the authors' conda environments as a transitive dependency, masking the gap. A clean install fails without it.Bug fix: missing
write_resultsimport (cascadia/cascadia.py)write_resultsis defined incascadia/utils.pybut was never imported — onlycascadia/depthcharge/utilswas pulled in via wildcard import. Every call tocascadia sequencewould raiseNameError: name 'write_results' is not definedat the final output step. This was caught by the new end-to-end test running inference all the way to SSL file generation.CI workflow (
.github/workflows/ci.yml)Runs on every push and pull request against Python 3.10 and 3.11.
Key design choices:
--index-url https://download.pytorch.org/whl/cpu) so pip does not pull in the multi-GB CUDA wheel.actions/cachewith a stable key — only regenerated when the architecture changes (~90 s first run, ~5 s on cache hits).Test suite (
tests/)tests/create_mini_mzml.pytests/create_dummy_ckpt.pytests/test_install.pyaugment_spectra, tokenizer (no checkpoint needed)tests/test_e2e.pycascadia sequencepipeline — augmentation → inference → SSL outputTest plan
pip install .succeeds in a fresh virtual environmentcascadia sequence <mzml> <ckpt>produces a.ssloutput fileSummary by CodeRabbit
New Features
psims.Bug Fixes
Tests