From cd8cdead34bbdf36a9284ce6d5b831f650069ae9 Mon Sep 17 00:00:00 2001 From: Gavin Borges Date: Thu, 23 Jul 2026 23:28:22 -0400 Subject: [PATCH] ci: drop the redundant unpinned Snakemake install (Scorecard Pinned-Dependencies) The DAG dry-run smoke step installed snakemake unpinned (pip install "snakemake>=8.0.0"), which OpenSSF Scorecard flagged as a Pinned-Dependencies violation (medium code-scanning alert #73). Snakemake and its full dependency set are already installed hash-pinned via environments/requirements-ci.txt in the test job "Install dependencies" step, so the separate install was redundant. Remove it; the DAG dry-run reuses the already-pinned snakemake. No functional change to the wiring check. --- .github/workflows/ci.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 46420de..ea65a68 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -146,16 +146,15 @@ jobs: - name: Run Contamination and Benchmark Evaluation Gate run: python scripts/benchmark_runner.py --tier A --run-id ci_dryrun --skip-freeze-check - - name: Install Snakemake - # Pipeline runner needed only for the DAG dry-run smoke check below. - run: pip install "snakemake>=8.0.0" - - name: Validate Snakemake pipeline wiring (DAG dry-run) # Runs UNCONDITIONALLY against a committed synthetic fixture so a renamed # rule output or a broken `include:` fails the PR. A dry-run only needs the # DAG's root input files to EXIST (not to be valid), so a 1-antigen fixture # + stub CSVs/joblib is enough to resolve the full 12-job DAG. Verified: - # clean wiring -> exit 0; renamed target -> exit 1. + # clean wiring -> exit 0; renamed target -> exit 1. Snakemake itself is + # already installed hash-pinned via environments/requirements-ci.txt in the + # "Install dependencies" step above; no separate unpinned install is needed + # (keeps OpenSSF Scorecard Pinned-Dependencies clean). run: | snakemake --snakefile pipeline.smk \ --configfile tests/fixtures/dag_smoke/config.smoke.yaml \