Merge pull request #47 from CompOmics/feat/sensitivity-improvements

Release readiness for v0.1.0: installable, portable, tested, documented

Author: RobbinBouwmeester

.dockerignore

@@ -1,17 +1,39 @@
-# Keep the build context small and free of machine-specific / large files.
-.git
-**/target
-**/.cargo/config.toml
-out_*/
-mzml_files/
-fasta/
-notebooks/
-sidecar_work/
-*.parquet
-*.mzML
-*.mzml
-*.raw
-*.pin
-*.log
-__pycache__/
-*.pyc
+# ALLOWLIST, not a deny list.
+#
+# A deny list is the wrong shape for a build context: it has to be updated every time
+# something new appears in the tree, and the thing that appears is exactly the thing
+# nobody thought to exclude. Two concrete cases it was already missing:
+#
+#   - `.gitignore` excludes `scripts/run_*.sh` and `scripts/_probe*.py` as "throwaway;
+#     hardcoded paths", but the Docker build context is the WORKING TREE, not the git
+#     tree, and the Dockerfile does `COPY scripts /opt/mumdia/scripts`. A locally built
+#     image would have baked them in. (CI builds from a clean checkout, so the published
+#     image was never affected -- it was latent, not live.)
+#   - untracked local data and vendored comparison sources (`alphadia/`, `lib/`,
+#     `raw_files/`, `val*/`, `mbr_work/`) all entered the context and were sent to the
+#     daemon on every local build.
+#
+# Everything is excluded, then the four things the Dockerfile actually COPYs are
+# re-included. Adding a new COPY now requires adding it here, which is the failure
+# direction we want: a build that misses a file, not an image that carries one.
+*
+
+# The workspace the release binary is built from.
+!rust
+rust/**/target
+rust/**/.cargo/config.toml
+
+# The Python sidecar workers the engine invokes, and their environment specs.
+!scripts
+scripts/__pycache__
+scripts/*.pyc
+# Local-only helpers with hardcoded paths (mirrors .gitignore).
+scripts/run_*.sh
+scripts/_probe*.py
+!env
+
+# The two baked configs, and the notices that must travel with the binary.
+!docker
+!LICENSE
+!THIRD_PARTY_LICENSES.md
+!sbom.cdx.json

.github/dependabot.yml

@@ -0,0 +1,62 @@
+# Dependency updates. Cargo.lock is tracked and both CI and the Docker build use
+# `--locked`, so a dependency only moves when a pull request moves it here.
+#
+# Grouped, monthly, and capped on purpose: the dependency surface is small (arrow,
+# parquet, mzdata, clap, serde, rayon and a handful of leaves) and an unreviewed
+# arrow or parquet bump can change artifact encoding, which is a data-format change
+# rather than a routine upgrade. Every bump still has to pass the full CI gate.
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /rust/mumdia
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    groups:
+      # The Arrow/Parquet pair must move together: they share a version line, and
+      # the engine's on-disk contract (snappy, utf8, list columns) rides on them.
+      arrow-parquet:
+        patterns:
+          - arrow*
+          - parquet*
+      # Everything else, batched so review is one pull request rather than ten.
+      rust-minor-and-patch:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - arrow*
+          - parquet*
+        update-types:
+          - minor
+          - patch
+
+  # Base images, so the digest pins in the Dockerfile stay current instead of
+  # freezing the image on a base that stops receiving security updates. Pinning
+  # without an update path is how a reproducible image becomes an unpatched one.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 2
+
+  # No `pip` entry, deliberately. The Python dependency surface lives in the pip
+  # sections of the conda specifications under `env/`, which Dependabot does not
+  # parse: its pip ecosystem reads requirements.txt, pyproject.toml, Pipfile or
+  # poetry.lock. Adding a mirror requirements file to satisfy the scanner would
+  # create a second list that nothing installs and that drifts from the one that
+  # does, which is worse than no entry.
+  #
+  # What covers the gap meanwhile: the `sidecar-imports` CI job resolves both
+  # environments for real and runs `pip-audit` over them, so a known
+  # vulnerability in a sidecar dependency fails a build. The permanent fix is
+  # `scripts/pyproject.toml` (docs/22, WP4), after which a `pip` entry pointing
+  # at /scripts belongs here.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns:
+          - "*"