Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

CI: install the remaining test dependencies from hashed requirements

Open
#335 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, python
Domain
ci-cd

Research direction

Read .github/workflows/test.yml, .github/workflows/vscode-extension.yml, and pyproject.toml, then locate the sandbox and lens requirements files and the test jobs' torch install. Make the installs use hashes, decide and document how the train extras are handled, and add --ignore-scripts to the extension job's npm ci. Run the extension build and tests; done when the issue's three checklist items pass.

Written by the indexing model from the issue text.

Description

area/ci security status/ready

What needs doing

The test workflow installs its own tools from a hashed lock file.
Seven installs are still unhashed: the sandbox and lens requirements
and the torch install in the test jobs. Move them to hashed
requirements files. Decide for the train extras in pyproject.toml
whether to commit a lock file or to record why they stay as lower
bounds. In .github/workflows/vscode-extension.yml the extension
job's npm ci lets package install scripts run: add
--ignore-scripts, and check that the build and the tests still pass.

Why

A hashed install is reproducible, and it fails when a package differs
from the locked one.

Done when

  • No pip install in .github/workflows/test.yml runs without
    --require-hashes.
  • The extension job installs with npm ci --ignore-scripts.
  • The decision for the train extras is written down.

Refs #202

Dominant language
Python
Stars
2.1k
Forks
197
Avg merge
9h 42m
Merged PRs (30d)
325

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from inferstep/ATLAS

All issues in inferstep/ATLAS

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.