build: hash the dependency lock and install it with --require-hashes
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- Half a day
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker, github-actions, python
- Domain
- build-system, ci-cd
Research direction
Start with the header command in dokimi/requirements.lock.txt, then find the three install sites: the CI workflow steps, the dev target in the Makefile, and .agent-eval/Dockerfile. Before editing, decide how the unhashed tool pins (ruff, mypy) get hashes or their own hashed file, since --require-hashes rejects them. Done means the lock is regenerated with hashes, every install of it passes --require-hashes, and CI and make dev still install cleanly.
Written by the indexing model from the issue text.
Description
dokimi/requirements.lock.txt pins versions but not hashes, so pip install -r takes whatever the index serves for those versions. The lock is installed by:
- CI: tests, mypy, benchmark, external catalog smoke
make dev- the repository-eval image in
.agent-eval/Dockerfile(#57)
A swapped artifact on the index would go unnoticed in all three.
Proposal:
# header command of requirements.lock.txt
-uv pip compile requirements.txt requirements-test.txt --universal --python-version=3.11 --exclude-newer=P7D --output-file=requirements.lock.txt
+uv pip compile requirements.txt requirements-test.txt --universal --python-version=3.11 --exclude-newer=P7D --generate-hashes --output-file=requirements.lock.txt
Every pip install -r requirements.lock.txt then adds --require-hashes, and so does uv pip install in make dev.
Things to check before merging:
- Renovate's
pip-compilemanager re-runs the header command, so it keeps the hashes on refresh. - The tool pins installed next to the lock (
pip install ruff mypy …in the workflows and the eval image) are not in it. With--require-hashespip refuses unhashed requirements in the same command, so they need their own step or their own hashed file.
From review on #57 (jharlow-intel).
- Dominant language
- Python
- Stars
- 8
- Forks
- 7
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 199
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from intel/dokimi
-
eval cross-judge drops the provider when splitting the judge specPossibly taken @vlad-perevezentsev claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 38/100
Maintainers usually reply within 1 day
-
Consolidate duplicated subsystems (stats, LLM routing, judge loop, containers, digests, writers)Possibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
Answering stack: one implementation for evaluate/benchmark/answers and arms/subjectsPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 24/100
Maintainers usually reply within 1 day
Similar issues
-
difficulty:2 enhancement good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
MakazhanAlpamys/Soup#2309 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
google-deepmind/tapnet#173 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Netcracker/qubership-ai-packages#203 ·
Maintainers usually reply within 1 day
-
PAC Wording
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day