monopod wilks [minor]

.github/workflows/publish.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   image-publish:
-    uses: WIPACrepo/wipac-dev-workflows/.github/workflows/image-publish.yml@v1.20
+    uses: WIPACrepo/wipac-dev-workflows/.github/workflows/image-publish.yml@v1.25
     permissions: # for GITHUB_TOKEN
       packages: write
     with:
@@ -32,3 +32,5 @@ jobs:
       registry_username: ${{ secrets.DOCKERHUB_USERNAME }}
       registry_token: ${{ secrets.DOCKERHUB_TOKEN }}
       cvmfs_github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+      dockerfile_secret_name_0: github_token
+      dockerfile_secret_value_0: ${{ secrets.PERSONAL_ACCESS_TOKEN }}

.github/workflows/tests.yml

@@ -55,7 +55,7 @@ jobs:
     outputs:
       matrix: ${{ steps.versions.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
       - id: versions
@@ -142,7 +142,7 @@ jobs:
       matrix:
         py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
       - uses: actions/setup-python@v6
@@ -161,7 +161,7 @@ jobs:
       matrix:
         py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit ('github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
@@ -179,7 +179,7 @@ jobs:
     if: ${{ github.actor != 'dependabot[bot]' }} # dependabot cannot access PAT
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
           ref: ${{ github.ref }}  # dont lock to sha (action needs to push)
@@ -202,19 +202,21 @@ jobs:
 
       # pre-check passed, so proceed...
       - if: ${{ steps.pydep-precheck.outputs.do_generation == 'true' }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
       - if: ${{ steps.pydep-precheck.outputs.do_generation == 'true' }}
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - if: ${{ steps.pydep-precheck.outputs.do_generation == 'true' }}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: skymap_scanner:py-dep-this
           load: true
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
           build-args: INCLUDE_GCD=0  # for pip recording we don't need GCD files
       - if: ${{ steps.pydep-precheck.outputs.do_generation == 'true' }}
         uses: WIPACrepo/wipac-dev-py-dependencies-action@v3.4
@@ -228,17 +230,19 @@ jobs:
     needs: [ flake8 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: ${{ env._SCANNER_IMAGE_DOCKER }}
           load: false  # for checking if this builds, no loading needed
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
   test-run-dummy:
     needs: [ flake8 ]
@@ -265,17 +269,19 @@ jobs:
       - *free_disk_space
       - *df_disk_space
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: ${{ env._SCANNER_IMAGE_DOCKER }}
           load: true
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
           build-args: INCLUDE_GCD=0  # for dummy tests we don't need GCD files
 
       - if: ${{ matrix.container_platform == 'apptainer' }}
@@ -403,18 +409,20 @@ jobs:
       - *free_disk_space
       - *df_disk_space
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: ${{ env._SCANNER_IMAGE_DOCKER }}
           load: true
           build-args: INCLUDE_GCD=0  # for dummy tests we don't need GCD files
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
       - name: run
         timeout-minutes: 12  # on average max~=8.5min
@@ -499,17 +507,19 @@ jobs:
       - *free_disk_space
       - *df_disk_space
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: ${{ env._SCANNER_IMAGE_DOCKER }}
           load: true
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
       - name: run
         timeout-minutes: 55  # on average max~=35min
@@ -598,17 +608,19 @@ jobs:
     needs: [ flake8 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: ${{ env._SCANNER_IMAGE_DOCKER }}
           load: true
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
       - name: run
         run: |
@@ -651,17 +663,19 @@ jobs:
           - reco_algo: splinempe_pointed
             dir: "JSON"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
           fetch-depth: 0  # setuptools-scm needs to access git tags
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
           tags: ${{ env._SCANNER_IMAGE_DOCKER }}
           load: true
+          secrets: |
+            github_token=${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
       - name: run
         timeout-minutes: 10  # on average max~=5min
@@ -739,7 +753,7 @@ jobs:
       test-run-realistic,
       test-run-single-pixel,
     ]
-    uses: WIPACrepo/wipac-dev-workflows/.github/workflows/tag-and-release.yml@v1.20
+    uses: WIPACrepo/wipac-dev-workflows/.github/workflows/tag-and-release.yml@v1.25
     permissions: # for GITHUB_TOKEN
       contents: write
     with:

Dockerfile

@@ -35,6 +35,15 @@ RUN --mount=type=bind,source=.,target=/src,rw \
     --mount=type=cache,target=/tmp/pip-cache \
     pip install /src[rabbitmq]
 
+#INSTALL RECO REPOSITORY
+RUN --mount=type=secret,id=github_token \
+  git clone \
+    https://x-access-token:$(cat /run/secrets/github_token)@github.com/icecube/reco.git \
+    /opt/reco_src
+RUN --mount=type=cache,target=/tmp/pip-cache \
+  pip install /opt/reco_src
+
+
 # optional diagnostics
 RUN python --version
 RUN pip freeze