Restore analysis parity and correct integrated workflow behavior

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,31 @@
+name: Bug report
+description: Report a reproducible software or documentation problem
+title: "[BUG] "
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe what happened and what you expected.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Include the exact command, relevant flags, and a small input example when possible. Do not attach sensitive data.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Installation and environment
+      description: Include the WASP2 version, installation method or container tag, operating system, and Python version.
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Error output
+      description: Paste the relevant error or traceback.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -1,17 +1,5 @@
-blank_issues_enabled: false
+blank_issues_enabled: true
 contact_links:
-  - name: Security Vulnerability
+  - name: Security vulnerability
     url: https://github.com/mcvickerlab/WASP2/security/advisories/new
     about: Report security issues privately via GitHub Security Advisories
-
-  - name: General Question
-    url: https://github.com/mcvickerlab/WASP2/discussions
-    about: Ask questions or discuss WASP2 usage in Discussions
-
-  - name: Feature Request
-    url: https://github.com/mcvickerlab/WASP2/discussions/categories/ideas
-    about: Suggest new features or improvements in Discussions
-
-  - name: Bug Report (Non-Audit)
-    url: https://github.com/mcvickerlab/WASP2/issues/new
-    about: For general bug reports outside of release audits, create a blank issue

.github/ISSUE_TEMPLATE/scientific-validation.yml

@@ -1,7 +1,7 @@
 name: "Scientific Validation"
 description: "Report scientific accuracy concerns (for bioinformaticians/scientists)"
 title: "[SCIENCE] "
-labels: ["scientific-accuracy", "audit", "needs-domain-expert"]
+labels: ["scientific-accuracy", "needs-domain-expert"]
 body:
   - type: markdown
     attributes:

.github/workflows/ci.yml

@@ -123,11 +123,19 @@ jobs:
       - name: Run tests
         run: |
           source .venv/bin/activate
-          pytest tests/ -v --tb=short \
+          pytest tests/ -v --tb=short --junitxml=test-results.xml -o junit_family=xunit1 \
             -m "not benchmark and not sanity" \
             --ignore=tests/benchmarks \
             --ignore=tests/sanity
 
+      - name: Upload Python test results
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
+        with:
+          name: pytest-${{ matrix.python-version }}
+          path: test-results.xml
+          if-no-files-found: warn
+
   # ===========================================================================
   # Rust unit tests and clippy lints
   # ===========================================================================

.github/workflows/ecosystem.yml

@@ -73,8 +73,21 @@ jobs:
       - uses: nf-core/setup-nf-test@f2db585128ae681918440f6c074dededeceadce1  # v1
         with:
           version: "0.9.2"
+      - name: Set up Python for single-cell H5AD stubs
+        if: matrix.pipeline == 'nf-scatac'
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        with:
+          python-version: "3.11"
+      - name: Install single-cell stub dependencies
+        if: matrix.pipeline == 'nf-scatac'
+        run: python -m pip install "pandas>=1.5,<3.0" "scipy>=1.10" "anndata>=0.8,<0.12"
       - name: Run pipeline compatibility test
-        run: nf-test test tests/main.nf.test --tag ci_stub --profile=test_stub --ci --tap=ci-stub.tap --verbose
+        run: |
+          test_file=tests/main.nf.test
+          if [ "${{ matrix.pipeline }}" = "nf-scatac" ]; then
+            test_file=tests/pipeline.nf.test
+          fi
+          nf-test test "$test_file" --tag ci_stub --profile=test_stub --ci --tap=ci-stub.tap --verbose
       - name: Upload nf-test result
         if: always()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
@@ -83,16 +96,81 @@ jobs:
           path: pipelines/${{ matrix.pipeline }}/ci-stub.tap
           if-no-files-found: warn
 
+  nextflow-native:
+    name: Nextflow native process regressions
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        with:
+          python-version: "3.11"
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
+      - uses: astral-sh/setup-uv@7eb50e6e20e1e2009087999ba91242e80253875f  # v7
+      - uses: nf-core/setup-nextflow@6c2e22b4d901f0c42ca66c5069f8026df026d165  # v2
+        with:
+          version: "24.10.4"
+      - uses: nf-core/setup-nf-test@f2db585128ae681918440f6c074dededeceadce1  # v1
+        with:
+          version: "0.9.2"
+      - name: Build matching native software
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libhts-dev libbz2-dev liblzma-dev zlib1g-dev libssl-dev pkg-config libclang-dev
+          uv venv .venv
+          source .venv/bin/activate
+          uv pip install "maturin==1.14.1"
+          maturin develop --release --uv
+      - name: Run actual analysis and coverage regressions
+        run: |
+          source .venv/bin/activate
+          cat > "$RUNNER_TEMP/nf-native.config" <<EOF
+          config {
+              testsDir "$GITHUB_WORKSPACE"
+              workDir "$RUNNER_TEMP/nf-native-work"
+              configFile "$RUNNER_TEMP/nextflow-native.config"
+          }
+          EOF
+          cat > "$RUNNER_TEMP/nextflow-native.config" <<'EOF'
+          docker.enabled = false
+          singularity.enabled = false
+          conda.enabled = false
+          process.executor = 'local'
+          process.cpus = 1
+          process.memory = '1.GB'
+          params.min_count = 0
+          params.pseudocount = 0
+          params.min_cells_per_snp = 1
+          EOF
+          nf-test test -c "$RUNNER_TEMP/nf-native.config" --ci --tag correctness_regression --tap=native-process.tap \
+              pipelines/nf-atacseq/tests/modules/local/wasp2_find_imbalance.nf.test \
+              pipelines/nf-rnaseq/tests/modules/local/wasp2_analyze_imbalance.nf.test \
+              pipelines/nf-modules/modules/wasp2/analyze/tests/main.nf.test \
+              pipelines/nf-modules/modules/wasp2/analyze_imbalance/tests/main.nf.test \
+              pipelines/nf-scatac/tests/modules/local/scatac_pseudobulk.nf.test \
+              pipelines/nf-scatac/tests/subworkflows/wasp_allelic_sc.nf.test
+      - name: Upload native process results
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
+        with:
+          name: nf-test-native-processes
+          path: native-process.tap
+          if-no-files-found: warn
+
   required:
     name: Required / Ecosystem
     if: always()
-    needs: [galaxy, nextflow]
+    needs: [galaxy, nextflow, nextflow-native]
     runs-on: ubuntu-latest
     steps:
       - name: Verify ecosystem jobs
         env:
           GALAXY_RESULT: ${{ needs.galaxy.result }}
           NEXTFLOW_RESULT: ${{ needs.nextflow.result }}
+          NATIVE_RESULT: ${{ needs.nextflow-native.result }}
         run: |
           test "$GALAXY_RESULT" = success
           test "$NEXTFLOW_RESULT" = success
+          test "$NATIVE_RESULT" = success

.github/workflows/release.yml

@@ -193,7 +193,12 @@ jobs:
           python -m twine check dist/*
           uv venv .sdist-test
           uv pip install --python .sdist-test/bin/python dist/*.tar.gz
-          .sdist-test/bin/python -c "import wasp2, wasp2_rust; print(wasp2.__version__)"
+          SDIST_PYTHON="$GITHUB_WORKSPACE/.sdist-test/bin/python"
+          cd /tmp
+          "$SDIST_PYTHON" -c "import wasp2, wasp2_rust; print(wasp2.__version__)"
+          "$GITHUB_WORKSPACE/.sdist-test/bin/wasp2-count" --help
+          "$GITHUB_WORKSPACE/.sdist-test/bin/wasp2-map" --help
+          "$GITHUB_WORKSPACE/.sdist-test/bin/wasp2-analyze" --help
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
         with:
           name: source-distribution
@@ -309,9 +314,11 @@ jobs:
         with:
           persist-credentials: false
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
-      - uses: eWaterCycle/setup-singularity@931d4e31109e875b13309ae1d07c70ca8fbc8537  # v7
+      - uses: eWaterCycle/setup-apptainer@3f706d898c9db585b1d741b4692e66755f3a1b40
         with:
-          singularity-version: 3.11.4
+          apptainer-version: 1.4.5
+      - name: Verify container runtime
+        run: apptainer --version
       - name: Build local Docker archive
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
         with:
@@ -328,8 +335,8 @@ jobs:
         env:
           RELEASE_VERSION: ${{ needs.validate.outputs.version }}
         run: |
-          singularity build "wasp2_${RELEASE_VERSION}.sif" "docker-archive://${RUNNER_TEMP}/wasp2-docker.tar"
-          singularity exec "wasp2_${RELEASE_VERSION}.sif" /opt/wasp2/scripts/container_smoke_test.sh
+          apptainer build "wasp2_${RELEASE_VERSION}.sif" "docker-archive://${RUNNER_TEMP}/wasp2-docker.tar"
+          apptainer exec "wasp2_${RELEASE_VERSION}.sif" /opt/wasp2/scripts/container_smoke_test.sh
 
   publish-pypi:
     name: Publish PyPI
@@ -418,17 +425,19 @@ jobs:
       id-token: write  # Authenticate Singularity provenance attestations.
       attestations: write  # Publish Singularity provenance attestations.
     steps:
-      - uses: eWaterCycle/setup-singularity@931d4e31109e875b13309ae1d07c70ca8fbc8537  # v7
+      - uses: eWaterCycle/setup-apptainer@3f706d898c9db585b1d741b4692e66755f3a1b40
         with:
-          singularity-version: 3.11.4
+          apptainer-version: 1.4.5
+      - name: Verify container runtime
+        run: apptainer --version
       - name: Build from released image
         env:
           RELEASE_VERSION: ${{ needs.validate.outputs.version }}
-        run: singularity build "wasp2_${RELEASE_VERSION}.sif" "docker://${IMAGE_NAME}:${RELEASE_VERSION}"
+        run: apptainer build "wasp2_${RELEASE_VERSION}.sif" "docker://${IMAGE_NAME}:${RELEASE_VERSION}"
       - name: Test Singularity artifact
         env:
           RELEASE_VERSION: ${{ needs.validate.outputs.version }}
-        run: singularity exec "wasp2_${RELEASE_VERSION}.sif" wasp2-count count-cohort --help
+        run: apptainer exec "wasp2_${RELEASE_VERSION}.sif" wasp2-count count-cohort --help
       - uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45  # v2
         with:
           subject-path: "wasp2_${{ needs.validate.outputs.version }}.sif"
@@ -463,7 +472,11 @@ jobs:
           name: singularity-artifact
           path: release-assets
       - name: Generate release checksums
-        run: sha256sum release-assets/* > release-assets/SHA256SUMS
+        run: |
+          cd release-assets
+          find . -maxdepth 1 -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/SHA256SUMS"
+          mv "$RUNNER_TEMP/SHA256SUMS" SHA256SUMS
+          sha256sum --check SHA256SUMS
       - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2
         with:
           files: release-assets/*