Fix remapping correctness and validate release installation routes

.github/dependabot.yml

@@ -59,3 +59,15 @@ updates:
       - "rust"
     commit-message:
       prefix: "deps(rust)"
+
+  # Keep the tested base-image digests current through normal review.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      containers:
+        patterns: ["*"]
+    labels: ["dependencies", "containers"]
+    commit-message:
+      prefix: "deps(docker)"

.github/workflows/build.yml

@@ -28,7 +28,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -43,12 +43,12 @@ jobs:
             zlib1g-dev \
             libssl-dev \
             pkg-config \
-            libclang-dev
+            libclang-dev samtools bcftools bedtools bwa
 
       - name: Install system dependencies (macOS)
         if: runner.os == 'macOS'
         run: |
-          brew install htslib xz bzip2 openssl@3 pkg-config llvm@19
+          brew install htslib xz bzip2 openssl@3 pkg-config llvm@19 samtools bcftools bedtools bwa
 
       - name: Set macOS library paths
         if: runner.os == 'macOS'
@@ -62,20 +62,20 @@ jobs:
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
 
       - name: Set up sccache
-        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad  # v0.0.9
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
 
       - name: Configure sccache
         run: |
           echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
           echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@7eb50e6e20e1e2009087999ba91242e80253875f  # v7
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Install build tools
         run: uv pip install --system maturin twine
@@ -93,9 +93,11 @@ jobs:
           cd /tmp
           /tmp/wasp2-wheel/bin/python -c "import wasp2_rust; print(wasp2_rust.__file__)"
           /tmp/wasp2-wheel/bin/wasp2-count count-cohort --help
+          export PATH="/tmp/wasp2-wheel/bin:$PATH"
+          bash "$GITHUB_WORKSPACE/scripts/container_smoke_test.sh"
 
       - name: Upload wheel artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: wheel-${{ matrix.os }}
           path: dist/*.whl

.github/workflows/ci.yml

@@ -27,17 +27,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@7eb50e6e20e1e2009087999ba91242e80253875f  # v7
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Install ruff
         run: uv pip install --system ruff
@@ -62,8 +62,11 @@ jobs:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
+        include:
+          - python-version: "3.11"
+            minimum-dependencies: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           # Runtime reference tests read the pinned pre-Rust archive commit.
@@ -82,34 +85,34 @@ jobs:
             libclang-dev \
             samtools \
             bcftools \
-            bedtools
+            bedtools bwa
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Set up Rust toolchain
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
 
       - name: Set up sccache
-        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad  # v0.0.9
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
 
       - name: Configure sccache
         run: |
           echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
           echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
 
       - name: Install uv
-        uses: astral-sh/setup-uv@7eb50e6e20e1e2009087999ba91242e80253875f  # v7
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Create virtualenv and install dependencies
         run: |
           uv venv .venv
           source .venv/bin/activate
           uv pip install maturin
           maturin develop --release
-          uv pip install -e ".[dev]" --no-build-isolation
+          uv pip install -e ".[dev,plink,cyvcf2,export]"
 
       - name: Verify Rust extension loads
         run: |
@@ -128,9 +131,16 @@ jobs:
             --ignore=tests/benchmarks \
             --ignore=tests/sanity
 
+      - name: Check minimum supported scientific dependencies
+        if: matrix.minimum-dependencies == true
+        run: |
+          uv pip install --python .venv/bin/python "numpy==1.26.4" "pandas==1.5.3" "polars==1.0.0" "scipy==1.13.1"
+          source .venv/bin/activate
+          pytest tests/counting tests/analysis tests/test_rust_python_counting_parity.py -q --tb=short
+
       - name: Upload Python test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: pytest-${{ matrix.python-version }}
           path: test-results.xml
@@ -144,7 +154,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -166,7 +176,7 @@ jobs:
           components: clippy
 
       - name: Set up sccache
-        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad  # v0.0.9
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
 
       - name: Configure sccache
         run: |

.github/workflows/codeql.yml

@@ -32,20 +32,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5049b573e2cbf31c2dbde702a60c24fe476f0766  # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           languages: python
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5049b573e2cbf31c2dbde702a60c24fe476f0766  # v4
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5049b573e2cbf31c2dbde702a60c24fe476f0766  # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           category: "/language:python"

.github/workflows/docker.yml

@@ -3,10 +3,10 @@ name: Container CI
 on:
   push:
     branches: [master, dev]
-    paths: ["Dockerfile", "rust/**", "src/**", "pyproject.toml", "scripts/container_smoke_test.sh", ".github/workflows/docker.yml"]
+    paths: ["Dockerfile", ".dockerignore", "tests/shared_data/**", "rust/**", "src/**", "pyproject.toml", "scripts/container_smoke_test.sh", "scripts/check_sbom.py", ".github/workflows/docker.yml"]
   pull_request:
     branches: [master, dev]
-    paths: ["Dockerfile", "rust/**", "src/**", "pyproject.toml", "scripts/container_smoke_test.sh", ".github/workflows/docker.yml"]
+    paths: ["Dockerfile", ".dockerignore", "tests/shared_data/**", "rust/**", "src/**", "pyproject.toml", "scripts/container_smoke_test.sh", "scripts/check_sbom.py", ".github/workflows/docker.yml"]
   workflow_dispatch:
 
 concurrency:
@@ -28,11 +28,11 @@ jobs:
           - {runner: ubuntu-24.04, platform: linux/amd64}
           - {runner: ubuntu-24.04-arm, platform: linux/arm64}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
       - name: Read package version
         id: version
         run: |
@@ -42,7 +42,8 @@ jobs:
               print("value=" + tomllib.load(handle)["package"]["version"])
           PY
       - name: Build local test image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
+        id: build_image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           load: true
@@ -51,9 +52,10 @@ jobs:
           build-args: |
             VERSION=${{ steps.version.outputs.value }}
             REVISION=${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=container-${{ strategy.job-index }}
+          cache-to: type=gha,mode=max,scope=container-${{ strategy.job-index }}
       - name: Smoke-test image
+        id: smoke
         env:
           PLATFORM: ${{ matrix.platform }}
           EXPECTED_VERSION: ${{ steps.version.outputs.value }}
@@ -62,6 +64,68 @@ jobs:
           test "$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.version" }}' wasp2:ci)" = "$EXPECTED_VERSION"
           test "$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' wasp2:ci)" = "$EXPECTED_REVISION"
           docker run --rm --platform "$PLATFORM" -e EXPECTED_WASP2_VERSION="$EXPECTED_VERSION" wasp2:ci /opt/wasp2/scripts/container_smoke_test.sh
+      - name: Build dependency image for scanning
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
+        with:
+          context: .
+          target: rust-builder
+          load: true
+          platforms: ${{ matrix.platform }}
+          tags: wasp2:builder-scan
+          cache-from: type=gha,scope=container-${{ strategy.job-index }}
+      - name: Scan build dependency vulnerabilities
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          image-ref: wasp2:builder-scan
+          version: v0.76.0
+          format: json
+          output: builder-vulnerabilities.json
+          severity: CRITICAL,HIGH
+          exit-code: '1'
+      - name: Preserve build dependency scan
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: builder-scan-${{ strategy.job-index }}
+          path: builder-vulnerabilities.json
+          if-no-files-found: warn
+      # Collect runtime evidence even when the build-image scan fails; both scans remain gates.
+      - name: Inventory runtime image
+        id: inventory
+        if: ${{ !cancelled() && steps.build_image.outcome == 'success' }}
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c  # v0.24.3
+        with:
+          image: wasp2:ci
+          format: cyclonedx-json
+          output-file: container-sbom.cdx.json
+          upload-artifact: false
+      - name: Verify image inventory
+        if: ${{ !cancelled() && steps.inventory.outcome == 'success' }}
+        run: python3 scripts/check_sbom.py container-sbom.cdx.json wasp2 numpy scipy samtools bcftools bedtools
+      - if: ${{ !cancelled() && steps.inventory.outcome == 'success' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: container-sbom-${{ strategy.job-index }}
+          path: container-sbom.cdx.json
+          if-no-files-found: error
+      - name: Scan runtime image vulnerabilities
+        id: runtime_scan
+        if: ${{ !cancelled() && steps.build_image.outcome == 'success' }}
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          image-ref: wasp2:ci
+          format: json
+          output: container-vulnerabilities.json
+          version: v0.76.0
+          severity: CRITICAL,HIGH
+          exit-code: '1'
+      - name: Preserve container scan
+        if: ${{ !cancelled() && steps.runtime_scan.outcome != 'skipped' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: container-scan-${{ strategy.job-index }}
+          path: container-vulnerabilities.json
+          if-no-files-found: error
 
   required:
     name: Required / Container