refactor(tooling): consolidate build and verification workflows

[mldangelo-oai]

ModelAudit repeats build steps, Docker Rust installation, workflow test accessors, and QA report generation. Share those implementations while preserving workflow jobs and permissions, verified Rust downloads, command ordering, report contents, and package boundaries.

This is PR 1 of the six-part simplification series. It changes tooling and its contract tests only; scan runtime behavior is unchanged. Net reduction: 403 maintained physical lines (386 tooling, 17 tests), including the new installer/helper and assertion-rewrite registration. Generated files and dependency versions are unchanged by this PR.

Validation:

• 257 workflow, Docker-contract, nightly-prerequisite, benchmark, and local corpus tests passed against this checkout.
• Ruff formatting/lint, Prettier, shell syntax, and all three Dockerfile BuildKit checks passed. Compose configuration matched the original byte for byte.
• Original/candidate probes matched 13 entrypoint cases, six protobuf compile fixtures, 66 EditorConfig mappings, and 36 Rust-installer architecture/failure cases. A deliberate failing assertion confirmed shared workflow helpers retain pytest diagnostics.
• Both wheels built offline and matched checkout sources. Isolated standalone scans and installed-root CLI clean/finding/error smoke tests passed.
• Local mypy 2.3.1 reports the existing unreachable TensorFlow import in tests/scanners/test_weight_distribution_scanner.py; the upstream-required mypy 2.4 environment could not be installed from this devbox's package index. The upstream pin and CI command are preserved.

Full Docker image builds and the hosted platform matrix are left to CI; local BuildKit checks do not claim those builds ran. No merge is requested as part of preparing this series.

Review order: 1: tooling → 2: tests → 3: raw evidence → 4: picklescan → 5: scanning/results → 6: acquisition/cache/progress. Each PR targets the previous branch; PR1 targets main.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T06:46:27.983094Z	3948e2b	Manual request
🔒 Security Review	✅ Completed 2026-10-03T06:47:59.129817Z	3948e2b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 13 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 13 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 4.364s -> 4.342s (-0.5%).

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	355.4us	338.8us	-4.7%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	306.1us	294.4us	-3.8%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	321.9us	312.7us	-2.8%	stable
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	225.3us	219.3us	-2.7%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	277.9us	271.3us	-2.4%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	115.72ms	113.49ms	-1.9%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	127.23ms	125.81ms	-1.1%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	111.00ms	110.31ms	-0.6%	stable
rejected-basic-auth-candidates	tests/benchmarks/test_scan_benchmarks.py::test_rejected_basic_auth_candidates_scan_linearly	-	371.1 KiB	1	2.505s	2.490s	-0.6%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	582.77ms	579.72ms	-0.5%	stable
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	106.14ms	105.83ms	-0.3%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	658.80ms	659.50ms	+0.1%	stable
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	156.06ms	155.91ms	-0.1%	stable

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.53%. Comparing base (2e78519) to head (3948e2b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1868   +/-   ##
=======================================
  Coverage   76.53%   76.53%           
=======================================
  Files         218      218           
  Lines      119936   119936           
  Branches    28392    28392           
=======================================
+ Hits        91790    91791    +1     
  Misses      20452    20452           
+ Partials     7694     7693    -1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 3948e2b920

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot review overview

🔵 Needs a closer look

Broad release, CI, and Docker workflow changes still depend on hosted matrix and full-image validation.

Review effort: Balanced
Findings: None

What changed in this PR

Consolidates duplicated CI, release, Docker, and QA tooling while preserving existing contracts and runtime behavior.

Changes:

• Reuses workflow steps and test accessors through shared helpers and YAML anchors.
• Centralizes Docker Rust installation and QA report generation.
• Simplifies equivalent scripts and configuration.

File	Description
tests/​test_release_workflow.py	Uses shared workflow helpers and validates package-specific PyPI settings.
tests/​test_perf_workflow.py	Uses shared workflow accessors.
tests/​test_docker_workflow.py	Tests the shared Rust installer contract.
tests/​helpers/​workflows.py	Adds shared workflow test accessors.
tests/​__init__.py	Enables assertion rewriting for test helpers.
scripts/​large_pickle_corpus_qa.py	Consolidates QA output generation and removes trivial wrappers.
scripts/​compile_tensorflow_protos.sh	Combines equivalent protobuf compilation loops.
scripts/​benchmark_report.py	Inlines percentage formatting.
pyproject.toml	Removes an obsolete mypy override.
Dockerfile.tensorflow	Uses the shared Rust installer.
Dockerfile.full	Uses the shared Rust installer.
Dockerfile	Uses the shared Rust installer.
docker-install-rust.sh	Provides verified, architecture-aware Rust installation.
docker-entrypoint.sh	Simplifies equivalent ModelAudit routing.
docker-compose.yml	Shares the model volume configuration.
.github/​workflows/​test.yml	Reuses common CI steps and paths.
.github/​workflows/​release-please.yml	Consolidates release steps, permissions, and PyPI verification.
.github/​workflows/​perf.yml	Shares benchmark trigger paths.
.github/​workflows/​nightly.yml	Reuses common setup steps.
.github/​workflows/​docker-publish.yml	Shares validation outputs, permissions, and checkout configuration.
.github/​workflows/​docker-image-test.yml	Shares Docker setup and tracks the installer.
.github/​workflows/​codeql.yml	Shares main-branch trigger configuration.
.editorconfig	Consolidates common file settings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 3948e2b920

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.