🧑‍🔬 🐍 Add SciPy packages to base 3.12 environment (#35)

Signed-off-by: Jacob Woffenden <[email protected]>

.github/workflows/scan.yml

@@ -19,6 +19,30 @@ jobs:
         id: checkout
         uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
+      - name: Free Disk Space
+        id: free_disk_space
+        shell: bash
+        run: |
+          df -h /
+          echo "Pruning cached tools"
+          # https://github.com/actions/runner-images/issues/2840#issuecomment-2272410832
+          sudo rm -rf \
+            /opt/hostedtoolcache \
+            /opt/google/chrome \
+            /opt/microsoft/msedge \
+            /opt/microsoft/powershell \
+            /opt/pipx \
+            /usr/lib/mono \
+            /usr/local/julia* \
+            /usr/local/lib/android \
+            /usr/local/lib/node_modules \
+            /usr/local/share/chromium \
+            /usr/local/share/powershell \
+            /usr/share/dotnet \
+            /usr/share/swift
+          echo "Disk space after cleanup..."
+          df -h /
+
       - name: Build
         id: build
         shell: bash
@@ -34,6 +58,7 @@ jobs:
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
+          TRIVY_TIMEOUT: 15m
         with:
           image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
           severity: HIGH,CRITICAL

.trivyignore

@@ -5,6 +5,9 @@ CVE-2024-43882
 ## setuptools
 CVE-2024-6345 # TODO: @jacobwoffenden - Figure out where this comes from and patch it
 
+## imagecodecs
+GHSA-94vc-p8w7-5p49
+
 # .NET
 ## We are running the latest dotnet-sdk from Ubuntu
 CVE-2024-0057

Dockerfile

@@ -12,9 +12,17 @@ SHELL ["/bin/bash", "-e", "-u", "-o", "pipefail", "-c"]
 COPY --chown="${CONTAINER_USER}:${CONTAINER_GROUP}" --chmod=0644 src${ANALYTICAL_PLATFORM_DIRECTORY}/first-run-notice.txt ${ANALYTICAL_PLATFORM_DIRECTORY}/first-run-notice.txt
 
 # JupyterLab
-COPY --chown="${CONTAINER_USER}:${CONTAINER_GROUP}" --chmod=0644 src${ANALYTICAL_PLATFORM_DIRECTORY}/requirements.txt ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements.txt
+COPY --chown="${CONTAINER_USER}:${CONTAINER_GROUP}" --chmod=0644 src${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-jupyterlab.txt ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-jupyterlab.txt
 RUN <<EOF
-pip install --no-cache-dir --requirement ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements.txt
+pip install --no-cache-dir --requirement ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-jupyterlab.txt
+EOF
+
+# Base + SciPy
+# Base is used by users when installing with different versions of Python
+COPY --chown="${CONTAINER_USER}:${CONTAINER_GROUP}" --chmod=0644 src${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-base.txt ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-base.txt
+COPY --chown="${CONTAINER_USER}:${CONTAINER_GROUP}" --chmod=0644 src${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-scipy.txt ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-scipy.txt
+RUN <<EOF
+conda install --yes --file ${ANALYTICAL_PLATFORM_DIRECTORY}/requirements-scipy.txt
 EOF
 
 USER ${CONTAINER_USER}

src/opt/analytical-platform/requirements-base.txt

@@ -0,0 +1 @@
+ipykernel

src/opt/analytical-platform/requirements-scipy.txt

@@ -0,0 +1,31 @@
+# Taken from https://github.com/jupyter/docker-stacks/blob/main/images/scipy-notebook/Dockerfile#L29
+
+altair
+beautifulsoup4
+bokeh
+bottleneck
+cloudpickle
+conda-forge::blas=*=openblas
+cython
+dask
+dill
+h5py
+ipympl
+ipywidgets
+matplotlib-base
+numba
+numexpr
+openpyxl
+pandas
+patsy
+protobuf
+pytables
+scikit-image
+scikit-learn
+scipy
+seaborn
+sqlalchemy
+statsmodels
+sympy
+widgetsnbextension
+xlrd