Conversation
- New diann-2.5.0/ Dockerfile (Academia Linux from 2.0 release tag) - DIA-NN 2.5.0 becomes the :latest tag - CI workflow updated with change detection and matrix entry Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR adds DIA-NN version 2.5.0 support by introducing a new Dockerfile with installation steps and updating the CI workflow with corresponding build matrix entries, filtering logic, and environment variables. The prior 2.3.2 version's latest tag assignment is also adjusted. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@diann-2.5.0/Dockerfile`:
- Line 1: Add a non-root user and switch to it in the Dockerfile: create a
dedicated unprivileged user/group (e.g., appuser), ensure /data is created and
owned by that user (chown/chgrp) during image build, then set USER to that
unprivileged account before the WORKDIR /data/ instruction so the container runs
unprivileged; update related RUN commands that create files under /data/ to use
the new user or to perform chown as part of the build.
- Around line 35-37: Remove the insecure wget flag and add checksum
verification: replace the RUN line that downloads and unzips
"DIA-NN-2.5.0-Academia-Linux.zip" so it uses a TLS-verified download (remove
--no-check-certificate or use curl -fsSL), also download the corresponding
checksum file (e.g. "DIA-NN-2.5.0-Academia-Linux.zip.sha256" or ".sha256sum")
from the same GitHub release, verify the archive with sha256sum -c (or echo
"<expected> DIA-NN-2.5.0-Academia-Linux.zip" | sha256sum -c -) and fail the
build if the check fails, then unzip "DIA-NN-2.5.0-Academia-Linux.zip" and
remove both the zip and checksum files; update the RUN block that references
these filenames accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f68d507f-614c-492f-b4c5-19f0a34df95f
📒 Files selected for processing (2)
.github/workflows/quantms-containers.ymldiann-2.5.0/Dockerfile
| @@ -0,0 +1,52 @@ | |||
| FROM ubuntu:22.04 | |||
There was a problem hiding this comment.
Drop root at runtime.
The container currently runs as root. Add a dedicated unprivileged user and switch to it before WORKDIR /data/.
🛡️ Proposed hardening
-WORKDIR /data/
+RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin diann && \
+ mkdir -p /data && \
+ chown -R diann:diann /data
+USER diann
+WORKDIR /data/Also applies to: 50-50
🧰 Tools
🪛 Trivy (0.69.3)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@diann-2.5.0/Dockerfile` at line 1, Add a non-root user and switch to it in
the Dockerfile: create a dedicated unprivileged user/group (e.g., appuser),
ensure /data is created and owned by that user (chown/chgrp) during image build,
then set USER to that unprivileged account before the WORKDIR /data/ instruction
so the container runs unprivileged; update related RUN commands that create
files under /data/ to use the new user or to perform chown as part of the build.
Comment on lines
+35
to
+37
| RUN wget --no-check-certificate https://github.com/vdemichev/DiaNN/releases/download/2.0/DIA-NN-2.5.0-Academia-Linux.zip && \ | ||
| unzip DIA-NN-2.5.0-Academia-Linux.zip -d /usr/ && \ | ||
| rm DIA-NN-2.5.0-Academia-Linux.zip |
There was a problem hiding this comment.
Remove insecure download flag and verify artifact integrity.
Disabling certificate verification here is a release-blocking supply-chain risk. Keep TLS verification enabled and add checksum verification before unzip.
🔒 Proposed fix
+ARG DIANN_URL="https://github.com/vdemichev/DiaNN/releases/download/2.0/DIA-NN-2.5.0-Academia-Linux.zip"
+ARG DIANN_SHA256="<official_sha256_here>"
-RUN wget --no-check-certificate https://github.com/vdemichev/DiaNN/releases/download/2.0/DIA-NN-2.5.0-Academia-Linux.zip && \
- unzip DIA-NN-2.5.0-Academia-Linux.zip -d /usr/ && \
- rm DIA-NN-2.5.0-Academia-Linux.zip
+RUN wget -O /tmp/diann.zip "$DIANN_URL" && \
+ echo "${DIANN_SHA256} /tmp/diann.zip" | sha256sum -c - && \
+ unzip /tmp/diann.zip -d /usr/ && \
+ rm /tmp/diann.zip🧰 Tools
🪛 Checkov (3.2.513)
[high] 35-37: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@diann-2.5.0/Dockerfile` around lines 35 - 37, Remove the insecure wget flag
and add checksum verification: replace the RUN line that downloads and unzips
"DIA-NN-2.5.0-Academia-Linux.zip" so it uses a TLS-verified download (remove
--no-check-certificate or use curl -fsSL), also download the corresponding
checksum file (e.g. "DIA-NN-2.5.0-Academia-Linux.zip.sha256" or ".sha256sum")
from the same GitHub release, verify the archive with sha256sum -c (or echo
"<expected> DIA-NN-2.5.0-Academia-Linux.zip" | sha256sum -c -) and fail the
build if the check fails, then unzip "DIA-NN-2.5.0-Academia-Linux.zip" and
remove both the zip and checksum files; update the RUN block that references
these filenames accordingly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
diann-2.5.0/Dockerfile):latesttag (replaces 2.3.2)DIA-NN 2.5.0 highlights
--rt-model,--fr-model,--im-model,--tokens)--aa-eqflag for amino acid equivalence in reannotation--parentflag to override model directory pathContainer verified locally:
docker buildx build --platform linux/amd64🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Chores