docker: smoke-test the example pipeline in read-only mode

.github/workflows/deploy-image.yml

@@ -63,10 +63,13 @@ jobs:
           docker run --rm "$IMAGE" weightwatcher --version
           docker run --rm "$IMAGE" psfex --version
 
-      - name: Test runtime — shapepipe entry point
+      - name: Test runtime — shapepipe entry point (read-only fs)
         run: |
           IMAGE=$(echo "${{ steps.meta-runtime.outputs.tags }}" | head -n1)
-          docker run --rm "$IMAGE" shapepipe_run -c /app/example/config.ini
+          # --read-only + tmpfs /tmp emulates apptainer/SIF semantics: only
+          # /tmp is writable. shapepipe_run_example wraps shapepipe_run so
+          # the example tree gets copied into a mktemp workdir before running.
+          docker run --rm --read-only --tmpfs /tmp:rw "$IMAGE" shapepipe_run_example
 
       # Build dev (reuses cached `base` layer)
       - name: Build dev (load)

.gitignore

@@ -130,7 +130,7 @@ dmypy.json
 # Pyre type checker
 .pyre/
 
-# Ignore example output
-*shapepipe_run_*
-*shapepipe_runs*
+# Ignore example output (generated under example/output/ by shapepipe_run)
+example/output/shapepipe_run_*
+example/output/shapepipe_runs*
 code

scripts/sh/shapepipe_run_example.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Run the bundled example pipeline against a writable copy of /app/example.
+#
+# Works under both docker (writable /app) and apptainer/SIF (read-only /app):
+# the example tree is copied into a fresh tmp workdir so the config's
+# relative paths (INPUT_DIR=./example/data/..., OUTPUT_DIR=./example/output)
+# resolve to writable locations.
+#
+# Extra args are forwarded to shapepipe_run, e.g.:
+#   shapepipe_run_example -v
+set -euo pipefail
+
+WORK="$(mktemp -d -t shapepipe-example-XXXXXX)"
+cp -r /app/example "$WORK/"
+cd "$WORK"
+exec shapepipe_run -c example/config.ini "$@"