Skip to content

[Code scan] Make Docker builds use the checked-out source instead of cloning mutable upstream #360

Description

@njzjz

This issue is part of a Codex global repository scan.

Problem:
Both Dockerfiles ignore the local build context and run git clone https://github.com/deepmodeling/DeePTB.git, then install whatever branch state GitHub serves at build time.

Code references:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/Dockerfile#L33-L35
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/Dockerfile.main#L34-L36

Impact:
Building this commit can produce an image from different source code, and local changes cannot be tested in Docker. This makes Docker builds non-reproducible for PRs and release commits.

Suggested fix:
Use COPY . /DeePTB and install from the checked-out source, or pin the clone to the intended commit/tag via build args.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions