This issue is part of a Codex global repository scan.
Problem:
Both Dockerfiles ignore the local build context and run git clone https://github.com/deepmodeling/DeePTB.git, then install whatever branch state GitHub serves at build time.
Code references:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/Dockerfile#L33-L35
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/Dockerfile.main#L34-L36
Impact:
Building this commit can produce an image from different source code, and local changes cannot be tested in Docker. This makes Docker builds non-reproducible for PRs and release commits.
Suggested fix:
Use COPY . /DeePTB and install from the checked-out source, or pin the clone to the intended commit/tag via build args.
This issue is part of a Codex global repository scan.
Problem:
Both Dockerfiles ignore the local build context and run
git clone https://github.com/deepmodeling/DeePTB.git, then install whatever branch state GitHub serves at build time.Code references:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/Dockerfile#L33-L35
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/Dockerfile.main#L34-L36
Impact:
Building this commit can produce an image from different source code, and local changes cannot be tested in Docker. This makes Docker builds non-reproducible for PRs and release commits.
Suggested fix:
Use
COPY . /DeePTBand install from the checked-out source, or pin the clone to the intended commit/tag via build args.