You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[Code scan] Make Docker builds use the checked-out source instead of cloning mutable upstream #360
This issue is part of a Codex global repository scan.
Problem:
Both Dockerfiles ignore the local build context and run git clone https://github.com/deepmodeling/DeePTB.git, then install whatever branch state GitHub serves at build time.
Impact:
Building this commit can produce an image from different source code, and local changes cannot be tested in Docker. This makes Docker builds non-reproducible for PRs and release commits.
Suggested fix:
Use COPY . /DeePTB and install from the checked-out source, or pin the clone to the intended commit/tag via build args.
Activity