Merge pull request #34 from alliander-opensource/fix-vuln

Fix vulnerabilities.

Author: mesarcik

.github/workflows/ci.yml

@@ -1,9 +1,6 @@
 name: continuous-integration-checks
 
 on:
-  push:
-    branches:    
-      - '*' 
   pull_request:
     branches:
       - main
@@ -12,25 +9,25 @@ on:
 
 jobs:
   python-checks:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.12"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
+      # uv installs via its standalone script (not a GitHub Action, so exempt
+      # from the enterprise SHA-pinning policy) and provisions Python itself,
+      # avoiding an extra pinned action such as actions/setup-python.
+      - name: Install uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
 
       - name: Install Dependencies
         run: |
-          python -m pip install --upgrade pip build wheel setuptools
-          python -m pip install uv
-          uv venv
+          uv python install ${{ matrix.python-version }}
           uv sync
 
       - name: Check

notebooks/01_train_model.ipynb

@@ -215,13 +215,22 @@
    "outputs": [],
    "source": [
     "from torch.utils.data import DataLoader\n",
+    "\n",
     "from s4casting.data.utils import collate_single_interval\n",
     "\n",
     "N = len(batcher.train)\n",
     "print(f\"The training dataset has {N} samples\")\n",
     "first, _ = next(\n",
     "    iter(\n",
-    "        DataLoader(batcher.train, batch_size=1, num_workers=0, shuffle=True, pin_memory=False, persistent_workers=False, collate_fn=collate_single_interval)\n",
+    "        DataLoader(\n",
+    "            batcher.train,\n",
+    "            batch_size=1,\n",
+    "            num_workers=0,\n",
+    "            shuffle=True,\n",
+    "            pin_memory=False,\n",
+    "            persistent_workers=False,\n",
+    "            collate_fn=collate_single_interval,\n",
+    "        )\n",
     "    )\n",
     ")\n",
     "X, Xm, Y, Ym = (t for t in first)\n",
@@ -284,7 +293,9 @@
     "import numpy as np\n",
     "\n",
     "predict_width_samples = (config.model.predict_width * 24 * 60) // config.model.base_sample_interval_minutes\n",
-    "input_width_samples = ((config.model.context_window[0] * 24 * 60) // config.model.base_sample_interval_minutes) - predict_width_samples\n",
+    "input_width_samples = (\n",
+    "    (config.model.context_window[0] * 24 * 60) // config.model.base_sample_interval_minutes\n",
+    ") - predict_width_samples\n",
     "days_per_sample = config.model.context_window[0]\n",
     "samples_per_day = 96  # 24 hours x 4 samples/hour\n",
     "\n",
@@ -369,13 +380,11 @@
     "    Xm = Xm.to(context.machine.torch_device).float()\n",
     "    Ym = Ym.to(context.machine.torch_device).float()\n",
     "\n",
-    "    input_interval  = batch_cfg.sample_interval_minutes.to(context.machine.torch_device)\n",
+    "    input_interval = batch_cfg.sample_interval_minutes.to(context.machine.torch_device)\n",
     "    output_interval = select_rate(input_interval, config.model.output_sample_intervals_minutes)\n",
     "\n",
     "    # input data to model\n",
-    "    _, loss = context.model_container.model(\n",
-    "        X, Xm, input_interval, output_interval, Y, Ym\n",
-    "    )\n",
+    "    _, loss = context.model_container.model(X, Xm, input_interval, output_interval, Y, Ym)\n",
     "    loss.backward()\n",
     "    total_loss += loss.item()\n",
     "\n",

notebooks/04_train_with_weather_time_location.ipynb

@@ -356,6 +356,7 @@
     "# Extract locations from Croissant measurements (data/LianderPower/measurements.parquet)\n",
     "# Snap lat/lon to a GRID (0.25°) and build `sampled_coordinates` used for sampling weather points\n",
     "from pathlib import Path\n",
+    "\n",
     "import numpy as np\n",
     "import pandas as pd\n",
     "\n",
@@ -365,6 +366,7 @@
     "\n",
     "# Load measurements using the Croissant adapter; this returns a NumpyData with a `locations` dict\n",
     "from s4casting.data.dataset.croissant_adapter import load_measurements_from_croissant\n",
+    "\n",
     "ndata = load_measurements_from_croissant(release_dir, to_memory=False)\n",
     "locs = ndata.locations\n",
     "\n",
@@ -391,10 +393,11 @@
     "# merged original ids, optional human-readable names, mean coordinate, and count.\n",
     "df = pd.DataFrame(rows)\n",
     "sampled_coordinates = (\n",
-    "    df.groupby([\"snapped_lat\", \"snapped_lon\"]) \n",
+    "    df\n",
+    "    .groupby([\"snapped_lat\", \"snapped_lon\"])\n",
     "    .agg(\n",
-    "        merged_ids=(\"id\", lambda x: list(x)),\n",
-    "        names=(\"name\", lambda x: [n for n in dict.fromkeys([n for n in x if n])]),\n",
+    "        merged_ids=(\"id\", list),\n",
+    "        names=(\"name\", lambda x: list(dict.fromkeys([n for n in x if n]))),\n",
     "        lat_mean=(\"lat\", \"mean\"),\n",
     "        lon_mean=(\"lon\", \"mean\"),\n",
     "        count=(\"id\", \"size\"),\n",
@@ -416,10 +419,7 @@
     "# Create interactive map showing sampled coordinates (snapped grid) and measurement points\n",
     "# This cell expects `sampled_coordinates` to exist in the notebook (produced above).\n",
     "from pathlib import Path\n",
-    "import base64\n",
-    "from IPython.display import HTML\n",
-    "import folium\n",
-    "from folium.plugins import FastMarkerCluster\n",
+    "\n",
     "import pandas as pd\n",
     "\n",
     "from s4casting.data.dataset.croissant_adapter import load_measurements_from_croissant\n",
@@ -468,7 +468,7 @@
     "    height=\"600\"\n",
     "    style=\"border: none;\"\n",
     "></iframe>\n",
-    "\"\"\")\n"
+    "\"\"\")"
    ]
   },
   {