blast-jobs: BLAST job service for the MCP's BLAST tools

.github/workflows/blast-jobs.yml

@@ -0,0 +1,48 @@
+# The blast-jobs jobs that download BLAST+ from NCBI. They live apart from ci.yml so a native path filter
+# keeps a slow NCBI from reddening unrelated changes (design 3.12). The fast unit job stays in ci.yml.
+name: blast-jobs
+on:
+  push:
+    branches: [master]
+    paths: ['blast-jobs/**', '.github/workflows/blast-jobs.yml']
+  pull_request:
+    paths: ['blast-jobs/**', '.github/workflows/blast-jobs.yml']
+permissions:
+  contents: read
+jobs:
+  blast-jobs-integration:
+    runs-on: ubuntu-latest
+    defaults: { run: { working-directory: blast-jobs } }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with: { workspaces: blast-jobs }
+      # The tarball URL and SHA-256 are pinned once, in the Dockerfile.
+      - id: pin
+        run: |
+          echo "url=$(sed -n 's/^ARG BLAST_URL=//p' Dockerfile)" >> "$GITHUB_OUTPUT"
+          echo "sha=$(sed -n 's/^ARG BLAST_SHA256=//p' Dockerfile)" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v4
+        id: blast-cache
+        with:
+          path: ~/ncbi-blast.tar.gz
+          key: ncbi-blast-${{ steps.pin.outputs.sha }}
+      - if: steps.blast-cache.outputs.cache-hit != 'true'
+        env: { BLAST_URL: "${{ steps.pin.outputs.url }}" }
+        run: curl -fsSL --retry 3 -o ~/ncbi-blast.tar.gz "$BLAST_URL"
+      - env: { BLAST_SHA256: "${{ steps.pin.outputs.sha }}" }
+        run: |
+          test -n "$BLAST_SHA256"
+          echo "$BLAST_SHA256  $HOME/ncbi-blast.tar.gz" | sha256sum -c -
+          mkdir -p ~/ncbi-blast && tar -xzf ~/ncbi-blast.tar.gz -C ~/ncbi-blast --strip-components 1
+          ~/ncbi-blast/bin/blastn -version | grep -F '2.17.0+'
+      - run: BLAST_JOBS_REAL_BLAST="$HOME/ncbi-blast/bin" cargo test --test real_blast
+  blast-jobs-image:
+    runs-on: ubuntu-latest
+    defaults: { run: { working-directory: blast-jobs } }
+    steps:
+      - uses: actions/checkout@v4
+      - run: docker build -t blast-jobs:ci .
+      - run: docker image ls blast-jobs:ci
+      - run: tests/image-smoke.sh blast-jobs:ci

.github/workflows/ci.yml

@@ -1,5 +1,7 @@
 name: ci
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   lint-and-unit:
     runs-on: ubuntu-latest
@@ -37,3 +39,19 @@ jobs:
       - run: cd mcp && cargo test --tests
         env:
           CHADO_URL: postgres://flybase_mcp:[email protected]:5499/flybase
+  blast-jobs-unit:
+    runs-on: ubuntu-latest
+    defaults: { run: { working-directory: blast-jobs } }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with: { components: "clippy, rustfmt" }
+      - uses: Swatinem/rust-cache@v2
+        with: { workspaces: blast-jobs }
+      - run: cargo fmt --check
+      - run: cargo clippy --all-targets -- -D warnings
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          manifest-path: blast-jobs/Cargo.toml
+          command: check advisories licenses
+      - run: cargo test

README.md

@@ -4,6 +4,7 @@ Tools for using FlyBase data from AI assistants.
 
 - `mcp/`: the hosted FlyBase MCP server (Rust). Endpoint: `https://mcp.flybase.org/mcp`.
 - `plugins/flybase/`: a Claude Code plugin that registers the MCP server. Skills will live here later.
+- `blast-jobs/`: the BLAST job service behind the MCP's BLAST tools (Rust, NCBI BLAST+ 2.17.0).
 
 The server's tools and their arguments are listed in [docs/tools.md](docs/tools.md).
 
@@ -19,6 +20,14 @@ features in a range, cytology, release 5 to 6 coordinates), controlled vocabular
 gene groups, disease models, stocks, interactions), RNA-seq expression, and BLAST. Each is described in
 [docs/tools.md](docs/tools.md).
 
+## BLAST
+
+The MCP's BLAST tools are clients of a private job API. `blast-jobs/` implements it. The service is a
+small Rust process that runs NCBI BLAST+ 2.17.0 against a directory of BLAST databases described by a
+catalogue file, in its own container with the databases mounted read-only. Nothing in it is specific to
+FlyBase, so anyone with BLAST databases and a catalogue can run it. Configuration, the image and the run
+shape are in [docs/blast-jobs.md](docs/blast-jobs.md).
+
 ## Develop
 
 See `docs/deployment.md` for running the server and `mcp/README.md` for the crate.

blast-jobs/.dockerignore

@@ -0,0 +1,9 @@
+target
+tests
+fixture
+deploy
+bench
+rust-toolchain.toml
+README.md
+Dockerfile
+.dockerignore

blast-jobs/.gitignore

@@ -0,0 +1 @@
+target/