Skip to content

Fix audit findings in the deprecated paths, mocks, CI, and README - #65

Open
rly wants to merge 1 commit into
mainfrom
fix-audit-findings
Open

Fix audit findings in the deprecated paths, mocks, CI, and README#65
rly wants to merge 1 commit into
mainfrom
fix-audit-findings

Conversation

@rly

@rly rly commented Aug 18, 2026

Copy link
Copy Markdown
Owner

Motivation

A repo-wide Claude Code audit turned up a broken deprecated code path, three CI/test defects, and a set of documentation and packaging errors. This fixes the ones that affect correctness or are cheap and unambiguous.

Correctness

PoseEstimation built from the deprecated nodes and edges arguments could not be written. The Skeleton constructed from them is reachable only from that PoseEstimation object, so the link has no target in the NWBFile and io.write() fails with OrphanContainerBuildError. The constructor now raises with an explanation of what to build instead. Construct mode is unchanged, so files written before ndx-pose 0.2.0, which store nodes and edges on the PoseEstimation group, still read as before.

Making the old path work would require a schema change (a Skeleton child inside PoseEstimation, which the spec does not allow and which conflicts with keeping skeletons in a Skeletons container), so this converts a confusing failure at write time into an actionable one at construction. It is listed under Breaking changes in the CHANGELOG.

An empty devices list no longer raises a DeprecationWarning. An empty list carries no device, so it is not a use of the deprecated behavior.

Tests and CI

  • test_example_usage.py runs the examples with sys.executable rather than whatever python resolves to on PATH, from the repository root rather than the working directory, and removes the NWB file even when an example fails. The tests now pass when pytest is invoked from an unrelated directory, which they did not before.
  • The Windows wheel installation step sources the venv activation script. Running activate.bat under bash leaves the venv inactive, so the step was installing into and importing from the outer environment, where ndx-pose was already present, and passed unconditionally.
  • Checkout no longer fetches full history for tags. The version comes from pyproject.toml; there is no VCS-based versioning.

Fixtures

The default pose_estimation_series of mock_PoseEstimation hold (x, y) positions in pixel space, matching the single camera view a PoseEstimation object represents. They previously held (x, y, z) data labelled pixels. The per-camera views in the MultiCameraPoseEstimation roundtrip test are updated for the same reason.

Packaging and docs

  • license is the SPDX expression BSD-3-Clause (PEP 639), with LICENSE.txt in license-files. Verified in the built wheel: License-Expression: BSD-3-Clause, License-File: LICENSE.txt, and the file is bundled under dist-info/licenses/.
  • .gitignore negates *.nwb for src/pynwb/tests/back_compat/. Those fixtures are tracked, so a new one would otherwise need git add -f.
  • PoseEstimation's class docstring describes the single camera view scoping, matching the schema and README.
  • README: the mermaid init directive in both diagrams had a mismatched quote ("primaryBorderColor') that made it invalid; PoseTraining had a stray third angle bracket; MultiCameraPoseEstimation used source_software_version where PoseEstimation used the dataset__attribute form; SkeletonInstance pointed at Skeleton with the containment arrow despite being a link; and the labeled_video link had no relationship line.

Testing

  • pytest src/pynwb/tests: 60 passed, 309 subtests passed
  • ruff check src/ examples/: passes
  • Confirmed by hand that new construction with nodes/edges raises and that 0.1.1_poseestimation_nodes_edges.nwb still reads back its skeleton nodes with no unexpected warnings.

Not included

The audit also flagged items left alone here: the nodes/edges entries in __nwbfields__ being inert, the setters raising ValueError rather than AttributeError, black and ruff both being configured with neither enforced in CI, pre-commit in the dev group with no config, the stale src/matnwb sdist exclusion, the empty [tool.pytest.ini_options], and the unedited ndx-template placeholders in docs/source/.

🤖 Generated with Claude Code

PoseEstimation built from the deprecated `nodes` and `edges` arguments
holds a Skeleton that is reachable only from that object, so the link has
no target in the NWBFile and the object fails to write with an
OrphanContainerBuildError. Raise at construction with an explanation
instead. Files written before ndx-pose 0.2.0 store nodes and edges on the
PoseEstimation group, so construct mode keeps building the Skeleton and
those files read as before.

An empty `devices` list carries no device, so it no longer raises a
DeprecationWarning.

The default pose_estimation_series of mock_PoseEstimation hold (x, y)
positions in pixel space, matching the single camera view a PoseEstimation
object represents. The per-camera views in the MultiCameraPoseEstimation
roundtrip test hold pixel-space positions for the same reason.

The example usage tests run the examples with sys.executable rather than
whatever `python` resolves to on PATH, from the repository root rather than
the working directory, and remove the NWB file even when an example fails.

The Windows wheel installation test sources the venv activation script.
Running `activate.bat` under bash leaves the venv inactive, so the step
installed into and imported from the outer environment.

The version comes from pyproject.toml, so checkout no longer fetches the
full history for tags.

`*.nwb` in .gitignore is negated for the back-compat test fixtures, which
are tracked and would otherwise need `git add -f`.

`license` is the SPDX expression BSD-3-Clause (PEP 639) with LICENSE.txt in
`license-files`.

README: repair the mismatched quote in the mermaid init directive of both
diagrams, the stray angle bracket on PoseTraining, the version attribute
name on MultiCameraPoseEstimation, the SkeletonInstance-to-Skeleton arrow,
and the missing labeled_video relationship.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant