pin quay.io/broadinstitute/qiime2 to specific build hash

pin quay.io/broadinstitute/qiime2 to specific build hash; extend module checking scripts to allow for image pinning by hash

github_actions_ci/check-wdl-runtimes.sh

@@ -4,13 +4,18 @@
 
 echo "Checking wdl container versions against ${MODULE_VERSIONS}"
 
+
 # this is the newer script that simply validates existing version strings
 should_error=false
 for task_file in $(ls -1 pipes/WDL/tasks/*.wdl); do
  echo "Checking ${task_file}"
  while IFS='=' read module version; do
  OLD_TAG=$module
- NEW_TAG="$module:$version"
+ if ! grep -q "sha256" <<< "$version"; then
+ NEW_TAG="$module:$version"
+ else
+ NEW_TAG="$module@$version"
+ fi
 
  offending_lines="$(grep -nE "^[^#]*$OLD_TAG" "${task_file}" | grep -v $NEW_TAG)"
 

github_actions_ci/version-wdl-runtimes.sh

@@ -7,7 +7,18 @@
 
 while IFS='=' read module version; do
  OLD_TAG=$module
- NEW_TAG="$module:$version"
- echo Replacing $OLD_TAG with $NEW_TAG in all task WDL files
- sed -i "s|$OLD_TAG[^\"\']*|$NEW_TAG|g" pipes/WDL/tasks/*.wdl
+ if ! grep -q "sha256" <<< "$version"; then
+ echo "$module is specified using image tag"
+
+ NEW_TAG="$module:$version"
+ echo Replacing $OLD_TAG with $NEW_TAG in all task WDL files
+ sed -i "s|$OLD_TAG[^\"\']*|$NEW_TAG|g" pipes/WDL/tasks/*.wdl
+ else
+ echo "$module is specified using image build hash"
+
+ NEW_TAG="$module@$version"
+ echo Replacing $OLD_TAG with $NEW_TAG in all task WDL files
+ sed -i "s|$OLD_TAG[^\"\']*|$NEW_TAG|g" pipes/WDL/tasks/*.wdl
+ fi
+
 done < $MODULE_VERSIONS

pipes/WDL/tasks/tasks_16S_amplicon.wdl

@@ -9,7 +9,7 @@ task qiime_import_from_bam {
  Int memory_mb = 7000
  Int cpu = 5
  Int disk_size_gb = ceil(2*20) + 5
- String docker = "quay.io/broadinstitute/qiime2:latest" 
+ String docker = "quay.io/broadinstitute/qiime2@sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b" 
  }
  parameter_meta {
  reads_bam: {description: "Unaligned reads in BAM format, one sample per BAM file."}
@@ -77,7 +77,7 @@ task trim_reads {
  Int memory_mb = 2000
  Int cpu = 4
  Int disk_size_gb = ceil(2*size(reads_qza, "GiB")) + 5
- String docker = "quay.io/broadinstitute/qiime2:latest"
+ String docker = "quay.io/broadinstitute/qiime2@sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b"
  }
 
  command <<<
@@ -122,7 +122,7 @@ task join_paired_ends {
  Int memory_mb = 2000
  Int cpu = 1
  Int disk_size_gb = ceil(2*size(trimmed_reads_qza, "GiB")) + 50
- String docker = "quay.io/broadinstitute/qiime2:latest"
+ String docker = "quay.io/broadinstitute/qiime2@sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b"
  }
 
  command <<< 
@@ -159,7 +159,7 @@ task deblur {
  Int memory_mb = 2000
  Int cpu = 1
  Int disk_size_gb = ceil(2*size(joined_end_reads_qza, "GiB")) + 5
- String docker = "quay.io/broadinstitute/qiime2:latest"
+ String docker = "quay.io/broadinstitute/qiime2@sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b"
  }
  command <<< 
  set -ex
@@ -211,7 +211,7 @@ task train_classifier {
  Int memory_mb = 2000
  Int cpu = 1
  Int disk_size_gb = ceil(2*size(otu_ref, "GiB")) + 5
- String docker = "quay.io/broadinstitute/qiime2:latest"
+ String docker = "quay.io/broadinstitute/qiime2@sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b"
  }
  command <<<
  set -ex
@@ -264,7 +264,7 @@ task tax_analysis {
  Int memory_mb = 5
  Int cpu = 1
  Int disk_size_gb = 375
- String docker = "quay.io/broadinstitute/qiime2:latest"
+ String docker = "quay.io/broadinstitute/qiime2@sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b"
  }
  command <<<
  set -ex

requirements-modules.txt

@@ -9,4 +9,4 @@ nextstrain/base=build-20211012T204409Z
 andersenlabapps/ivar=1.3.1
 quay.io/staphb/pangolin=4.2-pdata-1.18.1.1
 nextstrain/nextclade=2.12.0
-quay.io/broadinstitute/qiime2=latest
+quay.io/broadinstitute/qiime2=sha256:b1b8824516dc8b2d829cf562d4525d87f0ba5aec0a08a4c63d640eff5f91978b