Siddhant Medar 4836e36f65 harden pipeline per PR review: locked lockfile, token permissions, image comment
1. Replace 'uv sync --frozen' with 'uv sync --locked'. --frozen silently
   uses a stale lockfile if pyproject.toml is updated without regenerating
   uv.lock, masking missed dependencies. --locked fails loudly with a clear
   error when the lockfile is out of sync. Verified empirically with uv
   0.9.14: --frozen exits 0 on mismatch, --locked exits 1.

2. Add 'chmod 600' on the OIDC token file after writing it. The container
   is already single-user root so this is defensive/cosmetic, but it
   silences security scanners and signals intent.

3. Add a comment explaining why gate steps use atlassian/default-image:4
   instead of python:3.12.7 (gates run bash only, no Python toolchain
   needed — lighter image, faster pull).

Explicitly rejected from the PR review:
- Token-masking sed mitigation (delimiter collision with / in real
  Bitbucket clone tokens; cmd | sed || exit 1 swallows git failures
  without set -o pipefail). Bitbucket's built-in Secured variable
  masking is the correct mitigation and is already documented as a
  setup requirement.
- SSH key alternative for git clone (architecturally worse — more
  secrets to manage; HTTPS+Secured is the Bitbucket-recommended pattern).
- cd/python refactor ('fragile logic bug'). Verified empirically that
  'cd X && python Y || echo Z' with set -e correctly catches both
  cd and python failures via the ||. The step exits 0 as intended
  by the 'advisory, not a gate' design. The suggested refactor would
  introduce a hard-fail regression.
2026-04-15 09:01:35 -05:00

Field Extraction Pipeline

Contract field extraction using LLMs.

Setup

Install uv (if not already installed)

# Ubuntu/WSL (recommended)
curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc  # or restart terminal

# macOS
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell - native, not WSL)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Verify installation: uv --version

Install dependencies

uv sync

Running the Code

Use uv run with Python's module flag from the project root:

# Run the default SaaS pipeline
uv run python -m src.pipelines.saas.main

# Run with unified runner (supports client selection)
uv run python -m src.pipelines.runner --client saas --input-dir /path/to/input

# Run with specific client
uv run python -m src.pipelines.runner --client clover --input-dir /path/to/input

Note: Always use uv run to ensure correct virtual environment. Always use -m flag for proper imports.

Development

Before pushing, always run these checks to avoid breaking the CI pipeline:

# Format code
uv run black src/

# Type checking
uv run mypy src/

# Run tests
uv run pytest

All checks must pass before merging to main.

Project Structure

├── src/
│   ├── pipelines/              # Pipeline implementations
│   │   ├── runner.py           # Unified CLI entry point with client routing
│   │   ├── saas/               # Default SaaS pipeline
│   │   │   └── main.py         # Main entry point for SaaS
│   │   ├── shared/             # Shared pipeline components
│   │   │   ├── preprocessing/  # Document preprocessing
│   │   │   ├── extraction/     # Field extraction logic
│   │   │   └── postprocessing/ # Result postprocessing
│   │   └── clients/            # Client-specific overrides
│   │       └── clover/         # Clover client customizations
│   ├── core/                   # Core utilities (registry, fieldset)
│   ├── constants/              # Constants, mappings, and field definitions
│   │   ├── mappings/           # Crosswalk JSON files
│   │   └── lists/              # Lookup lists
│   ├── prompts/                # LLM prompt templates
│   ├── utils/                  # Shared utilities (IO, string, logging, etc.)
│   ├── codes/                  # Medical code extraction utilities
│   ├── crosswalk/              # Crosswalk mapping logic
│   ├── embeddings/             # Pre-computed embeddings for code matching
│   ├── qc_qa/                  # QC/QA validation pipeline
│   ├── parent_child/           # Parent-child relationship mapping
│   ├── document_classification/ # Document type classification (DTC)
│   └── tests/                  # Unit tests
├── documentation/              # Project documentation
├── outputs/                    # Pipeline output files (gitignored)
├── logs/                       # Log files (gitignored)
└── pyproject.toml              # Project dependencies (uv/pip)

Branching

Naming Conventions

Type Pattern Use Case Example
Feature feature/<ticket>-<description> New functionality feature/PROJ-123-add-export-csv
Bugfix bugfix/<ticket>-<description> Bug fixes bugfix/PROJ-456-fix-null-handling
Hotfix hotfix/<ticket>-<description> Urgent production fixes hotfix/PROJ-789-critical-parse-error
Test test/<description> Testing/experimentation test/lesser-table-caching-refactor
Release release/<version> Release preparation release/v1.2.0

Branch Guidelines

  • Use lowercase with hyphens (kebab-case) for descriptions
  • Include ticket number when applicable (e.g., JIRA, GitHub issue)
  • Keep branch names concise but descriptive
  • Delete branches after merging

Workflow

  1. Create branch from main
  2. Make changes and commit with clear messages
  3. Run checks before pushing: uv run black src/ && uv run mypy src/ && uv run pytest
  4. Create PR to main
  5. Ensure all CI checks pass
  6. Get code review approval
  7. Squash and merge
S
Description
AARETE DoczyAI pipelines mirror.
Readme 642 MiB
Languages
Python 80.5%
Jupyter Notebook 13%
HCL 3.1%
HTML 1.6%
PLpgSQL 1.5%
Other 0.2%