Repository navigation
Add data_files setting and tests_dir fixture - #37
Merged
Merged
Conversation
ConfigObject(data_files=[...]) copies the listed tests-folder files into a new read-only folder that the sandbox starts in, so leading code and student code can read them by relative path, as in a Jupyter workspace. A missing listed file makes the submission ungradable. The tests_dir fixture gives tests the tests folder for reading the originals. run.sh now makes the merged run folder root-owned and not writable by group or others, so student code can't change files that tests read later when the host's file owner has ag's uid. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use PurePosixPath so "/" is the separator on every OS and "." and repeated "/" parts are normalized, and compare normalized paths for duplicates. Keep rejecting backslashes and Windows drives, which would be a separator or an anchor on Windows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Build them from stat flags instead of octal literals. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Call the folder named after the test module the tests folder everywhere, to match the tests_dir fixture, and fix get_tests_dir's docstring, which described a 'data' directory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eliotwrobson
marked this pull request as ready for review
November 10, 2026 15:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets workspace questions keep data files in
tests/and read them by relative path, e.g.np.loadtxt("pagerank_large.txt")in PageRank's leading code and notebook.ConfigObject(data_files=["pagerank_large.txt"]): the sandbox starts in a new folder in/tmpthat holds root-owned, read-only copies of the listed files at their relative paths. It's opt-in and works withsandbox,module_sandbox(.pyand.ipynb) andworkspace_sandbox, since the notebook questions don't useworkspace_mode. Entries must be relative paths without... A missing file makes the submission ungradable, likehelper_modules. Without the setting, the starting folder doesn't change. The folder isn't on the import path.tests_dirfixture: returns the tests folder (get_datadir), so tests can donp.loadtxt(tests_dir / "pagerank_large.txt").run.sh: now runschown -R root:rootandchmod -R go-won/grade/run. In a Docker test where the host files hadag's uid, student code could overwrite/grade/run/test_student/pagerank_large.txtby absolute path, which changed whattests_dirreads. This fixes that. It needs an image rebuild.Docker test (full image + this wheel, job copied into the container): a notebook loading the file in leading code and in a
#gradecell got full credit on both tests. A wrong matrix failed only that test. A missing file made the submission ungradable with the config message. Asag, writes to the copy, to its folder and to the original all raisedPermissionError, even with the originals owned by uid 1000. Docker Desktop bind mounts on macOS don't enforce file permissions, so the job has to be copied into the container to test this.🤖 Generated with Claude Code