fix: address PR review workflow/docs/test issues

Assisted-by: GitHub Copilot (GPT-5.3-Codex)

Author: ChrisChilders-USDA

.github/workflows/build.yml

@@ -28,7 +28,15 @@ jobs:
       - name: Test with coverage
         run: |
           coverage erase
-          coverage run -a tests.py
+          coverage run -a "$(command -v gff3_QC)" -g example_file/example.gff3 -f example_file/reference.fa -o error.txt
+          coverage run -a "$(command -v gff3_fix)" -qc_r error.txt -g example_file/example.gff3 -og corrected.gff3
+          coverage run -a "$(command -v gff3_merge)" -g1 example_file/new_models.gff3 -g2 example_file/reference.gff3 -f example_file/reference.fa -og merged.gff -r merged_report.txt
+          coverage run -a "$(command -v gff3_merge)" -g1 example_file/new_models.gff3 -g2 example_file/reference.gff3 -f example_file/reference.fa -og merged.gff -u1 example_file/u1.txt -u2 example_file/u2.txt -r merged_report.txt
+          coverage run -a "$(command -v gff3_merge)" -g1 example_file/new_models.gff3 -g2 example_file/reference.gff3 -f example_file/reference.fa -og merged.gff -u1 example_file/u1.txt -r merged_report.txt
+          coverage run -a "$(command -v gff3_merge)" -g1 example_file/new_models.gff3 -g2 example_file/reference.gff3 -f example_file/reference.fa -og merged.gff -u2 example_file/u2.txt -r merged_report.txt
+          coverage run -a "$(command -v gff3_merge)" -g1 example_file/new_models_w_replace.gff3 -g2 example_file/reference.gff3 -f example_file/reference.fa -og merged.gff -r merged_report.txt -noAuto
+          coverage run -a "$(command -v gff3_sort)" -g example_file/example.gff3 -og example-sorted.gff3
+          coverage run -a "$(command -v gff3_to_fasta)" -g example_file/example.gff3 -f example_file/reference.fa -st all -d simple -o test_sequences
           coverage run -a -m unittest discover -s tests/unit -p "test_*.py"
       - name: after success
         env: 
@@ -57,7 +65,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ['ubuntu-24.04', 'windows-2025-vs2026', 'macos-latest']
+        os: ['ubuntu-24.04', 'windows-latest', 'macos-latest']
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -78,7 +86,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ['ubuntu-24.04', 'windows-2025-vs2026', 'macos-latest']
+        os: ['ubuntu-24.04', 'windows-latest', 'macos-latest']
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -95,7 +103,7 @@ jobs:
       - name: Install wheel and verify CLI entry points
         run: |
           python -c "import glob,subprocess,sys; wheels=glob.glob('dist/*.whl'); assert wheels, 'No wheel built'; subprocess.check_call([sys.executable, '-m', 'pip', 'install', wheels[0]])"
-          python -m gff3tool.bin.gff3_sort -h
+          gff3_sort -h
           python -c "import shutil,sys; sys.exit(0 if shutil.which('gff3_sort') else 1)"
 
   build5-Docs-build:
@@ -111,7 +119,6 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           python -m pip install -r docs/requirements.txt
-          python -m pip install .
       - name: Build docs (warnings as errors)
         run: |
           python -m sphinx -W -b html docs docs/_build/html

.readthedocs.yml

@@ -11,5 +11,3 @@ sphinx:
 python:
   install:
     - requirements: docs/requirements.txt
-    - method: pip
-      path: .

docs/HANDOFF.md

@@ -4,7 +4,8 @@
 - Date: 2026-05-15
 - Branch: chore/version-updates-followup
 - Latest commit before this note: 6862a83
-- Goal completed: Python 3.14 compatibility reassessment with runtime and packaging checks.
+- Goal completed locally: Python 3.14 compatibility reassessment with runtime and packaging checks.
+- Note: several follow-up review items remained open after this validation.
 
 ## What Was Validated Under Python 3.14
 Environment used:
@@ -40,6 +41,7 @@ Commands run:
 ### 3) setup.py uses private setuptools fallback path
 - setup.py imports setuptools._distutils.command.build in fallback path.
 - This works now, but it is a private path and has upgrade fragility risk.
+- The BLAST bundle step also needs to be idempotent and safe against archive path traversal.
 
 ### 4) Smoke test caveat
 - tests.py requires bundled BLAST executables to be available.
@@ -55,6 +57,7 @@ Commands run:
 1. Update pyproject.toml license metadata to remove setuptools-deprecated forms.
 2. Consider removing private setuptools._distutils fallback usage in setup.py.
 3. Keep tests.py BLAST preflight behavior, but ensure local instructions clearly explain BLAST artifact requirements.
+4. Resolve the remaining review comments in the workflow, docs, setup, and tests before treating the branch as finished.
 
 ## Fast Resume Checklist
 1. Confirm branch: chore/version-updates-followup

docs/conf.py

@@ -68,6 +68,7 @@
     '_build',
     'Thumbs.db',
     '.DS_Store',
+    'HANDOFF.md',
     # Keep these markdown files for GitHub readability but avoid duplicate
     # Sphinx docnames where .rst versions exist.
     'Detection-of-GFF3-format-errors.md',

docs/gff3_to_fasta.md

@@ -5,7 +5,7 @@ Extract sequences from specific regions of genome based on gff file.
 ## Features
 
 * **Incorporation of [gff3.py](https://github.com/hotdogee/gff3-py)**: `gff3.py` is contributed by [Han Lin](https://github.com/hotdogee) which uses simple data structures to parse a [`GFF3`] file into a structure composed of simple python [`dict`] and [`list`].
-* **Validation**: Validate the [GFF3 formatting errors](Detection-of-GFF3-format-errors.rst) utilizing [QC methods](../gff3tool/bin/gff3_QC.py) contributed by the [I5K Workspace@NAL team](https://i5k.nal.usda.gov/). Provide `WARNING` messages for gene models that may have incorrect biological sequences generated because of [`GFF3`] formatting errors.
+* **Validation**: Validate the [GFF3 formatting errors](Detection-of-GFF3-format-errors.rst) utilizing [QC methods](gff3_QC.md) contributed by the [I5K Workspace@NAL team](https://i5k.nal.usda.gov/). Provide `WARNING` messages for gene models that may have incorrect biological sequences generated because of [`GFF3`] formatting errors.
 * **Easy extraction of biological sequences**: Provide options for extracting six types of biological sequences or user-specified type of spliced sequences.
     - **`gene`**: Gene sequence for each record in the [`FASTA`] output. Gene or pseudogene features need to be included in the gff file
     - **`exon`**: Exon sequence for each record in the [`FASTA`] output. Exon features need to be included in the gff file

gff3tool/lib/id_processor.py

@@ -193,7 +193,7 @@ def general_newModel(oldmodel, gff):
     newid = oldmodel['attributes']['ID']
     if newid in gff.features.keys():
         eofindex = len(gff.lines)
-        newid = eofindex
+        newid = str(eofindex)
     newmodel = newParentModel(oldmodel, newid, gff)
     gff.features[newid].append(newmodel)
     gff.lines.append(newmodel)

setup.py

@@ -40,17 +40,23 @@ def bundle_blast(project_root, version):
 
     blast_path = path.join(project_root, 'gff3tool', 'lib', 'ncbi-blast+')
     blast_file = path.join(blast_path, 'blast.tgz')
+    blast_bin_path = path.join(blast_path, 'bin')
     download_url = 'https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/{0:s}/{1:s}'.format(
         version, archive_name)
 
+    if path.exists(blast_bin_path):
+        return
+
     if not path.exists(blast_path):
         mkdir(blast_path)
 
     urlretrieve(download_url, blast_file)
 
     tar = tarfile.open(blast_file, 'r:gz')
-    tar.extractall(blast_path)
-    tar.close()
+    try:
+        _safe_extract_tar(tar, blast_path)
+    finally:
+        tar.close()
 
     extract_path = path.join(blast_path, 'ncbi-blast-{0:s}+'.format(version))
     shutil.move(path.join(extract_path, 'bin'), blast_path)
@@ -61,6 +67,26 @@ def bundle_blast(project_root, version):
         shutil.rmtree(extract_path)
 
 
+def _safe_extract_tar(archive, destination):
+    destination_root = path.realpath(destination)
+    if not destination_root.endswith(path.sep):
+        destination_root = destination_root + path.sep
+
+    safe_members = []
+    for member in archive.getmembers():
+        if path.isabs(member.name):
+            raise RuntimeError('Refusing to extract absolute tar member: {0:s}'.format(member.name))
+        if member.issym() or member.islnk():
+            raise RuntimeError('Refusing to extract linked tar member: {0:s}'.format(member.name))
+
+        member_path = path.realpath(path.join(destination, member.name))
+        if not member_path.startswith(destination_root):
+            raise RuntimeError('Refusing to extract outside destination: {0:s}'.format(member.name))
+        safe_members.append(member)
+
+    archive.extractall(destination, members=safe_members)
+
+
 class bdist_wheel(_bdist_wheel):
     def finalize_options(self):
         _bdist_wheel.finalize_options(self)

tests.py

@@ -108,6 +108,8 @@ def assert_fasta_has_header(path: Path) -> None:
 
 def run_command(name: str, args: list[str], expected_files: list[Path]) -> None:
 	cmd = [resolve_command(args[0]), *args[1:]]
+	for output_path in expected_files:
+		remove_if_exists(output_path)
 
 	print(f"[RUN] {name}: {' '.join(cmd)}")
 	result = subprocess.run(cmd, cwd=ROOT)

tests/unit/test_id_processor.py

@@ -224,8 +224,8 @@ def test_general_new_model_uses_eof_index_when_id_already_exists(self):
             id_processor.general_newModel(oldmodel, gff)
 
         new_root = gff.lines[2]
-        self.assertEqual(new_root["attributes"]["ID"], 2)
-        self.assertIn(2, gff.features)
+        self.assertEqual(new_root["attributes"]["ID"], "2")
+        self.assertIn("2", gff.features)
         self.assertTrue(new_root["children"])
 
     def test_new_nreplace_model_replaces_old_model_and_removes_original(self):