Add HLA-HD v1.7.1 module and BAM-input subworkflow

.github/actions/nf-test-action/action.yml

@@ -13,6 +13,14 @@ inputs:
   paths:
     description: "Test paths"
     required: true
+  jfrog_username:
+    description: "JFrog registry username"
+    required: false
+    default: ""
+  jfrog_password:
+    description: "JFrog registry password or token"
+    required: false
+    default: ""
 
 runs:
   using: "composite"
@@ -32,6 +40,14 @@ runs:
       with:
         python-version: "3.11"
 
+    - name: Install cross-repo component dependencies
+      shell: bash
+      run: |
+        mapfile -t metas < <(find subworkflows -name meta.yml)
+        if (( ${#metas[@]} > 0 )); then
+          bash .github/scripts/install-components.sh "${metas[@]}"
+        fi
+
     - name: Install nf-test
       uses: nf-core/setup-nf-test@v1
       with:
@@ -72,6 +88,34 @@ runs:
         nextflow secrets set ONCOKB_TOKEN $ONCOKB_TOKEN
 
 
+    - name: Login to JFrog Container Registry (docker)
+      if: ${{ inputs.profile == 'docker' && inputs.jfrog_username != '' }}
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+      with:
+        registry: mskcc.jfrog.io
+        username: ${{ inputs.jfrog_username }}
+        password: ${{ inputs.jfrog_password }}
+
+    - name: Configure JFrog auth for Apptainer/Singularity
+      if: ${{ contains(inputs.profile, 'singularity') && inputs.jfrog_username != '' }}
+      shell: bash
+      env:
+        JFROG_USERNAME: ${{ inputs.jfrog_username }}
+        JFROG_PASSWORD: ${{ inputs.jfrog_password }}
+      run: |
+        # Scope JFrog creds to mskcc.jfrog.io only via a Docker-format auth
+        # file. Setting APPTAINER_DOCKER_USERNAME/PASSWORD globally would send
+        # JFrog basic-auth to every docker:// pull (incl. ghcr.io, quay.io),
+        # which the other registries reject with 403.
+        AUTH=$(printf '%s:%s' "$JFROG_USERNAME" "$JFROG_PASSWORD" | base64 -w0)
+        for d in "$HOME/.apptainer" "$HOME/.singularity"; do
+          mkdir -p "$d"
+          cat > "$d/docker-config.json" <<EOF
+        {"auths":{"mskcc.jfrog.io":{"auth":"$AUTH"}}}
+        EOF
+          chmod 600 "$d/docker-config.json"
+        done
+
       # TODO Skip failing conda tests and document their failures
       # https://github.com/nf-core/modules/issues/7017
     - name: Run nf-test

.github/scripts/install-components.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Install cross-repo nf-core/MSK component dependencies declared in a
+# subworkflow's meta.yml.
+#
+# Usage: install-components.sh META_YML [META_YML …]
+#
+# Each META_YML may declare a `components:` list. Bare-string entries
+# (e.g. `- hlahd`) refer to components in this repo and are skipped.
+# Dict entries, nested under the component name to match the schema
+# `nf-core subworkflows install` itself expects (components_utils.py):
+#   - samtools/collate:
+#       git_remote: https://github.com/nf-core/modules.git
+#       branch: master        # optional; git_sha: <sha> also accepted
+#       org_path: nf-core     # optional, MSK-only extension — nf-core's
+#                              # CLI infers this from git_remote instead and
+#                              # ignores this key, so it's safe to include
+# are sparse-checked-out into `modules/<org_path>/<name>/`.
+#
+# Notes:
+# - Only leaf components are installed; transitive `components:` in the
+#   fetched modules are not recursively resolved.
+# - An existing `modules/<org>/<name>/` directory is treated as a cache hit
+#   and not refreshed even if the declared ref has changed. CI always
+#   starts from a fresh checkout, so this is fine in practice; for local
+#   re-runs, delete the directory to force a refetch.
+# - Default ref is `master`. Set `git_sha:` or `branch:` per component to
+#   override.
+# - Keep this schema in sync with what `nf-core subworkflows install`
+#   expects (see docs/ci.md) — a mismatch breaks installing the
+#   subworkflow into a downstream pipeline via the standard nf-core CLI,
+#   even though this script (and CI) would still work.
+
+set -euo pipefail
+
+DEFAULT_REMOTE="https://github.com/nf-core/modules.git"
+DEFAULT_REF="master"
+
+# Allowlist for path components built from meta.yml input.
+NAME_RE='^[a-z0-9_]+(/[a-z0-9_]+)?$'
+ORG_RE='^[a-z0-9_-]+$'
+
+TMPROOT=$(mktemp -d)
+trap 'rm -rf "$TMPROOT"' EXIT
+
+declare -A seen
+
+for meta in "$@"; do
+  [[ -f "$meta" ]] || { echo "skip: $meta not found"; continue; }
+  n=$(yq '.components | length // 0' "$meta")
+  for i in $(seq 0 $((n - 1))); do
+    kind=$(yq ".components[$i] | tag" "$meta")
+    [[ "$kind" == "!!str" ]] && continue  # bare = local, skip
+
+    name=$(yq -r ".components[$i] | keys | .[0]" "$meta")
+    export COMP_NAME="$name"
+
+    org=$(yq -r    ".components[$i][env(COMP_NAME)].org_path   // \"nf-core\"" "$meta")
+    remote=$(yq -r ".components[$i][env(COMP_NAME)].git_remote // \"$DEFAULT_REMOTE\"" "$meta")
+    ref=$(yq -r    ".components[$i][env(COMP_NAME)].git_sha // .components[$i][env(COMP_NAME)].branch // \"$DEFAULT_REF\"" "$meta")
+
+    [[ "$name" =~ $NAME_RE ]] || { echo "ERROR: invalid component name: $name (in $meta)" >&2; exit 1; }
+    [[ "$org"  =~ $ORG_RE  ]] || { echo "ERROR: invalid org_path: $org (in $meta)" >&2; exit 1; }
+
+    key="$remote|$org|$name|$ref"
+    [[ -n "${seen[$key]:-}" ]] && continue
+    seen[$key]=1
+
+    dest="modules/$org/$name"
+    if [[ -d "$dest" ]]; then
+      echo "✓ $dest already present"
+      continue
+    fi
+
+    echo "→ fetching $org/$name from $remote@$ref"
+    tmp="$TMPROOT/$org-${name//\//_}-$ref"
+    mkdir -p "$tmp"
+    git -C "$tmp" init -q
+    git -C "$tmp" remote add origin "$remote"
+    git -C "$tmp" config core.sparseCheckout true
+    echo "modules/$org/$name/" > "$tmp/.git/info/sparse-checkout"
+    git -C "$tmp" fetch --depth 1 origin "$ref" -q
+    git -C "$tmp" checkout -q FETCH_HEAD
+    mkdir -p "$(dirname "$dest")"
+    mv "$tmp/modules/$org/$name" "$dest"
+  done
+done

.github/skip_nf_test.json

@@ -38,7 +38,9 @@
         "subworkflows/msk/phylowgs",
         "subworkflows/msk/generate_mutated_peptides",
         "subworkflows/msk/neoantigen_editing",
-        "subworkflows/msk/traceback"
+        "subworkflows/msk/traceback",
+        "modules/msk/hlahd",
+        "subworkflows/msk/hlahd_from_bam"
     ],
     "docker": [],
     "singularity": []

.github/workflows/nf-test.yml

@@ -135,6 +135,8 @@ jobs:
           shard: ${{ matrix.shard }}
           total_shards: ${{ env.TOTAL_SHARDS }}
           paths: "${{ join(fromJson(steps.filter.outputs.filtered_paths), ' ') }}"
+          jfrog_username: ${{ secrets.JFROG_USERNAME }}
+          jfrog_password: ${{ secrets.JFROG_PASSWORD }}
 
   confirm-pass:
     runs-on: ubuntu-latest

README.md

@@ -19,6 +19,7 @@ A repository for hosting [Nextflow DSL2](https://www.nextflow.io/docs/latest/dsl
   - [Table of contents](#table-of-contents)
   - [Using existing modules](#using-existing-modules)
   - [Adding new modules](#adding-new-modules)
+  - [CI](#ci)
   - [Help](#help)
   - [Citation](#citation)
 
@@ -141,6 +142,11 @@ If you wish to contribute a new module, please see the documentation on the [MSK
 
 > Please be kind to our code reviewers and submit one pull request per module :)
 
+## CI
+
+See [docs/ci.md](docs/ci.md) for how `nf-test` CI works, including how
+subworkflows declare and fetch cross-repo (nf-core) component dependencies.
+
 ## Help
 
 For further information or help, don't hesitate to get in touch on [Slack `#mskcc-omics-workflows` channel](https://mskcc.enterprise.slack.com/archives/C040T4MFCHJ).