Modernize the package: upgrade all dependencies, fix silent correctness bugs, add tests and CI/CD

[asjacobs92]

Summary

Trustee's dependencies dated from 2022 and no longer resolved against current releases. This upgrades the whole stack to the latest of everything, fixes the breakages that exposed, and adds the test suite and CI/CD that would have caught them.

The headline finding: the package imported and ran fine on modern scikit-learn but produced wrong numbers. Nothing crashed — the reports just printed nonsense.

Silent correctness bugs

scikit-learn 1.3 changed classifier tree_.value from raw sample counts to per-node class fractions. Every percentage derived from it was wrong:

Before: virginica: 200.00% / 0.00%    Class Samples: 1400.00%    Data Split: 7.14% (every node)
After:  virginica: 0.00% / 100.00%    Class Samples: 100.00%     Data Split: 35.71% / 64.29%

Fixed with a version-agnostic get_node_counts() helper. Five more real bugs surfaced along the way:

Bug	Impact
TrustReport(X=..., y=...) raised AttributeError	The documented entry point, so the shipped trust_classification.py example could not run
Leaf prob tested .ndim > 1 on a 1-D array	Every probability rendered as 0.00%
Stray trailing comma	Class names rendered as (np.str_('virginica'),)
TrustReport.__getstate__ used a shallow copy	Detached trustee.expert from the live object; first save() corrupted the report, second raised
plt.figure() immediately superseded by plt.subplots()	Leaked a figure per call in four plot helpers

Plus two pandas 3.0 breaks: df.drop(columns=..., axis=1) now raises, and get_dummies returning bool forced the output array to object dtype, silently making the np.nan_to_num scrub a no-op.

Dependency audit

The manifest was wrong in both directions:

• six and joblib were imported but never declared — a latent ImportError. six is a Python-2 shim and is now gone.
• scipy, termcolor, setuptools and all four Sphinx packages were declared as runtime deps but unused. pip install trustee was pulling in the whole of Sphinx.

Locked: numpy 2.5.2 · pandas 3.0.5 · scikit-learn 1.9.0 · matplotlib 3.11.1 · prettytable 3.18.0 · graphviz 0.21 · Sphinx 9.1 · furo 2025.12.19

pyproject.toml moved to PEP 621 with poetry-core (the old poetry.masonry.api backend and dev-dependencies are both removed in Poetry 2.x). Python floor 3.7 → 3.11. Version 1.1.6 → 1.2.0.

One gotcha worth recording: Poetry 2.1 silently does not lock PEP 735 [dependency-groups]. The docs/dev deps were missing from poetry.lock entirely until I switched to Poetry's native group syntax.

Tests and CI/CD

The repo had no tests, and CI only built docs — which is why the rot went unnoticed.

67 tests, ~15s. The tree tests assert on magnitudes, not shapes, because the regression they guard leaves numbers finite and plausible-looking. Verified against the pre-fix code: 6 of them fail.

• test.yml — lint (black, flake8, poetry check --lock); tests on Python 3.11–3.14 across Linux, macOS and Windows; the shipped examples (they render into the docs, so breakage there breaks the published site); and a build job that runs twine check and verifies the wheel imports standalone.
• release.yml — builds, re-runs tests, refuses to publish if tag / pyproject.toml / _version.py disagree, then publishes via PyPI Trusted Publishing. TestPyPI available via workflow_dispatch.
• sphinx.yml — replaced the third-party action pinned to @master (it supplies its own Python and would not pick up the pinned Sphinx 9 stack) with a direct build. Warnings are now errors; deploys gated to master so PRs no longer publish.

pytest now fails on DeprecationWarning/FutureWarning, so the next round of dependency drift surfaces as a test failure rather than silently wrong numbers.

⚠️ Before merging

release.yml needs a one-time PyPI trusted-publisher setup or the release will fail. On PyPI → Manage → Publishing, add: owner TrusteeML, repo trustee, workflow release.yml, environment pypi. Same for TestPyPI with environment testpypi. (Alternative: swap in a PYPI_API_TOKEN secret.)

Also worth noting GitHub currently flags 174 vulnerabilities on master (9 critical, 75 high) — this upgrade should clear the bulk of them.

Verification

All green locally: 67 tests on Python 3.12 and 3.14 · all four shipped examples · clean-venv wheel and sdist installs · Sphinx 9 docs build with -W and zero warnings · black --check and flake8 clean · poetry check --lock clean.

Two things deliberately left alone as pre-existing and out of scope: cosmetic matplotlib findfont/tight_layout warnings, and a benign sklearn UserWarning in the regression report path (allowlisted in the pytest config rather than silenced globally).

🤖 Generated with Claude Code