.bashrc

@@ -6,11 +6,8 @@ if [ -f /etc/bashrc ]; then
     . /etc/bashrc
 fi
 
-source /cvmfs/oasis.opensciencegrid.org/ligo/sw/conda/etc/profile.d/conda.sh
-conda activate igwn-py39-20221118
-
 # Add user site directory to the PATH. On Linux, this is usuall ~/.local/bin.
-export PATH="$(python -m site --user-base)/bin${PATH+:${PATH}}"
+export PATH="$(python3.11 -m site --user-base)/bin${PATH+:${PATH}}"
 
 # Disable OpenMP, MKL, and OpenBLAS threading by default.
 # In this environment, it will be enabled selectively by processes that use it.
@@ -47,4 +44,10 @@ emfollow-playground)
 emfollow-test)
     export CELERY_CONFIG_MODULE="gwcelery.conf.test"
     ;;
+emfollow-dev)
+    export CELERY_CONFIG_MODULE="gwcelery.conf.dev"
+    ;;
 esac
+
+# HTGETTOKENOPTS for passing through to condor
+export HTGETTOKENOPTS="--vaultserver vault.ligo.org --issuer igwn --role read-cvmfs-${USER} --credkey read-cvmfs-${USER}/robot/${USER}.ligo.caltech.edu --nooidc"

.gitignore

@@ -50,3 +50,4 @@ public_html
 .vim
 .viminfo
 .Xauthority
+read-cvmfs.keytab

.gitlab-ci.yml

@@ -10,10 +10,13 @@ include:
 variables:
   # Allow Celery to run as root, because everything runs as root under Docker.
   C_FORCE_ROOT: 'true'
+  # Poetry version to install
+  POETRY_VERSION: 1.8.3
 
 stages:
   - build
   - test
+  - docker
   - deploy
 
 # Build source distribution
@@ -43,20 +46,25 @@ build:
     - !reference [".debian:base", before_script]
     - !reference [".python:pytest", before_script]
     - *install-redis
-    - curl -sSL https://install.python-poetry.org | python3 -
+    - python3 -m pip install pipx
     - export PATH="/root/.local/bin:$PATH"
+    - pipx ensurepath
+    - pipx install poetry==$POETRY_VERSION
+    - pipx inject poetry poetry-dynamic-versioning
     - poetry config virtualenvs.create false
+    # Check that poetry.lock is consistent with pyproject.toml
+    - poetry check --lock
     - poetry install -E test
   needs: []
-test/poetry/python3.8:
-  extends: .test-poetry
-  image: python:3.8
-test/poetry/python3.9:
-  extends: .test-poetry
-  image: python:3.9
 test/poetry/python3.10:
   extends: .test-poetry
   image: python:3.10
+test/poetry/python3.11:
+  extends: .test-poetry
+  image: python:3.11
+test/poetry/python3.12:
+  extends: .test-poetry
+  image: python:3.12
 
 # Run test suite using wheel and bleeding-edge dependencies
 .test-wheel:
@@ -70,20 +78,22 @@ test/poetry/python3.10:
     - *install-redis
   needs:
     - build
-test/wheel/python3.8:
-  extends: .test-wheel
-  image: python:3.8
-test/wheel/python3.9:
-  extends: .test-wheel
-  image: python:3.9
 test/wheel/python3.10:
   extends: .test-wheel
   image: python:3.10
+test/wheel/python3.11:
+  extends: .test-wheel
+  image: python:3.11
+test/wheel/python3.12:
+  extends: .test-wheel
+  image: python:3.12
 
 lint:
   stage: test
   extends: .python:flake8
   needs: []
+  variables:
+    REQUIREMENTS: flake8-isort
 
 associate commits in Sentry:
   stage: test
@@ -106,9 +116,7 @@ doc:
   extends:
     - .debian:base
     - .python:sphinx
-  # FIXME: temporarily set image to Python 3.9 because default `python` image
-  # is now Python 3.10 which lacks wheels for many packages right now.
-  image: python:3.9
+  image: python:3.11
   variables:
     SOURCEDIR: doc
     REQUIREMENTS: .[doc]
@@ -118,16 +126,36 @@ doc:
     - apt-get install -y -qq graphviz
   needs: []
 
+# Create Docker image
+docker:
+  stage: build
+  script:
+    - IMAGE_TAG=$CI_REGISTRY_IMAGE:${CI_COMMIT_REF_NAME/\//-} # Replace "/" in release branch names with "-"
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    - docker build -t $IMAGE_TAG .
+    - docker push $IMAGE_TAG
+    - |
+      if [ "${CI_COMMIT_TAG:0:1}" = "v" ]
+      then
+        docker tag $IMAGE_TAG ${IMAGE_TAG%:*}:latest
+        docker push ${IMAGE_TAG%:*}:latest
+      fi
+  needs: []
+
 # SCCB request
 sccb:
   stage: deploy
+  when: manual
+  only:
+    - tags@emfollow/gwcelery
   before_script:
     # poetry-dynamic-versioning needs to be installed to properly
     # update the version information in pyproject.toml
-    - >
-      python -m pip install --upgrade pip;
-      curl -sSL https://install.python-poetry.org | python3 -;
-      python -m pip install --upgrade poetry-dynamic-versioning
+    - python -m pip install --upgrade pip
+    - python -m pip install pipx
+    - pipx ensurepath
+    - pipx install poetry==$POETRY_VERSION
+    - pipx inject poetry poetry-dynamic-versioning
   needs: []
 
 # Publish coverage
@@ -142,7 +170,7 @@ pages:
   only:
     - main
   needs:
-    - test/poetry/python3.8
+    - test/poetry/python3.10
 
 # Upload package to PyPI.
 # Place your PyPI API token in the repository's GitLab CI secrets.
@@ -150,7 +178,7 @@ pypi:
   stage: deploy
   image: python:slim
   script:
-    - pip install twine
+    - python -m pip install twine
     - twine upload --username __token__ --password $PYPI_API_TOKEN *.tar.* *.whl
   needs:
     - build
@@ -229,13 +257,16 @@ release:
       ssh -T $REMOTE_HOST bash <<EOF
       . .bashrc
       set -e
-      python -m pip install --upgrade pip
-      curl -sSL https://install.python-poetry.org | python3 -
-      # FIXME: It would be simpler to use `poetry install`, but it tries to
-      # uninstall system site-packages even if they are not writable.
-      pip install --no-deps -r <(poetry export --with dev)
-      pip install --no-deps .
-
+      python3.11 -m ensurepip --upgrade
+      python3.11 -m pip install pipx
+      pipx ensurepath
+      pipx install poetry==$POETRY_VERSION
+      pipx inject poetry poetry-dynamic-versioning
+      # FIXME: It would be simpler to use `poetry install`, but it installs the
+      # project in editable mode, which is not appropriate for production
+      # deployments.
+      python3.11 -m pip install --no-deps -r <(poetry export --with dev)
+      python3.11 -m pip install --no-deps .
       # FIXME: remove pip uninstall temporary directories left behind due to
       # bug with pip on NFS. See https://github.com/pypa/pip/issues/6327
       chmod -R ug+rwx .local/lib/python*/site-packages/~* || true
@@ -274,6 +305,7 @@ deploy to production at LHO:
 
 deploy to playground at CIT:
   <<: *deploy-start
+  when: manual
   environment:
     name: playground/CIT
     on_stop: stop deployment on playground at CIT
@@ -293,7 +325,6 @@ deploy to playground at LHO:
 
 deploy to test at CIT:
   <<: *deploy-start
-  when: manual
   environment:
     name: test/CIT
     on_stop: stop deployment on test at CIT
@@ -311,6 +342,16 @@ deploy to test at LHO:
   variables:
     REMOTE_HOST: emfollow-test@emfollow-test.ligo-wa.caltech.edu
 
+deploy to dev at CIT:
+  <<: *deploy-start
+  when: manual
+  environment:
+    name: dev/CIT
+    on_stop: stop deployment on dev at CIT
+    url: https://emfollow-dev.ligo.caltech.edu/flower
+  variables:
+    REMOTE_HOST: emfollow-dev@emfollow-dev.ligo.caltech.edu
+
 stop deployment on production at CIT:
   <<: *deploy-stop
   when: manual
@@ -352,3 +393,10 @@ stop deployment on test at LHO:
   environment:
     name: test/LHO
     action: stop
+
+stop deployment on dev at CIT:
+  <<: *deploy-stop
+  when: manual
+  environment:
+    name: dev/CIT
+    action: stop

.gitlab/issue_templates/Add new external pipeline.md

+# Checklist
+
+## Policy
+
+- [ ] Determine whether the new experiment falls within an existing search, see this [documentation](https://gracedb.ligo.org/documentation/models.html#data-models) for a comprehensive list.
+- [ ] Determine which (if any) joint FAR method to use, either [untargeted](https://ligo-raven.readthedocs.io/en/latest/joint_far.html#untargeted-search-method) or [targeted](https://ligo-raven.readthedocs.io/en/latest/joint_far.html#targeted-search-method). The untargeted method is often used with highly significant external events (enough to be published based on their own sigificance) while the targeted method is often used with less significant events that have their own FARs available.
+- [ ] Determine what the relevant rates will be, either the *independent* rates of detection (i.e. not detected by any other experiment in the same search) or max FAR thresholds (both GW and external). See the following for examples: [adding subthreshold GRBs](https://dcc.ligo.org/cgi-bin/private/DocDB/ShowDocument?docid=T1900297); [Adding SVOM GRBs to the list of existing GRBs](https://dcc.ligo.org/LIGO-T2400116)
+- [ ] Determine which coincidence searches will need to be set up, i.e. which type(s) of GW candidate(s) associations we are looking for. Examples include CBCs and unmodeled GW Bursts created from supernovae.
+- [ ] If a new coincidence search, determine what the relevant new time window(s) should be. These should ideally be based on delay models. If the underlying systems that could produce such a coincidence are not as well understood, then a practical time window could be chosen that is roughly what we could expect (e.g. the CBC-FRB time windows are double that of CBC-GRB due to our ignorance of such systems). Otherwise use the time windows of the existing search.
+- [ ] Determine whether sky maps or sky map information (RA/dec/error radius) will be available. Determine whether these will be flattened or Multi-Order Coverage (MOC).
+- [ ] If a new search, determine whether there should be differences in considering which external event should be preferred (currently SNEWS > threshold > subthreshold, with tie breakers being whether the `NOT_GRB` label is present and the joint FAR).
+- [ ] Determine whether there are any special conditions to publish this event beyond the current conditions (see `raven.trigger_raven_alert`)
+
+## GraceDB
+
+- [ ] If the `search` and/or `pipeline` names do not yet exist in GraceDB, open an issue on [GraceDB Server](https://git.ligo.org/computing/gracedb/server/-/issues/new) and work with the developers to add this. This can be checked via the [documentation](https://gracedb.ligo.org/documentation/models.html#data-models).
+- [ ] If the VOEvent packet differs from previous examples and is not ingestible, open an issue on [GraceDB Server](https://git.ligo.org/computing/gracedb/server/-/issues/new) and work with the developers to fix this. *Note* we currently convert JSON packets to VOEvent in gwcelery, so until this is natively supported in GraceDB, an existing function in gwcelery [_kafka_to_voevent](https://git.ligo.org/emfollow/gwcelery/-/blob/218d378e665e5397677854b43f5e6719c42e0036/gwcelery/tasks/external_triggers.py#L726) may need to be modified (or a new equivalent function written if too different).
+
+## GWCelery
+
+- [ ] Add/modify the policy-determined variables to the [configuration file](https://git.ligo.org/emfollow/gwcelery/-/blob/main/gwcelery/conf/__init__.py), next to each relevant existing variable if applicable. This also includes pipeline variables used in other applications like detchar omegascans, etc.
+- [ ] If an existing search, add to the relevant listener. Add any unique differences compared to previous searches, especially if there are ways to either filter out events or mark them to not be considered in the search with the `NOT_GRB` label. If the search differs significantly from existing or different functionality is needed, create a new listener. Add logic to download sky maps if available or create sky maps if RA/dec/error is given by choosing the arguments for `external_triggers._create_replace_external_event_and_skymap`.
+- [ ] Do the same for the IGWN alert listener. Add `raven.coincidence_search`s determined in the above policy section.
+- [ ] If using Kafka, modify the credential map (at `~/.config/gwcelery/kafka_credential_map.json`) on each server (`production`, `playground`, `test`, `dev`) to include the key/credential pair for each new notice type.
+- [ ] If using ligo-raven < 4.0, modify `raven.calculate_coincidence_far` to get the correct joint FAR method by overriding the `ext_search` if necessary. If using ligo-raven >= 4.0, map to the correct `joint_far_method`.
+- [ ] If changing or adding time windows, modify `raven._time_window`.
+- [ ] If changing how the preferred external event is calculated, modify `raven.update_coinc_far` accordingly.
+- [ ] If change publishing conditions, modify `raven.trigger_raven_alert`.
+- [ ] If creating sky maps from RA/dec/error, add to list of pipelines in `external_skymaps.py`.
+- [ ] Add both O3 replay and MDC testing in [`first2years_external.py`](https://git.ligo.org/emfollow/gwcelery/-/blob/main/gwcelery/tasks/first2years_external.py).
+- [ ] Add [tests](https://git.ligo.org/emfollow/gwcelery/-/tree/main/gwcelery/tests) for all of the changes made. Ensure 100% testing coverage moving forward.
+
+/label ~External Triggers

.gitlab/issue_templates/Create a Release.md

@@ -11,19 +11,41 @@
     release, then the list of issues and merge requests that have been
     addressed is accurate. Any unaddressed issues and merge requests have been
     moved to another milestone.
+5.  [ ] Check the versions of the following packages in the [`poetry.lock`](https://git.ligo.org/emfollow/gwcelery/-/blob/main/poetry.lock) file have been approved by the SCCB (i.e. either has the status:deploy or status:deployed label).
+    - [ ] [`bilby`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=bilby&first_page_size=100)
+    - [ ] [`bilby_pipe`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=bilby_pipe&first_page_size=100)
+    - [ ] [`gracedb-sdk`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=gracedb-sdk&first_page_size=100)
+    - [ ] [`gwdatafind`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=gwdatafind&first_page_size=100)
+    - [ ] [`gwpy`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=gwpy&first_page_size=100)
+    - [ ] [`gwskynet`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=gwskynet&first_page_size=100)
+    - [ ] [`igwn-alert`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=igwn-alert&first_page_size=100)
+    - [ ] [`igwn-alert-schema`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=igwn-gwalert-schema&first_page_size=20)
+    - [ ] [`lalsuite`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=lalsuite&first_page_size=100)
+    - [ ] [`ligo-followup-advocate`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=ligo-followup-advocate&first_page_size=100)
+    - [ ] [`ligo-gracedb`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=ligo-gracedb&first_page_size=100)
+    - [ ] [`ligo-raven`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=ligo-raven&first_page_size=100)
+    - [ ] [`ligo-segments`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=ligo-segments&first_page_size=20)
+    - [ ] [`ligo.em-bright`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=ligo.em-bright&first_page_size=20)
+    - [ ] [`ligo.skymap`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=ligo.skymap&first_page_size=100)
+    - [ ] [`lscsoft-glue`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=lscsoft-glue&first_page_size=100)
+    - [ ] [`pesummary`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=pesummary&first_page_size=100)
+    - [ ] [`python-ligo-lw`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=python-ligo-lw&first_page_size=100)
+    - [ ] [`rapidpe`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=Rapidpe&first_page_size=20)
+    - [ ] [`rapidpe-rift-pipe`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=RapidPE%20pipeline&first_page_size=20)
+    - [ ] [`RIFT`](https://git.ligo.org/computing/sccb/-/issues/?sort=updated_desc&state=all&search=rift&first_page_size=100)
 
-## Playground deployment
+## Test deployment
 
-4.  [ ] Sentry does not show any new [unresolved issues on playground](https://sentry.io/organizations/ligo-caltech/issues/?environment=playground&groupStatsPeriod=14d&project=1425216&query=is%3Aunresolved&statsPeriod=14d) that indicate new bugs or regressions.
-5.  [ ] The playground deployment has run for at least 10 minutes.
-6.  [ ] The [Flower monitor](https://emfollow-playground.ligo.caltech.edu/flower) is reachable and shows no unexpected task failures.
-7.  [ ] The [Flask dashboard](https://emfollow-playground.ligo.caltech.edu/gwcelery) is reachable.
-8.  [ ] The playground deployment is connected to IGWN Alert (in Flower, find the main gwcelery-worker, click Other, and look at the list of subscribed IGWN Alert topics).
-9.  [ ] The playground deployment is connected to GCN.
+4.  [ ] Sentry does not show any new [unresolved issues on test](https://sentry.io/organizations/ligo-caltech/issues/?environment=test&groupStatsPeriod=14d&project=1425216&query=is%3Aunresolved&statsPeriod=14d) that indicate new bugs or regressions.
+5.  [ ] The test deployment has run for at least 10 minutes.
+6.  [ ] The [Flower monitor](https://emfollow-test.ligo.caltech.edu/flower) is reachable and shows no unexpected task failures.
+7.  [ ] The [Flask dashboard](https://emfollow-test.ligo.caltech.edu/gwcelery) is reachable.
+8.  [ ] The test deployment is [connected to IGWN Alert](https://emfollow-test.ligo.caltech.edu/flower/worker/gwcelery-worker%40emfollow-test.ligo.caltech.edu#tab-other) (in Flower, find the main gwcelery-worker, click Other, and look at the list of subscribed IGWN Alert topics).
+9.  [ ] The test deployment is [connected to GCN](https://emfollow-test.ligo.caltech.edu/flower/worker/gwcelery-voevent-worker%40emfollow-test.ligo.caltech.edu#tab-other) (in Flower, find the voevent gwcelery-worker, click Other, and look at the list of receiver peers).
 
 ## Mock events
 
-10. [ ] The playground deployment has [produced an MDC superevent](https://gracedb-playground.ligo.org/latest/?query=MDC&query_type=S).
+10. [ ] The test deployment has [produced an MDC superevent](https://gracedb-test.ligo.org/latest/?query=MDC&query_type=S).
 11. [ ] The MDC superevent has the following annotations.
     - [ ] `bayestar.multiorder.fits`
     - [ ] `bayestar.fits.gz`
@@ -43,15 +65,15 @@
     - [ ] 2 preliminary VOEvents
     - [ ] 2 preliminary JSON packets
     - [ ] 2 preliminary Avro packets
-14. [ ] Issuing a manual preliminary alert from the [Flask dashboard](https://emfollow-playground.ligo.caltech.edu/gwcelery) sends another preliminary alert.
+14. [ ] Issuing a manual preliminary alert from the [Flask dashboard](https://emfollow-test.ligo.caltech.edu/gwcelery) sends another preliminary alert.
     - [ ] The alert **is sent** successfully if `ADVOK` or an `ADVNO` label is **not applied** this time.
     - [ ] Alternatively, a preliminary alert is **blocked** due to presence of `ADVOK` or `ADVNO`.
 15. [ ] `DQR_REQUEST` label is applied to the superevent. The application happens at the time of launching the second preliminary alert.
 16. [ ] The MDC superevent has either an `ADVOK` or an `ADVNO` label.
 17. [ ] Issuing an `ADVOK` signoff through GraceDB results in an initial VOEvent.
 18. [ ] Issuing an `ADVNO` signoff through GraceDB results in a retraction VOEvent.
-19. [ ] Requesting an update alert through the [Flask dashboard](https://emfollow-playground.ligo.caltech.edu/gwcelery) results in an update VOEvent.
-20. [ ] Playground has recently [produced an MDC superevent with an external coincidence](https://gracedb-playground.ligo.org/latest/?query=MDC+EM_COINC&query_type=S), i.e. with an `EM_COINC` label. Use the [Flask dashboard](https://emfollow-playground.ligo.caltech.edu/gwcelery) to do this manually (note that joint events with Swift may not pass publishing conditions and or have a combined sky map, indicated by the lack of `RAVEN_ALERT` and `COMBINEDSKYMAP_READY` label respectively).
+19. [ ] Requesting an update alert through the [Flask dashboard](https://emfollow-test.ligo.caltech.edu/gwcelery) results in an update VOEvent.
+20. [ ] Test has recently [produced an MDC superevent with an external coincidence](https://gracedb-test.ligo.org/latest/?query=MDC+EM_COINC&query_type=S), i.e. with an `EM_COINC` label. Use the [Flask dashboard](https://emfollow-test.ligo.caltech.edu/gwcelery) to do this manually (note that joint events with Swift may not pass publishing conditions and or have a combined sky map, indicated by the lack of `RAVEN_ALERT` and `COMBINEDSKYMAP_READY` label respectively).
 21. [ ] The joint MDC superevent has the following annotations.
     - [ ] `coincidence_far.json`
     - [ ] `combined-ext.multiorder.fits` or `combined-ext.fits.gz`
@@ -66,20 +88,19 @@
     - [ ] At least one VOEvent with `<Group name="External Coincidence">`.
     - [ ] At least one Kafka JSON packet with an `external_coinc` field.
     - [ ] At least one circular w/ `-emcoinc-` in filename.
-24. [ ] Issue a manual RAVEN alert using the [Flask dashboard](https://emfollow-playground.ligo.caltech.edu/gwcelery) for a coincidence (i.e. has `EM_COINC` label) that has does not have the `RAVEN_ALERT` label yet. Choose a [recent joint coincidence that meets this criteria](https://gracedb-playground.ligo.org/latest/?query=MDC+%7ERAVEN_ALERT+%26+EM_COINC&query_type=S&get_neighbors=&results_format=) and ensure that a `RAVEN_ALERT` label is applied to the associated superevent, external event, and preferred event.
+24. [ ] Issue a manual RAVEN alert using the [Flask dashboard](https://emfollow-test.ligo.caltech.edu/gwcelery) for a coincidence (i.e. has `EM_COINC` label) that has does not have the `RAVEN_ALERT` label yet. Choose a [recent joint coincidence that meets this criteria](https://gracedb-test.ligo.org/latest/?query=MDC+%7ERAVEN_ALERT+%26+EM_COINC&query_type=S&get_neighbors=&results_format=) and ensure that a `RAVEN_ALERT` label is applied to the associated superevent, external event, and preferred event.
 
 ## Replay events
 
-24. [ ] [A Production superevent labeled `GCN_PRELIM_SENT`](https://gracedb-playground.ligo.org/latest/?query=Production+GCN_PRELIM_SENT&query_type=S&get_neighbors=&results_format=) has the following parameter estimation annotations and the `PE_READY` label.
-    - [ ] `online_bilby_pe.ini`
+24. [ ] [A Production superevent labeled `GCN_PRELIM_SENT`](https://gracedb-test.ligo.org/latest/?query=Production+GCN_PRELIM_SENT&query_type=S&get_neighbors=&results_format=) has the following parameter estimation annotations and the `PE_READY` label.
+    - [ ] `bilby_config.ini`
     - [ ] `Bilby.posterior_samples.hdf5`
     - [ ] `Bilby.multiorder.fits`
     - [ ] `Bilby.html`
     - [ ] `Bilby.fits.gz`
     - [ ] `Bilby.png`
     - [ ] `Bilby.volume.png`
-    - [ ] `Bilby.extrinsic.png`
-    - [ ] `Bilby.intrinsic.png`
     - [ ] `PE_READY`
+    - [ ] Link to PEsummary page (log message in parameter estimation section)
 
 /label ~Release

.readthedocs.yml

@@ -10,6 +10,7 @@ python:
 build:
   apt_packages:
     - graphviz
+    - libkrb5-dev
   os: ubuntu-22.04
   tools:
-    python: '3.8'
+    python: '3.11'

Dockerfile

+# build stage: build wheel + extract dependencies
+FROM python:3.11 as build
+
+ENV PIP_DEFAULT_TIMEOUT=100
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1
+ENV PIP_NO_CACHE_DIR=1
+ENV POETRY_VERSION=1.8.1
+
+WORKDIR /app
+
+COPY . ./
+
+RUN pip install --upgrade pip
+RUN pip install \
+    poetry==$POETRY_VERSION \
+	poetry-dynamic-versioning
+
+RUN poetry export -f requirements.txt -o requirements.txt
+RUN poetry build -f wheel
+
+# install stage: install gwcelery + dependencies
+FROM python:3.11 as install
+
+ENV PIP_DEFAULT_TIMEOUT=100
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1
+ENV PIP_NO_CACHE_DIR=1
+
+# install kerberos for ciecplib
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libkrb5-dev && \
+	rm -rf /var/lib/apt /var/lib/dpkg /var/lib/cache /var/lib/log
+
+WORKDIR /app
+
+COPY --from=build /app/requirements.txt /app
+COPY --from=build /app/dist/*.whl /app
+
+# create virtualenv
+RUN python -m venv /opt/venv
+
+# ensure virtualenv python is preferred
+ENV PATH="/opt/venv/bin:$PATH"
+
+run pip install --upgrade pip
+RUN pip install -r requirements.txt
+RUN pip install --no-deps *.whl
+
+# final stage: installed app
+FROM python:3.11-slim as app
+
+COPY --from=install /opt/venv /opt/venv
+
+# install kerberos for ciecplib
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libkrb5-dev && \
+	rm -rf /var/lib/apt /var/lib/dpkg /var/lib/cache /var/lib/log
+
+# create app user
+RUN groupadd 1000 && \
+    useradd --uid 1000 --gid 1000 -m gwcelery
+
+USER gwcelery
+
+WORKDIR /home/gwcelery
+
+# ensure virtualenv python is preferred
+ENV PATH="/opt/venv/bin:$PATH"
+
+# disable OpenMP, MKL, and OpenBLAS threading by default
+# it will be enabled selectively by processes that use it
+ENV OMP_NUM_THREADS=1
+ENV MKL_NUM_THREADS=1
+ENV OPENBLAS_NUM_THREADS=1
+
+# web application configuration
+ENV FLASK_RUN_PORT=5556
+ENV FLASK_URL_PREFIX=/gwcelery
+ENV FLOWER_PORT=5555
+ENV FLOWER_URL_PREFIX=/flower
+
+# set dev configuration by default
+ENV CELERY_CONFIG_MODULE=gwcelery.conf.dev
+
+ENTRYPOINT ["gwcelery"]

doc/conf.py

@@ -18,11 +18,11 @@
 # documentation root, use os.path.abspath to make it absolute, like shown here.
 #
 import builtins
-from pathlib import Path
 import sys
+from pathlib import Path
 
-from packaging.version import Version
 import pep517.meta
+from packaging.version import Version
 
 # Make it possible for our code to tell that it is running under Sphinx.
 # See https://stackoverflow.com/a/65147676/167694