Dataset author normalization

[lucaspar]

Note

Merge #315 first

I was still getting warnings in prod because of datasets in the old authors format (str); this PR changes the Dataset.save() method to set the authors field value as a list of dicts, even if the dataset authors is in the old strings form.

The migration command converts existing data into the new format.

---

Note

Medium Risk
Dataset author writes touch all save paths (behavior change for legacy strings); production deploys now depend on published images and the promote workflow instead of compose builds.

Overview
Dataset authors are normalized on every Dataset.save() so legacy ["Name", …] values become [{"name": "…", "orcid_id": ""}, …], including JSON-string inputs and paths that bypass forms (e.g. versioning). A new migrate_dataset_authors management command backfills existing rows (with --dry-run / --uuid), and get_authors_display() is hardened for string JSON. Tests cover save normalization and the command.

Gateway delivery adds a post-check job that builds and pushes ghcr.io/spectrumx/sds-gateway (dev, dev-<short-sha>) on default-branch pushes, plus a manual workflow to retag dev-<sha> as stable. Production compose now pulls that image (SDS_GATEWAY_TAG, default stable) for app and Celery services instead of local builds.

Workflows also bump common GitHub Actions (checkout, cache, uv pin, artifacts) and minor package.json formatting.

^{Reviewed by Cursor Bugbot for commit 2981058. Bugbot is set up for automated code reviews on this repo. Configure here.}

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
gateway/sds_gateway/api_methods/management/commands/migrate_dataset_authors.py	0% smaller
gateway/sds_gateway/api_methods/models.py	0% smaller

[cursor]

Promote tag SHA mismatch

Medium Severity

The promotion workflow uses the raw commit_sha input to find the dev- image tag. CI builds, however, tag images with a 7-character short SHA. This mismatch means if the input isn't the exact 7-character SHA, the image won't be found, and promotion will fail, even if the SHA is valid in Git.

 

^{Reviewed by Cursor Bugbot for commit 5dae463. Configure here.}

[cursor]

Migration drops dict co-authors

High Severity

The migrate_dataset_authors command can cause data loss. If a dataset's authors list contains a mix of string and dict entries, and the first entry is a string, the script's conversion logic only processes string elements. This drops any existing dict-formatted co-authors from the updated data, permanently removing their metadata, unlike Dataset.save() normalization.

 

^{Reviewed by Cursor Bugbot for commit 5abf551. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2981058. Configure here.}

[cursor]

Migration skips dict-first mixed

Medium Severity

_convert_legacy_authors returns early when authors[0] is a dict, so rows that still contain legacy string authors after the first entry are never updated. Dataset.save() would normalize those strings via _normalize_authors_list, but the bulk migration leaves them in the database.

 

^{Reviewed by Cursor Bugbot for commit 2981058. Configure here.}