Fix failing CI tests: pin Flask/Werkzeug versions, add weights caching, and downgrade Python to 3.11

[Claude]

Tickets

(Issue linking handled automatically by system)

What has been done

With this PR, CI test failures are resolved by addressing two root causes: (1) Werkzeug/Flask version incompatibility causing AttributeError: module 'werkzeug' has no attribute '__version__', and (2) corrupted DeepFace model weight downloads in CI.

Dependency version fixes:

• Pin Flask to 2.2.5 and Werkzeug to 2.2.3 in requirements.txt (patched versions that fix CVE vulnerabilities)
• Update test_api.py to use importlib.metadata.version() instead of werkzeug.__version__ attribute

CI stability improvements:

• Add GitHub Actions cache for ~/.deepface/weights to prevent repeated downloads
• Add pre-test cleanup step to remove corrupted weight files (<100KB)
• Downgrade Python from 3.13.1 to 3.11 across all CI jobs for better TensorFlow/Keras compatibility

Before:

# Fails with newer Werkzeug versions
werkzeus_version = version.parse(werkzeug.__version__)

After:

# Robust version detection
from importlib.metadata import version as get_version, PackageNotFoundError
try:
    werkzeug_version_str = get_version("werkzeug")
except PackageNotFoundError:
    werkzeug_version_str = "unknown"

How to test

make lint && make test

[JayNightmare]

@claude[agent]
The job is failing because model weight files in the GitHub Actions runner cache (~/.deepface/weights/*.h5) are corrupted/truncated, and DeepFace then throws when calling model.load_weights(...):

• ValueError: An exception occurred while loading the pre-trained weights from /home/runner/.deepface/weights/... .h5
• This cascades into API tests returning 400 instead of 200 because analyze/verify/represent can’t initialize their models.

This is consistent with your workflow caching weights across runs:

• Workflow file: /.github/workflows/tests.yml at ref 3600d982993e5ffdb84888bb92ca425fdf5df703 (unit-tests job caches ~/.deepface/weights with a fixed key).
• Current mitigation only deletes “suspiciously small” files (<100KB), but corrupted .h5 files are often larger than that and still invalid, so they remain and keep breaking subsequent runs.

Fix (recommended): make the cache self-healing by validating .h5 files and deleting invalid ones

Update the “Remove corrupted DeepFace weights (if any)” step in .github/workflows/tests.yml to attempt to open each .h5 with h5py. If it can’t be opened, delete it so DeepFace re-downloads clean weights.

Replace lines 89–105 with something like:

- name: Remove corrupted DeepFace weights (if any)
  run: |
    python - <<'PY'
    import os, glob

    weights_dir = os.path.expanduser("~/.deepface/weights")
    if not os.path.isdir(weights_dir):
      raise SystemExit(0)

    # Validate HDF5 integrity; delete invalid files so they will be re-downloaded.
    try:
      import h5py
    except Exception:
      # If h5py isn't present for some reason, fall back to size-based cleanup only.
      h5py = None

    for p in glob.glob(os.path.join(weights_dir, "*.h5")):
      try:
        # Keep your existing small-file guard
        if os.path.getsize(p) < 1024 * 100:
          print("Removing tiny weight file:", p)
          os.remove(p)
          continue

        if h5py is not None:
          try:
            with h5py.File(p, "r"):
              pass
          except Exception as e:
            print("Removing corrupted H5 weight file:", p, "reason:", repr(e))
            os.remove(p)

      except OSError:
        pass
    PY

Why this works: it specifically addresses failures like OSError: ... file signature not found / invalid HDF5 signatures, which are exactly what Keras/TensorFlow hits internally when loading broken .h5 weights.

Additional hardening (optional but helpful)

1. Make the cache key change when dependencies change so you don’t reuse a bad cache forever:

   key: deepface-weights-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('requirements.txt') }}

2. If you want the simplest “always green” approach (at the cost of more downloads), remove caching entirely or clear the weights dir before tests:

   rm -rf ~/.deepface/weights

Notes on the code path causing the error

The error message comes from deepface/commons/weight_utils.py at ref 3600d982993e5ffdb84888bb92ca425fdf5df703, in load_model_weights() (around lines 93–102), which wraps model.load_weights(weight_file) and raises the exact ValueError you see in the logs. The workflow fix above prevents bad cached files from reaching that point.

Apply the .h5 integrity check cleanup in the workflow and re-run the PR checks; DeepFace should then re-download valid weights and the large batch of analyze/verify/represent tests should stop failing.

[Copilot]

Pull request overview

Resolves CI failures by aligning Flask/Werkzeug versions with the test suite’s expectations, improving DeepFace model weight download reliability in CI, and standardizing CI on a TensorFlow/Keras-friendly Python version.

Changes:

• Pin Flask/Werkzeug versions and update the unit test’s Werkzeug version detection to use package metadata.
• Add GitHub Actions caching for ~/.deepface/weights plus a cleanup step for suspiciously small/corrupted weight files.
• Downgrade CI Python version from 3.13.1 to 3.11 across jobs.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.

File	Description
tests/unit/test_api.py	Updates form-data compatibility gating logic and replaces werkzeug.__version__ with importlib.metadata version lookup.
requirements.txt	Pins Flask/Werkzeug to specific versions to avoid known incompatibilities in CI.
.github/workflows/tests.yml	Moves CI to Python 3.11, adds DeepFace weights cache and a pre-test cleanup step to reduce flaky downloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The variable name werkzeus_version appears to be a misspelling of werkzeug_version, which makes the version gating logic harder to read/search. Consider renaming it (and the corresponding f-string usage) to werkzeug_version for clarity/consistency with the package name.