Fix matrix index bounds validation

[ryanxw]

No description provided.

[Copilot]

Pull request overview

This PR tightens matrix index bounds validation across the C++ TinyMatrix API and the Python bindings for chi matrices, and adds regression tests to ensure out-of-range access raises the expected exceptions.

Changes:

• iqs::TinyMatrix::operator() now throws std::out_of_range instead of relying on assert for bounds enforcement.
• Pybind11 __getitem__ / __setitem__ for CM4x4 and CM16x16 now correctly validate indices (including negatives) and raise IndexError.
• Adds C++ and Python tests for out-of-range matrix access; updates Dockerfile to use keyrings instead of apt-key.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
include/tinymatrix.hpp	Switches TinyMatrix bounds checks from asserts to std::out_of_range throws.
unit_test/include/tinymatrix_test.hpp	Adds a unit test verifying out-of-range access throws for const/non-const matrices.
pybind11/intelqs_py.cpp	Fixes Python index validation for chi matrices and removes an unusable __getitem__ signature.
unit_test/import_iqs.py	Adds Python-level checks ensuring invalid indices raise IndexError.
Dockerfile	Replaces deprecated apt-key usage with a signed-by keyring setup for MKL repo.

Suppressed comments (1)

include/tinymatrix.hpp:157

• The non-const operator()(i,j) doc still lists only a precondition, but the function now throws std::out_of_range on invalid indices. Updating the comment helps keep the public API contract accurate.

  /// Access a matrix element.
  ///   \param i the row index
  ///   \param j the column index
  ///   \pre i<numRows() & j<numCols()

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Updated both accessor contracts to document std::out_of_range in commit aed9dc1.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Dockerfile:44

• apt-get install -y gpg is run without an apt-get update in the same layer. If earlier apt-get update layers are cached, package indexes can become stale and the build can fail when installing gpg (404s). Run apt-get update immediately before installing gpg (ideally in the same RUN instruction).

RUN apt-get install -y gpg

[giangiac]

It seems that the docker image contains an old version of cmake (3.15.2) while 3.16 is required.
It would be great if the CI/CD ran successfully.

[giangiac]

All changes are meaningful.