ci(release): decide extras by dependence, sign the SBOM, correct the pin comment - #10
Merged
Conversation
…pin comment Follow-up to the release-pipeline repair, from a review of it. Four defects, each verified before changing anything. Pin comment: the bump replaced the 40-character SHA and left the trailing `# v3.0.0` sitting three lines below a new comment block asserting "Pinned at v3.5.0 deliberately". Confirmed against the upstream tags API -- 790bc6be is v3.5.0, f514d46b is v3.0.0 -- so the file contradicted itself. A pin normalizer that trusts the comment rewrites the SHA back to v3.0.0 and silently reinstates the TUF abort the bump exists to avoid. Extras: an empty `extra` makes `extra == "cli"` false, but it makes `extra in "cli"` *true*, because "" is a substring of every string. An extra-gated dependency written that way would be demanded, be correctly absent, and abort the release blaming the venv -- exactly the false-positive class this check was fixed to remove. Extras are now decided by whether the marker's answer depends on `extra` at all, which holds for every operator rather than for `==` alone. Marker exceptions: `Requirement(spec)` was guarded but `.evaluate()` was not, and packaging raises UndefinedComparison and UndefinedEnvironmentName at evaluate time rather than parse time. `a; sys_platform ~= "1.0"` parses cleanly and then raises, aborting with a bare traceback instead of the `::error::` annotation every other failure path here deliberately emits. Both are now caught and routed through fail(). SBOM signature: the document was attached to the release but never passed to the signing step, so the one artifact these checks exist to make trustworthy shipped unauthenticated beside two signed distributions. It is added to `inputs` on the release path only -- the repair path fetches from PyPI and has no SBOM, and a glob matching nothing is fatal to that action. Verified by building a wheel and running the script end to end: 18 components, correct root purl, and `packaging` still absent from the document, so the install-after-generation order still holds.
…ribed venv The previous commit installed packaging into the very venv the SBOM describes, after the document was written, on the argument that the ordering made it safe. Ordering keeps packaging out of the document; it does not keep the document true. Where packaging is already in the dependency closure -- verified in four of these repositories -- the install silently replaces the version the document has just recorded, and a project capping `packaging<26` would receive that replacement with every check still green. `uv run --with` layers the dependency onto the interpreter for the single call that needs it. Verified: the check still sees the venv's own site-packages, and the venv is byte-identical afterwards.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the release-pipeline repair, from a review of it. Five defects, each verified before anything changed.
Pin comment. The bump replaced the 40-character SHA and left the trailing
# v3.0.0, three lines under a new comment block asserting "Pinned at v3.5.0 deliberately." Confirmed against the upstream tags API —790bc6beis v3.5.0,f514d46bis v3.0.0 — so the file contradicted itself. A pin normalizer that trusts the comment rewrites the SHA back and silently reinstates theroot was signed by 0/3 keysabort the bump exists to avoid.Extras. An empty
extramakesextra == "cli"false, but it makesextra in "cli"true, because""is a substring of every string:An extra-gated dependency written that way is demanded, is correctly absent, and aborts the release blaming the venv — the exact false-positive class the previous fix set out to remove. Extras are now decided by whether the marker's answer depends on
extraat all, which holds for every operator rather than for==alone.Marker exceptions.
Requirement(spec)was guarded;.evaluate()was not. packaging raisesUndefinedComparisonandUndefinedEnvironmentNameat evaluate time, not parse time:That aborted with a bare traceback instead of the
::error::annotation every other failure path here emits. Both are now caught and routed throughfail().Venv mutation. packaging was installed into the very venv the SBOM describes, after the document was written, on the argument that the ordering made it safe. Ordering keeps packaging out of the document; it does not keep the document true. Where packaging is already in the closure — verified in four of these repositories — the install silently replaces a version the document has just recorded, and a project capping
packaging<26would get that replacement with every check still green. It is now overlaid withuv run --with, which leaves the venv byte-identical while the check still sees its site-packages.SBOM signature. The document was attached to the release but never passed to the signing step, so the one artifact these checks exist to make trustworthy shipped unauthenticated beside two signed distributions. Added to
inputson the release path only — the repair path fetches from PyPI and has no SBOM, and a glob matching nothing is fatal to that action.Verified by building a wheel and running the script end to end in this repository: 66 dependencies, correct root purl, and the venv left byte-identical by the overlay.