Repository navigation
0.3.2: upstream source diff, shared-dependency users, quieter check - #11
Merged
Merged
Conversation
A CI log for a dependency bump buried the one drifted patch in a table of every watched symbol, and the drift itself said little more than "body", so the reviewer still had to dig up the upstream change by hand. Hide ok rows behind a count (--all restores them), print the changed fields under each row and in the GitLab description, and anchor GitLab findings to the declaring call rather than the first string that happens to quote the target. mpat diff and check --diff now render the upstream source change in the style of a ty diagnostic. The lock keeps hashes only, so the locked side is downloaded from the package index the environment already uses and cached; nothing upstream gets committed. Index credentials are only ever sent to the index host, because private registries redirect downloads to signed object-storage URLs. Fetch failures degrade to a one-line notice and never change the exit code. A shared depends_on used to report its drift once, under whichever patch declared it first. Every declaration using a drifted target is now listed, and each gets its own GitLab finding. A symbol deleted upstream used to abort collection with exit 2 and an empty Code Quality report. Collection now defers the lookup and check() reports it as missing; outside collection it still raises. Docstring-only upstream edits get their own status so they are not triaged like code changes. The lock gains an optional code_hash; old locks keep reporting body until relocked, so the format version stays 1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a dependency-bump MR,
mpat checkprinted every watched symbol, named drift only by status, and aborted with exit 2 when a symbol was deleted upstream. Reviewers had to dig up the upstream change by hand and could miss other patches sharing a drifted dependency.N okcount;--allrestores the full table.mpat diff/mpat check --diff: ty-style diff of the upstream source between the locked and installed release. The locked side is downloaded from the configured index (UV_DEFAULT_INDEX,UV_INDEX_URL,PIP_INDEX_URL, else PyPI) and cached inMPAT_CACHE_DIR. Credentials go to the index host only, never across a redirect. Fetch failures never change the exit code.used_by) and gets its own GitLab finding.missinginstead of failing collection.patch()/watch()line.docstringstatus for docstring-only upstream edits (still exit 1). Lock gains optionalcode_hash; format version unchanged.Tests: 378 passing on 3.11-3.14, ruff/ty clean, mkdocs strict build clean, fetcher smoke-tested against real PyPI.