ci(deps): scope the root pip updater to declared dependencies - #348
Merged
Merged
Conversation
The `/` pip entry is documented as covering the runtime dependencies that ship inside the installed package — PyYAML and raes — but it reaches requirements/runtime.txt as well as pyproject.toml, and without an `allow` filter it raises a separate ungrouped PR for every transitive line in that lock. #298 (pygments), #299 (idna) and #300 (python-dotenv) were all opened that way and all three were closed unmerged. A single-lock PR like that cannot land. runtime.txt and pip-audit.txt are installed into one environment by ci.yml:audit, and runtime.txt and sbom.txt by release-please.yml:publish, so moving a shared package in one of them alone fails test_co_installed_locks_agree_on_shared_packages. Moving it in all of them duplicates half the /requirements batch and forces that PR to rebase. Splitting the transitive closure is exactly what the group above this entry exists to prevent; the `/` entry was quietly undoing it. `allow: dependency-type: direct` limits this entry to what pyproject declares, which is what its own comment already says it is for. The transitive closure stays the /requirements group's job. The z3-solver and pydantic-core ignores stay: the pip updater reads a locked line as a requested pin, so they are cheap insurance rather than redundancy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
/pip entry in.github/dependabot.ymlis documented as covering the runtime dependencies that ship inside the installed package (PyYAML, raes). It also reachesrequirements/runtime.txt, and with noallowfilter it raises a separate ungrouped PR for every transitive line in that lock. #298 (pygments), #299 (idna) and #300 (python-dotenv) were all opened that way, and all three were closed unmerged in favour of the grouped #344.Those PRs cannot land as raised:
runtime.txtandpip-audit.txtare installed into one environment byci.yml:audit;runtime.txtandsbom.txtbyrelease-please.yml:publish. Moving a shared package inruntime.txtalone failstest_co_installed_locks_agree_on_shared_packages— which is what happened on fix(deps): bump idna from 3.18 to 3.19 #299./requirementsbatch and forces that PR into a conflict rebase.Splitting the transitive closure across ungrouped PRs is precisely what the
/requirementsgroup exists to prevent — its own comment says so ("splitting the bumps would land halves that disagree and fail--require-hashes"). The/entry was quietly undoing that.What
allow: - dependency-type: "direct"on the/pip entry, limiting it to whatpyproject.tomldeclares — which is what its own comment already says it is for. The transitive closure stays the/requirementsgroup's job, batched and regenerated together.The
z3-solver/pydantic-coreignores stay. The pip updater reads a locked line as an independently requested pin, so they are cheap insurance rather than redundancy.Verification
tests/test_dependency_pinning.py,test_ci_topology.py,test_pr_title_guard.pyandtest_workflow_permissions.pyall pass. No lock file changes.