[codex] harden dependency pin guard#194
Conversation
Co-Authored-By: Codex <noreply@openai.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc421b1529
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| QPK_PIN_URL = "https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/main/QPK_PIN" | ||
| QPK_REF_RE = re.compile(r"QuantPlatformKit\.git@([a-f0-9]{40})") | ||
| QSL_REF_RE = re.compile(r"github\.com/QuantStrategyLab/([A-Za-z0-9_.-]+)\.git@([A-Za-z0-9._/-]+)") |
There was a problem hiding this comment.
When a QuantStrategyLab dependency is changed to a moving ref such as @main in both requirements.txt and constraints.txt, this pattern records main as a valid ref and the later consistency check passes because there is only one unique ref; an unversioned URL without @<sha> is ignored entirely. That leaves deploys installing a changing commit even though constraints.txt declares git-based dependency SHAs as the source of truth, so the guard should fail refs that are not 40-hex SHAs instead of only comparing whatever token follows @.
Useful? React with 👍 / 👎.
| for m in QPK_REF_RE.finditer(content): | ||
| sha = m.group(1) | ||
| for line_no, line in enumerate(content.splitlines(), start=1): | ||
| for repo, ref in QSL_REF_RE.findall(line): |
There was a problem hiding this comment.
If a dependency file keeps an old QuantStrategyLab URL in a commented-out line, this still records its ref and can report drift against the active pin even though pip ignores that line. Because the new drift check runs the regex over every line rather than skipping lines whose first non-whitespace character is #, adding a commented example or temporarily disabled QSL dependency can block CI with a false mismatch.
Useful? React with 👍 / 👎.
1 participant
Summary
constraints*.txtin the scanned dependency filescontinue-on-errorWhy
A deployment can fail when
requirements.txtandconstraints.txtcarry different git refs for the same internal package. This hardens CI so that drift is caught before Docker/Cloud Run deploy.Validation
python3 scripts/check_qpk_pin_consistency.pypython3 -m pytest -q tests/test_dependency_pin_guard.pyactionlint .github/workflows/ci.ymlgit diff --check