Repository navigation
ci: raise the pins that were measured and are safe to raise - #148
Merged
Merged
Conversation
Nineteen tool versions are pinned by hand across these reusables and nothing watches any of them. All nineteen were measured against upstream on 2026-08-24; eight had drifted. This raises the four that could be verified and records why the other four were left. Raised: - rust-supply-chain's toolchain, 1.97 to 1.98. This one is not routine maintenance. rust-ci and rust-audit were already on 1.98, so an SBOM was being produced by a compiler the test suite never ran — the defect podup#1487 recorded, reappearing across two reusables because the bump raised one and not the other and nothing compares them. podup has a test asserting its own two pins agree; nothing asserts it here, so the constraint is now a comment beside the input. - pytest, 8.4.0 to 9.1.1. A major, so it was run rather than assumed: differentially, both versions against this repository's own tests in a Python 3.12 container, which is what the runner ships. Identical failure sets — six in both, all `exit status 127` because `gh` is absent from the container, none attributable to pytest. No new failure. - cargo-about 0.9.1 to 0.9.2, and PyYAML 6.0.2 to 6.0.3. Patches. Left alone, with reasons: - ruff stays at 0.12.0. Measured: 0.16.4 reports 15 findings this repository does not have today. They are real, but they are code changes in five files rather than a version bump, and PLW1510 is a trap — it wants an explicit `check=` on `subprocess.run`, and the tests that trip it capture `returncode` deliberately, so `check=True` would break them. The reason is now a comment on the input. - bun 1.3.14 to 1.4.0, gosec v2.27.1 to v2.28.0, cargo-llvm-cov 0.8.7 to 0.9.0. Their consumers are epistle-panel, specio, authcore and five repositories respectively — none of which can be exercised from here, and a coverage tool's minor bump can move numbers into a threshold. Measured and reported rather than raised blind. Refs Glyndor/podup#1526 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Acts on Glyndor/podup#1526, which recorded that pinned tool versions here are watched by nothing. All of them are now measured; four are raised, four are deliberately not.
The full survey
Nineteen hand-typed versions across the reusables, measured against upstream on 2026-08-24. Eleven were already current — actionlint, shellcheck, govulncheck, cargo-audit, cargo-deny, cargo-semver-checks, cargo-fuzz, cargo-cyclonedx, python, and rust in
rust-ciandrust-audit.Eight had drifted:
rust-supply-chainpython-cirust-supply-chaindocs-currentpython-cibun-cigo-auditrust-ciThe rust one is not routine maintenance
rust-ciandrust-auditwere already on 1.98 whilerust-supply-chainsat on 1.97 — so an SBOM was being produced by a compiler the test suite never ran. That is the defect podup#1487 recorded, reappearing here because the bump raised one reusable and not the other and nothing compares them.podup has a test asserting its own two pins agree. Nothing asserts it across these two reusables, so the constraint is now a comment beside the input. A comment is weaker than a test; it is what exists today.
pytest 9 was run, not assumed
A major version of a test framework should not be taken on trust. Differential run of both versions against this repository's own tests, in a
python:3.12-slimcontainer because the runner ships 3.12:Both sets are the same six, all exit status 127 —
ghis absent from that container, which is my harness's limitation rather than a defect in either version. No new failure from pytest 9.The control mattered. My first reading was "six tests fail under pytest 9", which looked like the bump breaking things until the same six appeared under 8.4.0.
ruff is held, and the reason is now in the file
0.16.4 reports 15 findings this repository does not have at 0.12.0 — SIM115, PLW1510, EXE002, I001, UP034 and UP037 across
scripts/andtests/. They are real. They are also code changes in five files rather than a version bump, and one is a trap: PLW1510 wants an explicit check argument onsubprocess.run, and the tests that trip it capture the return code on purpose, socheck=Truewould break them andcheck=Falseis the correct fix. Raise ruff together with the fixes, not before.The other three are held because I cannot exercise them
bun-ciis consumed by epistle-panel and specio,go-auditby authcore,rust-ciby five repositories. None can be run from here, and a coverage tool's minor bump can move numbers into a threshold. Measured and reported rather than raised blind.What #1526 still asks for and this does not give
A watcher. podup got one for its own four pins; these nineteen still have none, and the survey above is a snapshot taken by hand, which is the exact failure the issue describes.