fix: Always skip autoupdate-schedule = "never"

[Pavel Zwerschke (pavelzw)]

prompt:

❯ pixi run quant-ranger update --repository quantco/conda-deny pixi-update

  this produces weird results. also, for some reason quant-ranger still creates updates even though we set `[tool.update]` to never
  https://github.com/Quantco/conda-deny/blob/2369037a738616c217342df1b12e6330f68355c8/tests/test_lockfile_pattern/pixi.toml#L11
  https://github.com/Quantco/conda-deny/pull/162

🤖 yap

Problem

[tool.update] autoupdate-schedule = "never" was ignored unless --schedule was also passed, so unfiltered runs opened pull requests for repositories that had explicitly opted out.

Both pixi scanners guarded the comparison behind self.schedule is not None:

if self.schedule is not None and self.schedule != manifest.tool.update.autoupdate_schedule:

With no --schedule, no filtering happened at all. This was documented as intended behavior, but never is the one value that isn't a cadence, so it can never match a cadence filter — reading it as "never, unless nobody asked about schedules" is a footgun.

Real-world impact: Quantco/conda-deny#162–#165 were opened against four lockfiles that all had autoupdate-schedule = "never", set in Quantco/conda-deny#157.

Change

never is now an unconditional opt-out, honored with or without --schedule. The remaining values keep selecting a cadence, so --schedule weekly behaves exactly as before.

The same bug was present in pixi-version (_pixi_version.py:111) and is fixed alongside it.

• _pixi_update/_update.py, _pixi_version.py — check never before the cadence comparison
• cli_options.py, docs/contents/built-in-updaters/pixi.md, regenerated docs/contents/reference/cli.md
• One scanner test per updater

Verification

Both new tests fail without the fix and pass with it (verified via git stash, so they aren't vacuous). 561 tests pass; pixi run lint is clean.

Unfiltered dry run against the affected repository:

$ quant-ranger update --repository quantco/conda-deny --debug pixi-update
Skipping tests/test_default_use_case/pixi.lock: configured schedule is never.
Skipping tests/test_lockfile_pattern/pixi.lock: configured schedule is never.
Skipping tests/test_lockfile_pattern/subdir/pixi.lock: configured schedule is never.
Skipping tests/test_lockfile_pattern/subdir/another_subdir/pixi.lock: configured schedule is never.
Generated 1 update item.

All four pull requests above are no longer generated. The one remaining item is tests/pixi-build/pixi.lock, which has no [tool.update] section and so keeps the monthly default.

Out of scope

Those pull requests had No diff as their body, which is a separate bug left untouched here. _update.py:326 detects a no-op via output.stdout.strip() == "{}", but pixi 0.73 emits {"version": 1, "environment": {}}, making the UP_TO_DATE branch dead code. The file still changes because pixi update migrates the lockfile format (v6 → v7), producing a real git diff with an empty dependency diff.

conda-deny is unaffected now that its lockfiles are skipped, but any other repository with a version: 6 lockfile and an active schedule will still get one No diff pull request, and UP_TO_DATE is never reported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (fc8ed2f) to head (e474cba).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #21   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           48        49    +1     
  Lines         3067      3077   +10     
=========================================
+ Hits          3067      3077   +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.