feat(ci): 锁集交叉约束检查，抓 issue #97 那类上界/通配冲突 - #98
Merged
Merged
Conversation
check_pin_floors.py（#81）只查「钉版 < 本项目声明的下界」，对 issue #97 的 四条冲突一条都抓不到——它们全是**上界与 ==X.* 型**违反： transformers==4.52.1 要求 tokenizers<0.22，锁里 0.23.2 sympy==1.14.0 要求 mpmath<1.4， 锁里 1.4.1 hydra-core/omegaconf 要求 antlr4-python3-runtime==4.9.*，锁里 4.13.2 新脚本按 PyPI requires_dist 逐条比对锁内包之间的约束（离线不可行，但不需要装任何东西， 也不需要那 3-4GB 轮子），网络取不到元数据时计入「未核验」并以退出码 2 报出， 绝不静默当通过。 挂到 pre-commit 的 local 段，`files:` 限定为四份依赖清单 —— 不新增每次提交的联网开销。 实测 `pre-commit run check-pin-crossconflicts --all-files` 在当前 main 上 **rc=1** 并逐条列出上述冲突（两份锁各一遍）。 自查修掉的两个假阳性：_OP_RE 的贪婪字符类先吃掉了 `1.*` 的点，导致 `httpx 要求 httpcore==1.*` 对 1.0.9 被误报为冲突；修字符类后 10 条降到 8 条 （= 4 类 × 2 份锁），无误报。测试里同时锁住该通配语义与一条已知的 rc 近似偏差。 7 个用例（含干净锁集 0 冲突、元数据不可达必须计入未核验）。 Signed-off-by: ReSerendipity <zengyangc@outlook.com>
ReSerendipity
enabled auto-merge
September 20, 2026 16:00
This was referenced Sep 20, 2026
This was referenced Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
补
check_pin_floors.py（#81）的盲区：下界检查抓不到 #97 那四条上界 /==X.*型违反（transformers↔tokenizers、sympy↔mpmath、hydra-core&omegaconf↔antlr4）。它做什么
读两份锁的
==钉版，按 PyPIrequires_dist逐条比对锁内包互相的约束是否成立。不需要装任何东西、不需要那 3-4GB 轮子，就能证伪"这套锁能解析"。网络取不到元数据的依赖计入「未核验」并以退出码 2 报出，不会静默当通过。
接入位置
pre-commit 的 local 段，
files:限定四份依赖清单 → 不增加日常提交的联网开销。实测证据
pre-commit run check-pin-crossconflicts --all-files在当前 main 上 rc=1，逐条列出 main 的便携锁集自相矛盾（#87 引入）：4 条可证明的约束违反，pip 解析不了 #97 的 4 类冲突 × 2 份锁 = 8 条。_OP_RE贪婪字符类吃掉了1.*的点，把httpx 要求 httpcore==1.*对 1.0.9 误判为冲突；修后 10 条 → 8 条。tests/test_check_pin_crossconflicts.py7 passed，含"干净锁集应 0 冲突"与"元数据不可达不得算通过"两条反向断言。合并后的影响（先说清）
锁集仍是 #97 那四条违反时，任何改动依赖清单的提交会被本地挡住——这正是目的。想先只报不拦，就给该 hook 加
verbose: true（pre-commit 会显示输出但不失败）。#88/#91/#89/#90 这批 dependabot PR 都改依赖清单，合并前建议先把 #97 解决掉。未包含
不在这个 PR 里改任何钉版；
mpmath/antlr4的回退与transformers/tokenizers的二选一按 #97 的算术走，需要一次便携包解析 + 真机加载验证。