Repository navigation
ci: verify installed wheel outside the source checkout (#84) - #91
Merged
Merged
Conversation
Closed
6 tasks
This was referenced Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Editable source-tree tests can pass when a built distribution is incomplete or its metadata drifts. This change adds a separate ten-minute Ubuntu/Python 3.12 job that builds the exact PR head and exercises only the installed wheel from a fresh venv outside the checkout, using copied offline fixtures.
The stdlib-only gate checks source/wheel/imported/CLI versions, required wheel members, the console entry point, and the empty runtime dependency contract. It runs CLI help/version, core/work/code example verification and replay, and a fixture build/verify. Four damaged copies of the actual built wheel must be rejected: missing CLI, wrong version, a runtime dependency, and an extra-marker OR bypass. Complex dependency markers fail closed. Every subprocess is bounded. Scratch is removed on exit; no wheel/fixture artifacts are uploaded, and ordinary workflow logs use the repository's existing retention. Existing source-test jobs are unchanged.
Fixes #84 upon verified integration into
release/0.6.0. Base:22a2894057d9b1bc003efe4ef932ed4de601e26b; exact reviewed/tested head:0f7c65a230b0411571ef36decb4343f991cbb8f8. No runtime source/dependency or publication/release-acceptance change.Validation, 2026-10-24:
--no-index --no-depsin a fresh venv; isolated import, all seven offline commands and four damaged-wheel refusals passed.git archiveexport. No actionable findings. This is same-host agent/process independence, not separate credentials or formal forge approval; the reviewer did not independently run Ubuntu CI.git diff --checkpassed; worktree clean.macOS, other installed-wheel combinations and privileged path behavior remain unqualified. This gate neither publishes 0.6.0 nor accepts the unrelated pending #81–#90 release chain.