From e550b77a639e7a78768a1c5d129c0196a0e6fb65 Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Sat, 14 Nov 2026 20:25:32 +0000 Subject: [PATCH 1/2] ci(conda-lock): install py-rattler and pyyaml from a hashed tool lock (#681) The conda-lock refresh job holds contents: write, pull-requests: write and CONDA_LOCK_TOKEN, and the code it installs writes the lock the PR proposes, but it ran `pip install "py-rattler ==0.28.1" "pyyaml ==6.0.3"`: the versions were pinned, the file hashes and every transitive dependency were not. dokimi/requirements-conda-lock.txt now names the two exact pins and dokimi/requirements-conda-lock.lock.txt is their `uv pip compile --universal --generate-hashes --exclude-newer=P7D` output, for the job's Python 3.14. conda-lock.yml installs it with `pip install --no-deps --require-hashes -r dokimi/requirements-conda-lock.lock.txt`, a path relative to the repo root the job runs from. Renovate's pip-compile manager now covers the lock, so it re-runs the lock's header command on a bump, and the regex manager that read the pins out of conda-lock.yml is removed. pip-audit.yml audits the lock, .licenserc.yaml exempts it from the header as the sibling locks are, and ci/lock.py and ci/README.md name the lock instead of an unhashed install. tests/test_dependency_locks.py puts the lock through the checks the sibling locks have (header form, hashes, cooldown, pip-audit) and adds tests that its pins are the input's, that conda-lock.yml installs it with --require-hashes, that no workflow installs py-rattler without hashes, and that Renovate's pip-compile pattern matches it while no regex manager names conda-lock.yml. Signed-off-by: Anton Volkov --- .github/.licenserc.yaml | 1 + .github/renovate.json5 | 14 +--- .github/workflows/conda-lock.yml | 4 +- .github/workflows/pip-audit.yml | 2 +- ci/README.md | 4 +- ci/lock.py | 2 +- dokimi/requirements-conda-lock.lock.txt | 97 +++++++++++++++++++++++++ dokimi/requirements-conda-lock.txt | 7 ++ dokimi/tests/test_dependency_locks.py | 52 +++++++++++++ 9 files changed, 167 insertions(+), 16 deletions(-) create mode 100644 dokimi/requirements-conda-lock.lock.txt create mode 100644 dokimi/requirements-conda-lock.txt diff --git a/.github/.licenserc.yaml b/.github/.licenserc.yaml index dff08ffea..3738da36e 100644 --- a/.github/.licenserc.yaml +++ b/.github/.licenserc.yaml @@ -45,6 +45,7 @@ header: - 'dokimi/requirements.lock.txt' - 'dokimi/requirements-docs.lock.txt' - 'dokimi/requirements-ci.lock.txt' + - 'dokimi/requirements-conda-lock.lock.txt' - 'dokimi/requirements-mutation.lock.txt' - 'dokimi/requirements-fuzz.lock.txt' - 'dokimi/fuzz/corpus/**' diff --git a/.github/renovate.json5 b/.github/renovate.json5 index ec0b7973a..e980d18dd 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -4,8 +4,9 @@ // Dependency updates: the SHA-pinned actions in .github/workflows, the Python // lock (dokimi/requirements.lock.txt), the tools lock the workflows and the eval // image (.agent-eval/Dockerfile) install (dokimi/requirements-ci.lock.txt), the -// docs lock (dokimi/requirements-docs.lock.txt) and the hook revs in -// .pre-commit-config.yaml. +// docs lock (dokimi/requirements-docs.lock.txt), the py-rattler and PyYAML lock +// conda-lock.yml installs (dokimi/requirements-conda-lock.lock.txt) and the hook +// revs in .pre-commit-config.yaml. // // Once a week, every minor and patch update lands in one PR; a major update // gets a PR of its own. Advisories (vulnerabilityAlerts) skip the schedule. @@ -53,7 +54,7 @@ // and updates the SHA and the tag together. "pre-commit": { enabled: true }, "pip-compile": { - managerFilePatterns: ["/(^|/)requirements(-ci|-docs|-mutation|-fuzz)?\\.lock\\.txt$/"], + managerFilePatterns: ["/(^|/)requirements(-ci|-docs|-mutation|-fuzz|-conda-lock)?\\.lock\\.txt$/"], }, // Inside a range: bump the lock only. Outside it: move the range too. rangeStrategy: "update-lockfile", @@ -95,13 +96,6 @@ datasourceTemplate: "github-releases", versioningTemplate: "regex:^(?\\d+)\\.(?\\d+)\\.(?\\d+)-(?\\d+)$", }, - { - // The py-rattler and PyYAML conda-lock.yml installs to solve ci/conda-lock/. - customType: "regex", - managerFilePatterns: ["/^\\.github/workflows/conda-lock\\.yml$/"], - matchStrings: ["\"(?[A-Za-z0-9._-]+) ==(?\\d[^\" ]*)\""], - datasourceTemplate: "pypi", - }, { // The Miniforge release intel-ci.yml's jobs install, all in one PR; // tags carry a build number (26.7.2-0), as micromamba's do. diff --git a/.github/workflows/conda-lock.yml b/.github/workflows/conda-lock.yml index ca5450d00..55fe52729 100644 --- a/.github/workflows/conda-lock.yml +++ b/.github/workflows/conda-lock.yml @@ -38,9 +38,9 @@ jobs: with: python-version: "3.14" - # Renovate bumps both pins (.github/renovate.json5). + # Hash-locked, so nothing this job runs is unhashed; Renovate re-compiles the lock (.github/renovate.json5). - name: Install py-rattler - run: python -m pip install --no-input "py-rattler ==0.28.1" "pyyaml ==6.0.3" + run: python -m pip install --no-input --no-deps --require-hashes -r dokimi/requirements-conda-lock.lock.txt - name: Solve the locks run: python ci/lock.py diff --git a/.github/workflows/pip-audit.yml b/.github/workflows/pip-audit.yml index 31867441c..a6649ed8a 100644 --- a/.github/workflows/pip-audit.yml +++ b/.github/workflows/pip-audit.yml @@ -54,7 +54,7 @@ jobs: run: | sed -e 's/ *\\$//' -e 's/ *;.*//' \ requirements.lock.txt requirements-docs.lock.txt requirements-ci.lock.txt \ - requirements-mutation.lock.txt requirements-fuzz.lock.txt | sort -u \ + requirements-mutation.lock.txt requirements-fuzz.lock.txt requirements-conda-lock.lock.txt | sort -u \ | awk -F'==' '/^[A-Za-z0-9]/ { print > (ENVIRON["RUNNER_TEMP"] "/pins" seen[$1]++ ".txt") }' for f in "$RUNNER_TEMP"/pins*.txt; do pip-audit -r "$f" --no-deps --disable-pip --progress-spinner off diff --git a/ci/README.md b/ci/README.md index 2295a8459..99db1a29f 100644 --- a/ci/README.md +++ b/ci/README.md @@ -16,7 +16,7 @@ SPDX-License-Identifier: Apache-2.0 | `matrix.py` | Reads the platforms and Python versions from the recipe, or with `--system wheel` from `dokimi/pyproject.toml`. A pull request gets the oldest and the newest versions. | | `build.py` | Builds one Python version: with conda-build, which runs the recipe's own tests unless `--no-test` is given, or with `--system wheel` with `pip wheel`. | | `hooks.py` | The workflow's test jobs: installs one package into a clean environment with the requirements in `config.yml`, and runs `test.py`. A conda package's environment comes from that Python's lock in `conda-lock/`; it installs the package without dependencies, fails if the lock does not satisfy them, and runs the recipe's tests. A wheel's has only Python from conda-forge and everything else from PyPI, pinned by `dokimi/requirements.lock.txt`. A release tag and the weekly run resolve the latest releases instead, from conda-forge and PyPI. | -| `lock.py` | Writes `conda-lock/linux-64-py.txt` for each Python version the recipe declares: the conda-forge builds that the recipe's run and test requirements and `config.yml`'s test list resolve to, taking only builds at least 7 days old; run from any operating system, it targets linux-64, and a run without `--python` removes the `linux-64` locks of versions the recipe no longer declares. It solves with py-rattler (`pip install py-rattler`), as conda cannot leave out the newer builds. Each lock's header names its specs, and `dokimi/tests/test_intel_ci_conda_lock.py` fails when they no longer match. | +| `lock.py` | Writes `conda-lock/linux-64-py.txt` for each Python version the recipe declares: the conda-forge builds that the recipe's run and test requirements and `config.yml`'s test list resolve to, taking only builds at least 7 days old; run from any operating system, it targets linux-64, and a run without `--python` removes the `linux-64` locks of versions the recipe no longer declares. It solves with py-rattler (hash-locked with PyYAML in `dokimi/requirements-conda-lock.lock.txt`, which `conda-lock.yml` installs with `--require-hashes`), as conda cannot leave out the newer builds. Each lock's header names its specs, and `dokimi/tests/test_intel_ci_conda_lock.py` fails when they no longer match. | | `config.yml` | Names the workflow that builds the packages, its artifact names, and what the tests need. | | `test.py` | Runs dokimi's own test suite, `dokimi/tests`, from the checkout against the installed package. | @@ -28,7 +28,7 @@ SPDX-License-Identifier: Apache-2.0 **A push to `main`, a tag, or the weekly run.** Actions builds and tests every declared version: a push in the locked environments, a tag and the weekly run on the latest releases. -**A change to the recipe's requirements or to `config.yml`'s test list** needs its locks re-solved in the same PR: `pip install py-rattler pyyaml`, then `python ci/lock.py`. Renovate cannot run it, so a Renovate PR that bumps a `config.yml` pin (the `mypy` one) fails `dokimi/tests/test_intel_ci_conda_lock.py` until the re-solved locks are committed to its branch. +**A change to the recipe's requirements or to `config.yml`'s test list** needs its locks re-solved in the same PR: `pip install --no-deps --require-hashes -r dokimi/requirements-conda-lock.lock.txt`, then `python ci/lock.py`. Renovate cannot run it, so a Renovate PR that bumps a `config.yml` pin (the `mypy` one) fails `dokimi/tests/test_intel_ci_conda_lock.py` until the re-solved locks are committed to its branch. To support another Python, add it to `conda-recipe/conda_build_config.yaml` for the conda package and as a classifier in `dokimi/pyproject.toml` for the wheel; nothing else lists versions. Try it locally from a conda base environment with conda-build: diff --git a/ci/lock.py b/ci/lock.py index 27d9d0f16..50dc18682 100644 --- a/ci/lock.py +++ b/ci/lock.py @@ -14,7 +14,7 @@ It solves with py-rattler, which conda's solver cannot do: conda has no option that leaves out the builds newer than a date. Usage, from a Python with -py-rattler and PyYAML (the version .github/workflows/conda-lock.yml installs): +py-rattler and PyYAML (the versions dokimi/requirements-conda-lock.lock.txt pins): python ci/lock.py [--python 3.14 ...] [--min-age-days 7] """ diff --git a/dokimi/requirements-conda-lock.lock.txt b/dokimi/requirements-conda-lock.lock.txt new file mode 100644 index 000000000..12354d99a --- /dev/null +++ b/dokimi/requirements-conda-lock.lock.txt @@ -0,0 +1,97 @@ +# This file was autogenerated by uv via the following command: +# uv pip compile requirements-conda-lock.txt --universal --python-version=3.14 --exclude-newer=P7D --generate-hashes --output-file=requirements-conda-lock.lock.txt +py-rattler==0.28.1 \ + --hash=sha256:0548fbfa217bbc0e7202e9e161b1dcaf95487cd7bbac389da52354a05da4abe7 \ + --hash=sha256:0dc8546f11e06bc4b9057a714cdfd8b51c2aa1c741724eadbbc1acdc0f1a8ceb \ + --hash=sha256:1c6729aeff2c9134ef93da607790ee353bfff3881157297a5b944609b246cd7d \ + --hash=sha256:3f4acd7926ec97684a4667c64159e494c76bc2971fcb647a9dc0d82328e87376 \ + --hash=sha256:54d6d8602bf9751c8ec9d14ebb3e9b568aaa2acac25fd9ca95e203108de29028 \ + --hash=sha256:6bcbe64fb0aa98a19b61fefd4a6d085dec9f5f64ce336b931883cda4718a4c82 \ + --hash=sha256:6d036f7a48d375cf878b75de0c746c61de060dedd699096fa0189095ebf276a5 \ + --hash=sha256:7077a180d8e878d5794c5ed8000c87b1042c9c91cf6295fb386cec0f7e4a9509 \ + --hash=sha256:92001ee75e5a0d47b6aad0b7c4f76b746015785bdb06ab2851002540ffc767e5 \ + --hash=sha256:9f2618356a426511be8e48344a075c4f3c5b4e889122e9b605062170ffd7036d \ + --hash=sha256:bd9d8baaf4b7027a8e250583fa8d1ff6ae31b9928967a5751cf471cd13737254 \ + --hash=sha256:c97a83070dfac0d0f339888074f223153f43c0a66a224913abd525b8c2294f2d \ + --hash=sha256:cd7b2fdce956cb0b4f13e7797f4bfe6e0641d6f4c99be0711bd21f1e2d89f634 \ + --hash=sha256:d3d05c6b0004bcbd4efe45ffc3c26350548862e128c5355315399a4c0ee922c0 \ + --hash=sha256:d8b272045ee3a9bc948cc6f3edcb408df83276baec18b91775d07a621b1653bb \ + --hash=sha256:e82ef5201515b7472bba28aac714a5acb6030518b664662d7ee48d4b65e40554 \ + --hash=sha256:f5a5b9ee088c971a65e953d6f2ade761f964314c97446309303314d245f4203f \ + --hash=sha256:fc343ef375e802475883b11b85da2f3c7c9d06be30bb09f44b2017309828ac49 + # via -r requirements-conda-lock.txt +pyyaml==6.0.3 \ + --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \ + --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \ + --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \ + --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \ + --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \ + --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \ + --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \ + --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \ + --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \ + --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \ + --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \ + --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \ + --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \ + --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \ + --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \ + --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \ + --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \ + --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \ + --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \ + --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \ + --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \ + --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \ + --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \ + --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \ + --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \ + --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \ + --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \ + --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \ + --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \ + --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \ + --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \ + --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \ + --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \ + --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \ + --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \ + --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \ + --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \ + --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \ + --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \ + --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \ + --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \ + --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \ + --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \ + --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \ + --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \ + --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \ + --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \ + --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \ + --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \ + --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \ + --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \ + --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \ + --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \ + --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \ + --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \ + --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \ + --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \ + --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \ + --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \ + --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \ + --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \ + --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \ + --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \ + --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \ + --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \ + --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \ + --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \ + --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \ + --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \ + --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \ + --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \ + --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \ + --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0 + # via -r requirements-conda-lock.txt diff --git a/dokimi/requirements-conda-lock.txt b/dokimi/requirements-conda-lock.txt new file mode 100644 index 000000000..8210b163b --- /dev/null +++ b/dokimi/requirements-conda-lock.txt @@ -0,0 +1,7 @@ +# Copyright (C) 2026 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +# The two tools .github/workflows/conda-lock.yml installs to solve ci/conda-lock/; hash-locked in requirements-conda-lock.lock.txt. +# That job holds a write token and the code it installs writes the lock a PR proposes, so nothing it installs is left unhashed. +py-rattler==0.28.1 +pyyaml==6.0.3 diff --git a/dokimi/tests/test_dependency_locks.py b/dokimi/tests/test_dependency_locks.py index f11c7b340..974366b1c 100644 --- a/dokimi/tests/test_dependency_locks.py +++ b/dokimi/tests/test_dependency_locks.py @@ -23,6 +23,7 @@ "requirements-docs.lock.txt", "requirements-mutation.lock.txt", "requirements-fuzz.lock.txt", + "requirements-conda-lock.lock.txt", ) # Installed together with --require-hashes (ci.yml, docs.yml, .agent-eval/Dockerfile, # make dev), so a pin both carry has to be the same version. @@ -42,6 +43,7 @@ "requirements-docs.lock.txt", "requirements-mutation.lock.txt", "requirements-fuzz.lock.txt", + "requirements-conda-lock.lock.txt", ) # Where the stacked locks are installed: CI's Pythons, and make dev on any OS. ENVIRONMENTS = [ @@ -193,6 +195,56 @@ def test_tools_lock_has_every_requested_pin() -> None: ) +def test_conda_lock_tool_lock_is_the_compile_of_its_input() -> None: + """conda-lock.yml's job holds a write token: the lock holds exactly the input's pins, nothing transitive and unhashed.""" + requested = pins("requirements-conda-lock.txt") + assert set(requested) == {"py-rattler", "pyyaml"}, requested + assert pins("requirements-conda-lock.lock.txt") == requested + assert header_command("requirements-conda-lock.lock.txt")[3] == "requirements-conda-lock.txt" + + +def _conda_lock_install_step() -> str: + workflow = yaml.safe_load((ROOT.parent / ".github/workflows/conda-lock.yml").read_text(encoding="utf-8")) + (run,) = [s["run"] for s in workflow["jobs"]["refresh"]["steps"] if s.get("name") == "Install py-rattler"] + return run + + +def test_conda_lock_job_installs_its_tools_from_the_hashed_lock() -> None: + """The job runs from the repo root, so the path is repo-relative; --no-deps keeps pip from resolving past the lock.""" + args = _conda_lock_install_step().split() + assert "--require-hashes" in args and "--no-deps" in args, args + lock = args[args.index("-r") + 1] + assert lock == "dokimi/requirements-conda-lock.lock.txt" + assert (ROOT.parent / lock).is_file() + + +def test_no_workflow_installs_py_rattler_without_hashes() -> None: + """A `pip install py-rattler` by name, in conda-lock.yml or a later workflow, must carry --require-hashes.""" + installs = [] + for path in sorted((ROOT.parent / ".github/workflows").glob("*.y*ml")): + text = path.read_text(encoding="utf-8").replace("\\\n", " ") + installs += [(path.name, line.strip()) for line in text.splitlines() if "pip install" in line and "rattler" in line] + unhashed = [i for i in installs if "--require-hashes" not in i[1]] + assert not unhashed, unhashed + + +def _renovate_file_patterns() -> list[str]: + text = (ROOT.parent / ".github" / "renovate.json5").read_text(encoding="utf-8") + return re.findall(r"managerFilePatterns:\s*\[([^\]]*)\]", text) + + +def test_renovate_recompiles_the_conda_lock_tool_lock() -> None: + """The pip-compile manager reads the lock (and re-runs its header); no regex manager reads the pins out of conda-lock.yml.""" + patterns = _renovate_file_patterns() + (pip_compile,) = [p for p in patterns if "lock" in p and "requirements" in p] + regex = re.search(r'"/(.*)/"', pip_compile) + assert regex, pip_compile + pattern = re.compile(regex[1].replace("\\\\", "\\")) + assert pattern.search("dokimi/requirements-conda-lock.lock.txt") + assert not pattern.search("dokimi/requirements-conda-lock.txt") + assert not [p for p in patterns if "conda-lock" in p and "requirements" not in p], patterns + + @pytest.mark.parametrize(("base", "name"), STACKED_LOCKS) def test_stacked_lock_pins_agree(base: str, name: str) -> None: """A refresh of one lock alone makes `pip install -r -r ` unresolvable.""" From 0b91ff1a41317a9d75dacb6632b020f371369673 Mon Sep 17 00:00:00 2001 From: vchamarthi <123653452+vchamarthi@users.noreply.github.com> Date: Sat, 14 Nov 2026 15:34:19 -0600 Subject: [PATCH 2/2] fix(docs): list the conda-lock lock where pip-audit coverage is documented SECURITY.md named five locks pip-audit covers and omitted requirements-conda-lock.lock.txt, which pip-audit.yml audits. CONTRIBUTING.md did not mention the lock at all. A test now fails when a renovated lock is missing from SECURITY.md, and the advisory-list test matches the new wording of the no-advisory sentence. Signed-off-by: vchamarthi <123653452+vchamarthi@users.noreply.github.com> --- dokimi/CONTRIBUTING.md | 4 +++- dokimi/SECURITY.md | 4 ++-- dokimi/tests/test_advisory_lists.py | 2 +- dokimi/tests/test_dependency_locks.py | 6 ++++++ 4 files changed, 12 insertions(+), 4 deletions(-) diff --git a/dokimi/CONTRIBUTING.md b/dokimi/CONTRIBUTING.md index dfe2ead6b..9c656bd38 100644 --- a/dokimi/CONTRIBUTING.md +++ b/dokimi/CONTRIBUTING.md @@ -193,7 +193,9 @@ so the published sdist and wheel are not built by a backend resolved fresh from PyPI. The mutation workflow adds mutmut's closure (`requirements-mutation.txt`) from `requirements-mutation.lock.txt`, and the fuzz workflow atheris from `requirements-fuzz.lock.txt` (compiled for Linux -x86_64: atheris has no sdist), which nothing else installs, and pip-audit audits with the others. When you change a range in +x86_64: atheris has no sdist), which nothing else installs, and pip-audit audits with the others. The conda-lock workflow installs py-rattler and PyYAML +(`requirements-conda-lock.txt`) from `requirements-conda-lock.lock.txt` with +`--no-deps --require-hashes`. When you change a range in `requirements*.txt`, regenerate the lock with the command in its header: run it from `dokimi/`, and add `--upgrade` to pick up new versions (without it, uv keeps the current pins). The main and tools lock headers pass diff --git a/dokimi/SECURITY.md b/dokimi/SECURITY.md index 85c61da17..9b14ef776 100644 --- a/dokimi/SECURITY.md +++ b/dokimi/SECURITY.md @@ -46,8 +46,8 @@ The project is pre-1.0; only the latest `main` is supported. Fixes land on `pip-audit` against the locks (`requirements.lock.txt`, `requirements-docs.lock.txt`, `requirements-ci.lock.txt`, -`requirements-mutation.lock.txt` and `requirements-fuzz.lock.txt`) reports no -advisory. +`requirements-mutation.lock.txt`, `requirements-fuzz.lock.txt` and +`requirements-conda-lock.lock.txt`) reports no advisory. The locks pin filelock 4.2.4 although every litellm release up to 1.106.6 declares `filelock<4.0`. filelock 3.32.7, the newest version under that cap, has diff --git a/dokimi/tests/test_advisory_lists.py b/dokimi/tests/test_advisory_lists.py index 1cc4bf0a1..8452d8ddc 100644 --- a/dokimi/tests/test_advisory_lists.py +++ b/dokimi/tests/test_advisory_lists.py @@ -77,7 +77,7 @@ def test_security_documents_every_ignored_id(): ) -NO_LOCK_ADVISORY = "`requirements-fuzz.lock.txt`) reports no\nadvisory." +NO_LOCK_ADVISORY = "`requirements-conda-lock.lock.txt`) reports no advisory." def _lock_advisory_list() -> str: diff --git a/dokimi/tests/test_dependency_locks.py b/dokimi/tests/test_dependency_locks.py index 974366b1c..10d73a175 100644 --- a/dokimi/tests/test_dependency_locks.py +++ b/dokimi/tests/test_dependency_locks.py @@ -336,3 +336,9 @@ def test_a_replacement_update_is_exempt_from_the_release_age_wait() -> None: assert len(exempt) == 1, exempt assert 'matchManagers: ["github-actions"]' in exempt[0] assert 'matchUpdateTypes: ["replacement"]' in exempt[0] + + +def test_security_md_names_every_audited_lock() -> None: + """SECURITY.md says which locks pip-audit covers: every renovated lock is listed.""" + text = (ROOT / "SECURITY.md").read_text(encoding="utf-8") + assert [lock for lock in RENOVATE_LOCKS if f"`{lock}`" not in text] == []