ci: hash-pin the release path - #168
Merged
Merged
Conversation
I said earlier that integrations' installs track latest releases on purpose and left the whole repo alone. That was too broad. Most of these lines carry exact version pins already; only a few are deliberately floating, and the release path is not among them. Three locks, covering the jobs that build and upload to PyPI and the one that verifies the published artifact's attestations. Those are the most consequential unpinned resolutions in the repo: capture-core-publish and trace-adapters-publish fetch build and twine into a job holding publishing credentials. The wheels under test stay unpinned, deliberately. A smoke test exists to exercise what was just built, and the provenance job exists to check the version that was actually released, so pinning either would defeat the check. What moves into locks is the harness around them: pytest, agentrust-trace-tests, and the attestation verifier. Those install first with --require-hashes, then the subject goes in with --no-deps so it cannot drag an unpinned dependency behind it. Verified in clean venvs: all three locks install under --require-hashes, the smoke venv has pytest 9.1.1 and the trace-tests CLI, and build and twine import. The remaining pip installs in this repo are the per-integration conformance jobs. Those are a larger job and a separate change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Correcting myself. When I finished the pinning track I said integrations' installs "track latest releases on purpose" and left the repo alone. That was too broad — most of these lines carry exact version pins already, and only a few are genuinely floating. The release path is not among them.
What this pins
Three locks, covering the jobs that build and upload to PyPI and the one that verifies the published artifact's attestations:
release.txtcapture-core-publish,trace-adapters-publish—build+twineprovenance.txttrace-adapters-verify-provenance—pypi-attestationssmoke.txtpytest,agentrust-trace-testspip install build twinein a job that holds publishing credentials is the most consequential unpinned resolution in this repo, which is why it goes first.What stays unpinned, on purpose
The wheels under test. A smoke test exists to exercise what was just built, and the provenance job exists to check the version that was actually released. Pinning either would defeat the check it performs.
What changes is the ordering: the harness installs first with
--require-hashes, then the subject goes in with--no-deps, so the thing being tested cannot drag an unpinned dependency in behind it.Verification
Clean venvs for each lock: all three install under
--require-hashes, the smoke venv has pytest 9.1.1 and thetrace-testsCLI on PATH, andbuildandtwineimport. actionlint clean.Not in this PR
The per-integration conformance jobs (google-adk, langchain, openai-agents, pydantic-ai and the rest) are a larger job with one lock per framework. Worth doing, but as its own change rather than buried in this one.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t