Updating new-resolver-config branch to latest main - #1304
Merged
Conversation
Resolution failures are logged with a package-name prefix derived from requirement_ctxvar, which reflects whatever package happens to be active in the logging context when the exception is finally reported - not necessarily the package whose requirement actually conflicted. When a transitive dependency several levels deep fails to resolve (e.g. its-hub -> reward-hub -> vllm -> flashinfer-python), the error message correctly names the failing package but the log prefix can show an unrelated top-level package, making it look like that top-level package is the culprit when the real conflict originates further down the chain. See #1242 for the log-prefix problem itself, tracked separately since it requires changes to shared logging infrastructure used by every bootstrap phase, not just resolution. WorkItem already tracks the full dependency chain via why_snapshot. _handle_phase_error() is the centralized handler for errors from every bootstrap phase, so a new _enrich_resolution_error() helper attaches that chain to any RESOLVE-phase failure with a non-empty why_snapshot, regardless of exception type, before test-mode/multiple-versions recording or the final raise. For example: Unable to resolve requirement specifier flashinfer-python==0.6.8.post1 with constraint flashinfer-python==0.6.11.post2 using PyPI resolver: found no match for flashinfer-python==0.6.8.post1 (dependency chain: its-hub==1.0 -> reward-hub==2.0 -> vllm==3.0 -> flashinfer-python==0.6.8.post1) type(err)(msg) isn't safe for arbitrary exception classes, so the helper uses explicit isinstance checks (ResolverException, RuntimeError) with a generic RuntimeError fallback for anything else. Top-level failures (no chain) and non-RESOLVE-phase failures are returned unchanged, preserving the original exception object's identity. The enriched exception is raised with no `from` clause, while still inside the original exception's active handler in _handle_phase_error(). Python sets its __context__ to the original exception (keeping it available for traceback/debugging) while leaving __cause__ unset, so __main__._format_exception() - which only follows __cause__ - doesn't print the original message a second time via "... because ...". _format_exception() itself is intentionally unchanged here: a related, pre-existing duplication bug in that formatter is independent of this feature and is tracked separately as #1243. Signed-off-by: Reshmi Aravind <raravind@redhat.com>
…endency-chain Include dependency chain in resolution error messages
…nstant Make `DEFAULT_BG_THREADS` a public class constant on `Bootstrapper` instead of a private module-level `_DEFAULT_BG_THREADS` in `_types.py`. The CLI layer now references `Bootstrapper.DEFAULT_BG_THREADS` for the `--bg-threads` default, keeping the thread-count knowledge with the bootstrapper while giving it a clean public API surface. Co-Authored-By: Claude <claude@anthropic.com> Closes: #1246 Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>
cleanup(bootstrapper): expose `DEFAULT_BG_THREADS` as public class constant
Add proposal for configurable filtering of sensitive environment variables from subprocesses, modeled after sudo's env_keep/env_delete. See: #1083 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Christian Heimes <cheimes@redhat.com>
docs: add environment variable filtering proposal
Zizmor is a static analyzer for CI/CD configuration. It can detect and fix issues in GHA configuration. Run [zizmor](https://docs.zizmor.sh/) and apply all fixers to harden GitHub Actions: ```raw help[artipacked]: credential persistence through GitHub Actions artifacts warning[archived-uses]: action or reusable workflow from archived repository warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates ``` Replace archived `actions-rs/toolchain` with `dtolnay/rust-toolchain`, which is also used by pyca/cryptography. Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Christian Heimes <cheimes@redhat.com>
Apply zizmor hardening
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…tions/actions/checkout-7.0.1 build(deps): bump actions/checkout from 7.0.0 to 7.0.1
…ildEnvironment` Replace the generic `parent_dir` parameter with `sdist_root_dir` and `req` so that `BuildEnvironment` has the context it needs for future sandboxing and environment filtering. All arguments are now keyword-only and follow the common `ctx, req, sdist_root_dir` order. Part of the sandboxing proposal. See: #1019 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Christian Heimes <cheimes@redhat.com>
refactor(build_environment): add sdist_root_dir and req to BuildEnvironment
cleanup(bootstrapper): remove unused logger from `_types.py`
Ruff 0.16.0 enables more checkers by default and can now format code in Markdown files, too. See: https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md Signed-off-by: Christian Heimes <cheimes@redhat.com>
Include abiflags in build env path for free-threading (nogil) Python interpreter. Python 3.14 and 3.14t have different ABIs and need separate build environments. Signed-off-by: Christian Heimes <cheimes@redhat.com>
feat(build_environment): Include abiflags in path
Add `ExternalCommands` Pydantic model with `keep_env` / `delete_env` pattern lists, a `filter_env()` method, and a `DEFAULT_KEEP_ENV` class variable for essential variables (HOME, PATH, LC_*, TERM, TZ, TMPDIR, etc.). `delete_env` matching is case-insensitive so credentials cannot slip through due to unexpected capitalisation. Non-POSIX env var keys are always stripped by `filter_env()`. Not yet wired into `external_commands.run()`. See: #1083 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Christian Heimes <cheimes@redhat.com>
feat(packagesettings): add `ExternalCommands` model for env filtering
`NamedTemporaryFile` creates files with mode 0o600, making them unreadable by external wheel servers (e.g. nginx) that run as a different user. This caused 403 Forbidden errors when `uv pip install` tried to fetch wheels from the local package index. Use `os.fchmod` before close+rename to widen permissions to 0o644, preserving the atomicity and thread-safety benefits of `NamedTemporaryFile`. Closes: #1281 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Shanmukh Pawan <smoparth@redhat.com>
…ions fix(downloads): set 0o644 permissions on downloaded files
fix: Reformat code with Ruff 0.16.0
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…tions/ossf/scorecard-action-2.4.4 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4
Add paths-ignore for docs/** to test.yaml and codeql.yaml so that doc-only PRs no longer trigger the full CI matrix (unit tests, e2e tests, CodeQL analysis). check.yaml is left unchanged since it runs the Sphinx docs build that validates proposal files. Co-Authored-By: Claude <claude@anthropic.com> Closes: #1230
…-docs-only-changes fix: skip tests and CodeQL for doc-only changes
…tions/actions/setup-python-7.0.0 build(deps): bump actions/setup-python from 6.3.0 to 7.0.0
…tions/pypa/gh-action-pypi-publish-1.14.1 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1
…t --log-level Use `caplog.at_level(logging.INFO)` for the `_prepare_source` logger in `test_constraint_logged_when_present` so the test doesn't rely on `--log-level DEBUG` being passed by the runner. Also remove `--log-level DEBUG` from the hatch test runner command so that future tests that forget to set their own log level will fail in CI. Co-Authored-By: Claude <claude@anthropic.com> Closes: #1274 Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>
…tform.machine` `packaging` 26.3 caches the result of `default_environment()` via `@functools.cache`, so patching `platform.machine` after the first call has no effect. Mock `markers.default_environment` directly to return a fake environment with `platform_machine` set to `"atari"`. Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>
test(bootstrapper): fix caplog assertion that depends on global pytest --log-level
Packages with explicit constraints (e.g. `boto3==1.35.88` in constraints files) now skip age filtering entirely in `find_all_matching_from_provider()`. A constraint is explicit user intent and should not be silently overridden by the age heuristic. Previously in multi-version mode with `--max-release-age`, a constrained package whose pinned version was older than the age window would have all candidates removed, causing silent resolution failure. In single-version mode the fallback kept all candidates anyway, but emitted a misleading "keeping all to avoid empty resolution" warning. Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>
Replace the boolean `fallback_on_empty_age_filter` parameter in `find_all_matching_from_provider()` with an `AgeFallback` enum that supports three strategies when max-release-age filtering removes all candidates: - `ALL`: keep every candidate (single-version default, unchanged) - `NEWEST`: keep only the single newest candidate (new) - `NONE`: return empty list Multi-version mode now uses `AgeFallback.NEWEST` so that when a dependency has no releases within the age window (e.g. bar from 2 years ago depended on by recent foo), the newest version is built instead of failing. This prevents cascading failures where the dependent package also fails to build. Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Rohan Devasthale <rdevasth@redhat.com> fix(resolver): address PR review feedback - Narrow constraint bypass to exact == pins only, so range constraints like >=1.0 still go through age filtering. Reuses the existing `_has_equality_pin()` helper. - Move the constraint check inside the `max_age_cutoff is not None` block to avoid unnecessary work when age filtering is disabled. - Reorder `AgeFallback` enum members: ALL (default), NEWEST, NONE — most- to least-permissive. - Add unit test for NEWEST fallback + pinned constraint combination. - Add unit test verifying range constraints are still age-filtered. Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>
…lback Fix: Multi version bootstrap age filter fallback for edge cases
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.1 to 1.14.2. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ba38be9...dc37677) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772. - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@2c7215f...6c977a6) --- updated-dependencies: - dependency-name: dtolnay/rust-toolchain dependency-version: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…tions/pypa/gh-action-pypi-publish-1.14.2 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2
…d collisions When multiple Rust/maturin packages build in parallel via `ThreadPoolExecutor`, a shared `CARGO_TARGET_DIR` (inherited from the process environment) causes cargo to write intermediate artifacts to the same directory. This leads to collisions — e.g. two packages declaring `#[pyclass(generic)]` overwrite each other's build outputs. Set `CARGO_TARGET_DIR` to `sdist_root_dir / "target"` for every package that uses a Rust build backend (maturin or setuptools-rust). Each package already has its own `sdist_root_dir`, so this isolates cargo artifacts per package. Using `setdefault` preserves any explicit override from per-package settings. This also prevents EXDEV (cross-device rename) failures when cargo's target dir is on a different filesystem than the source tree. Adds `has_rust_build_backend()` public helper to `vendor_rust` module. Closes: #1300 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>
…ilds fix(build): set CARGO_TARGET_DIR per package to prevent parallel build collisions
…tions/dtolnay/rust-toolchain-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 build(deps): bump dtolnay/rust-toolchain from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
Adds a GitHub Actions workflow that merges main into the new-resolver-config feature branch on every push to main. If merge conflicts arise, it opens a GitHub issue listing the conflicting files with the sync-conflict label. When a subsequent sync succeeds, any open sync-conflict issue for that branch is automatically closed. The branch name is configurable via workflow_dispatch for reuse with future long-lived branches. Closes: #1295 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Lalatendu Mohanty <lmohanty@redhat.com>
…lel build collisions" This reverts commit 00344bb. The `CARGO_TARGET_DIR` setting is not needed. The Rust compiler uses a local directory in the current workspace (project) by default. The downstream issue was caused by a configuration setting in downstream. See https://doc.rust-lang.org/cargo/reference/build-cache.html Signed-off-by: Christian Heimes <cheimes@redhat.com>
Revert "fix(build): set CARGO_TARGET_DIR per package"
…er-config ci: add workflow to auto-sync feature branch with main
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Queued — the merge queue status continues in this comment ↓. |
Contributor
Merge Queue Status
This pull request spent 1 minute 12 seconds in the queue, including 9 seconds running CI. Required conditions to mergeReasonPull request #1304 has been dequeued GitHub refused to merge the pull request. You're not authorized to push to this branch. Visit https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches for more information. This is usually enforced by a branch protection or ruleset rule. Failing checks:
HintYou should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it. Tick the box to put this pull request back in the merge queue (same as
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
github-actions
Bot
merged commit Aug 11, 2026
cf4dc21
into
new-resolver-config
77 of 81 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updating new-resolver-config branch to latest main
What
Lets update the branch before the automation takes over.
Why
I am working on PRs for the branch, so wanted to update the feature branch before sending the PRs.