mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:07:17 +01:00
Krzysztof kuhy Rudnicki
08a4010a16
Some checks failed
dependency freshness / dependencies on newest stable (push) Has been cancelled
file length / file-length (push) Has been cancelled
md-naming / markdown naming convention (push) Has been cancelled
palette drift / palette (push) Has been cancelled
repo-contract / repo contract (push) Has been cancelled
shared gate tests / gate unit tests (push) Has been cancelled
toolchain:python's "latest" was platform.python_version(), so the verdict depended on the machine running the gate: setup-python "3.x" gave kuhyx/spellcode 3.15.0 on one runner and 3.14.8 on another, making its transitive:pyodide allowlist entry dead (exit 2) on one and required (exit 1) on the other. Now registries/toolchain.python_latest() reads python.org's release API (is_published, pre_release=false), keeps only exact "Python X.Y.Z" names (the feed also lists "Python install manager 26.4"), and takes the newest stable. The never_cached() carve-out is gone: it existed because a cached *interpreter* version from an older runner image (3.13.15) was served to a 3.14.7 job in screen-locker's CI. A registry answer is safe to cache, so python now goes through the normal TTL cache, prefetch, and offline fallback (expired cache -> DEGRADED; no cache -> unavailable), never the local interpreter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4VrLZn9YjhPuoxTj54WKk
64 lines
2.4 KiB
YAML
64 lines
2.4 KiB
YAML
name: dependency freshness
|
|
|
|
# Every dependency on its ecosystem's newest STABLE release, enforced on push
|
|
# as well as at commit time. The local pre-commit hook only sees the manifests
|
|
# in a commit and can be skipped entirely by a fresh clone that never ran
|
|
# `pre-commit install`; this runs `--all` over the whole repo.
|
|
#
|
|
# `--strict` is CI-only. Offline the gate degrades to its cached answer and
|
|
# passes, because `--no-verify` is banned locally and a hook that hard-failed
|
|
# on a flaky connection would leave no way to commit. A runner is always
|
|
# online, so here an undeterminable answer is a real failure.
|
|
#
|
|
# Expect this to go red for reasons this repo's commit did not cause: an
|
|
# upstream release overnight is enough. That is the chosen behaviour -- the
|
|
# alternative is a gate that only notices staleness when someone remembers to
|
|
# look.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
dependency-freshness:
|
|
name: dependencies on newest stable
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# The gate lives in the shared utils repo so every repo resolves the
|
|
# same "latest stable" the same way. Checking it out beats vendoring a
|
|
# copy, which is exactly how a gate and its survey start disagreeing.
|
|
- name: Check out the shared gate
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: kuhyx/utils
|
|
path: .utils
|
|
|
|
# Any recent Python runs the gate. The Python TARGET is python.org's
|
|
# newest release (registries/toolchain.python_latest), not this
|
|
# interpreter: when it was, "3.x" resolved to 3.15.0 on one runner and
|
|
# 3.14.8 on the next, and spellcode's allowlist flipped dead/required.
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.x"
|
|
|
|
- name: Install the gate's two runtime dependencies
|
|
run: python -m pip install --upgrade pyyaml packaging
|
|
|
|
- name: Cache registry lookups
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ~/.cache/dep-freshness
|
|
key:
|
|
dep-freshness-${{ hashFiles('**/pubspec.yaml', '**/pyproject.toml',
|
|
'**/requirements*.txt', '**/package.json', '**/Cargo.toml', '**/go.mod',
|
|
'**/*.versions.toml') }}
|
|
restore-keys: dep-freshness-
|
|
|
|
- name: Every dependency is on newest stable
|
|
run: bash .utils/scripts/check_dependency_freshness.sh --all --strict
|