utils/dep_freshness/resolve.py
Krzysztof kuhy Rudnicki 08a4010a16
Some checks failed
dependency freshness / dependencies on newest stable (push) Has been cancelled
file length / file-length (push) Has been cancelled
md-naming / markdown naming convention (push) Has been cancelled
palette drift / palette (push) Has been cancelled
repo-contract / repo contract (push) Has been cancelled
shared gate tests / gate unit tests (push) Has been cancelled
dep_freshness: Python's latest is python.org's newest release, not the interpreter
toolchain:python's "latest" was platform.python_version(), so the verdict
depended on the machine running the gate: setup-python "3.x" gave kuhyx/spellcode
3.15.0 on one runner and 3.14.8 on another, making its transitive:pyodide
allowlist entry dead (exit 2) on one and required (exit 1) on the other.

Now registries/toolchain.python_latest() reads python.org's release API
(is_published, pre_release=false), keeps only exact "Python X.Y.Z" names (the
feed also lists "Python install manager 26.4"), and takes the newest stable.

The never_cached() carve-out is gone: it existed because a cached
*interpreter* version from an older runner image (3.13.15) was served to a
3.14.7 job in screen-locker's CI. A registry answer is safe to cache, so
python now goes through the normal TTL cache, prefetch, and offline fallback
(expired cache -> DEGRADED; no cache -> unavailable), never the local
interpreter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A4VrLZn9YjhPuoxTj54WKk
2026-10-20 22:39:25 +02:00

131 lines
3.9 KiB
Python

"""Turn a `Dep` into "what is the newest stable of this?", via cache then net.
The cache is consulted first, the network second, and an *expired* cache entry
third — that last fallback is what lets a pre-commit run succeed offline
instead of cornering the user, since `--no-verify` is banned.
"""
from __future__ import annotations
from concurrent.futures import ThreadPoolExecutor
from dataclasses import dataclass
from dep_freshness._tables import (
CARGO,
GITCOMMIT,
GITTAG,
GOMOD,
MAVEN,
MAX_WORKERS,
NPM,
PUB,
PYPI,
TOOLCHAIN,
)
from dep_freshness.cache import Cache
from dep_freshness.models import Dep
from dep_freshness.registries import (
cargo,
gitcommit,
gittag,
gomod,
maven,
npmjs,
pub,
pypi,
)
from dep_freshness.registries import toolchain as tc
from dep_freshness.registries.http import Offline
_LOOKUP = {
PUB: pub.latest,
PYPI: pypi.latest,
NPM: npmjs.latest,
CARGO: cargo.latest,
GOMOD: gomod.latest,
GITTAG: gittag.latest,
MAVEN: maven.latest,
GITCOMMIT: gitcommit.latest,
}
@dataclass
class Answer:
"""Latest stable for one package, and how confident we are in it."""
version: str | None
stale_cache_days: float | None = None # served from an expired entry
unavailable: bool = False # no network and no cache at all
def _toolchain_latest(name: str) -> str | None:
if name == "flutter":
return tc.flutter_latest()[0]
if name == "dart":
return tc.flutter_latest()[1]
if name == "node":
return tc.node_latest()
if name == "python":
return tc.python_latest()
if name == "gradle":
return tc.gradle_latest()
return None
def _fetch(ecosystem: str, package: str) -> str | None:
if ecosystem == TOOLCHAIN:
return _toolchain_latest(package)
handler = _LOOKUP.get(ecosystem)
return handler(package) if handler else None
class Resolver:
"""Batch version lookups behind one shared on-disk cache."""
def __init__(self, cache: Cache | None = None, refresh: bool = False) -> None:
self.cache = cache if cache is not None else Cache()
if refresh:
self.cache.clear()
self.degraded: list[str] = []
def prefetch(self, deps: list[Dep]) -> None:
"""Warm the cache for everything not already fresh, eight at a time."""
wanted = {
(d.ecosystem, d.name)
for d in deps
if not (entry := self.cache.get(d.ecosystem, d.name))
or not entry.fresh(d.ecosystem)
}
if not wanted:
return
with ThreadPoolExecutor(max_workers=MAX_WORKERS) as pool:
futures = {
pool.submit(_fetch, eco, name): (eco, name) for eco, name in wanted
}
for future, (eco, name) in futures.items():
try:
self.cache.put(eco, name, future.result())
except Offline as exc:
self.degraded.append(str(exc))
except Exception as exc:
# Deliberately broad: one malformed registry payload
# must degrade that single package, not abort a run
# spanning ~900 lookups.
self.degraded.append(f"{eco}:{name}: {exc}")
self.cache.save()
def latest(self, dep: Dep) -> Answer:
entry = self.cache.get(dep.ecosystem, dep.name)
if entry and entry.fresh(dep.ecosystem):
return Answer(entry.version)
try:
version = _fetch(dep.ecosystem, dep.name)
except Offline:
version = None
else:
self.cache.put(dep.ecosystem, dep.name, version)
return Answer(version)
if entry is not None:
return Answer(entry.version, stale_cache_days=entry.age() / 86400)
return Answer(None, unavailable=True)