mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:07:17 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
89 lines
3.2 KiB
Python
89 lines
3.2 KiB
Python
"""Decide, for one `Dep` and its registry answer, whether the gate objects.
|
|
|
|
Kept separate from `check.py` so the rules are readable in one screen and
|
|
testable without a filesystem. The rules differ per constraint style on
|
|
purpose:
|
|
|
|
* Ordinary packages must carry an exact pin (Q6) — a range is not comparable
|
|
to a registry answer, which is what made "are we current?" unanswerable.
|
|
* Q13's carve-out packages may keep a caret; their *lower bound* is compared
|
|
instead, so a stale `^10.2.0` is still caught.
|
|
* Toolchain ranges are checked for whether they still admit the current
|
|
toolchain. `sdk: ^3.12.2` is not stale because Dart shipped 3.13.2 — that
|
|
constraint already permits it — but `<3.13` would be a real break.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dep_freshness._tables import TOOLCHAIN
|
|
from dep_freshness.constraints import lower_bound, satisfies
|
|
from dep_freshness.models import Dep, Finding, Severity
|
|
from dep_freshness.resolve import Answer
|
|
from dep_freshness.versions import behind
|
|
|
|
|
|
def _toolchain(dep: Dep, latest: str) -> Finding | None:
|
|
if dep.pinned:
|
|
if behind(dep.pinned, latest):
|
|
return Finding(dep, Severity.STALE, latest)
|
|
return None
|
|
if not dep.constraint or dep.caret_ok is False:
|
|
return Finding(
|
|
dep, Severity.UNPINNED, latest,
|
|
detail="a channel name is not a version: two machines on the same "
|
|
"commit can build with different SDKs",
|
|
)
|
|
if not satisfies(dep.constraint, latest):
|
|
return Finding(
|
|
dep, Severity.STALE, latest,
|
|
detail=f"the constraint excludes the current toolchain {latest}",
|
|
)
|
|
return None
|
|
|
|
|
|
def judge(dep: Dep, answer: Answer) -> Finding | None:
|
|
"""The gate's objection to `dep`, or None when it is fine."""
|
|
if dep.override:
|
|
return Finding(
|
|
dep, Severity.OVERRIDE, answer.version,
|
|
detail="an override pins a transitive dependency nothing else "
|
|
"watches; allowlist it or remove it",
|
|
)
|
|
if answer.unavailable:
|
|
return Finding(
|
|
dep, Severity.UNKNOWN, None,
|
|
detail="no network and no cached answer",
|
|
)
|
|
latest = answer.version
|
|
if latest is None:
|
|
return Finding(
|
|
dep, Severity.UNKNOWN, None,
|
|
detail="the registry has no stable release for this package",
|
|
)
|
|
|
|
if dep.ecosystem == TOOLCHAIN:
|
|
return _toolchain(dep, latest)
|
|
|
|
if dep.pinned is None:
|
|
if dep.caret_ok:
|
|
floor = lower_bound(dep.constraint)
|
|
if floor and behind(floor, latest):
|
|
return Finding(
|
|
dep, Severity.STALE, latest,
|
|
detail=f"range floor {floor} is behind latest stable",
|
|
)
|
|
return None
|
|
return Finding(
|
|
dep, Severity.UNPINNED, latest,
|
|
detail=f"exact-pin it ({latest}) so freshness is checkable",
|
|
)
|
|
|
|
if behind(dep.pinned, latest):
|
|
return Finding(dep, Severity.STALE, latest)
|
|
if dep.locked and dep.locked != dep.pinned:
|
|
return Finding(
|
|
dep, Severity.LOCK_MISMATCH, latest,
|
|
detail=f"lockfile resolved {dep.locked}, manifest pins {dep.pinned}",
|
|
)
|
|
return None
|