mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-15 02:50:57 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
49 lines
1.6 KiB
Python
49 lines
1.6 KiB
Python
"""PyPI: latest stable via the modern simple index.
|
|
|
|
The legacy `/pypi/<name>/json` endpoint's `info.version` includes yanked and
|
|
pre-release versions, which is exactly the fail-green bug this gate must not
|
|
have. The simple v1 JSON carries per-file `yanked` flags, so a version counts
|
|
only when at least one of its files is still installable.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dep_freshness._tables import PYPI_ACCEPT, PYPI_API
|
|
from dep_freshness.registries.http import get_json
|
|
from dep_freshness.versions import newest_stable
|
|
|
|
_SUFFIXES = (".tar.gz", ".zip", ".whl", ".tar.bz2", ".egg")
|
|
|
|
|
|
def _version_of(filename: str, versions: set[str]) -> str | None:
|
|
"""Which declared version a distribution filename belongs to."""
|
|
for suffix in _SUFFIXES:
|
|
if filename.endswith(suffix):
|
|
filename = filename[: -len(suffix)]
|
|
break
|
|
parts = filename.split("-")
|
|
for candidate in parts[1:]:
|
|
if candidate in versions:
|
|
return candidate
|
|
return None
|
|
|
|
|
|
def latest(name: str) -> str | None:
|
|
payload = get_json(PYPI_API.format(name=name), accept=PYPI_ACCEPT)
|
|
if not payload:
|
|
return None
|
|
versions = [str(v) for v in payload.get("versions") or []]
|
|
declared = set(versions)
|
|
files = payload.get("files") or []
|
|
if files:
|
|
live = set()
|
|
for entry in files:
|
|
if entry.get("yanked"):
|
|
continue
|
|
found = _version_of(str(entry.get("filename", "")), declared)
|
|
if found:
|
|
live.add(found)
|
|
if live:
|
|
return newest_stable(live)
|
|
return newest_stable(versions)
|