mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 22:47:14 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
43 lines
1.6 KiB
Bash
Executable File
43 lines
1.6 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# ============================================================================
|
|
# Fail if any dependency is behind its ecosystem's newest stable release.
|
|
#
|
|
# "Are we on the newest version?" is only mechanically answerable when the
|
|
# manifest states an exact version, so this gate checks two things at once:
|
|
# that every dependency is exact-pinned, and that the pin equals latest stable.
|
|
#
|
|
# The real check lives in Python (dep_freshness/check.py) so the pre-commit
|
|
# hook, the CI workflow and the SessionStart hook read one implementation --
|
|
# see rules/shell.instructions.md on never embedding another language's logic
|
|
# inline, and the four-way fork of the 250-line cap on why delegation matters.
|
|
#
|
|
# Usage:
|
|
# scripts/check_dependency_freshness.sh <file> [<file> ...] # pre-commit
|
|
# scripts/check_dependency_freshness.sh --all --strict # CI
|
|
#
|
|
# Exit: 0 current | 1 behind | 2 allowlist wrong | 3 undeterminable (offline)
|
|
# ============================================================================
|
|
|
|
set -euo pipefail
|
|
|
|
readonly UTILS_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
readonly CHECKER="$UTILS_ROOT/dep_freshness/check.py"
|
|
|
|
main() {
|
|
if [[ $# -eq 0 ]]; then
|
|
echo "Usage: $(basename "$0") <file>... | --all [--strict]" >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! -f "$CHECKER" ]]; then
|
|
echo "Error: checker not found at $CHECKER" >&2
|
|
echo "Clone kuhyx/utils next to this repo, or set UTILS_ROOT." >&2
|
|
exit 1
|
|
fi
|
|
|
|
PYTHONPATH="$UTILS_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
|
|
python3 -m dep_freshness "$@"
|
|
}
|
|
|
|
main "$@"
|