Repository navigation
ci: keep uv.lock version in step with Release Please - #5
Merged
Merged
Conversation
uv.lock records the project's own version in its `[[package]]` table, but Release
Please was only rewriting pyproject.toml, __version__, and the manifest. Every
release pull request therefore left uv.lock stale and failed `uv lock --check`
in CI, which is what happened on the 0.2.0 release PR.
Add a `uv.lock` entry to `extra-files` using the TOML updater. The JSONPath has
to filter on `@.name.value`, not `@.name`: Release Please parses TOML with a
format-preserving parser that wraps each scalar as `{start, end, value}` so it
can splice by byte range. `@.name` matches nothing, and a JSONPath that matches
nothing is a silent no-op rather than an error. Verified end to end against the
real lockfile -- the updater rewrites exactly one line, leaves the generated
header and formatting intact, and `uv lock --check` passes afterwards.
Two tests close the gap that let this through: one asserts uv.lock's recorded
version matches __version__, the other pins the `.value` in the JSONPath so it
is not "corrected" away as a typo.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
🐍 Bandit Python Security ResultsBranch: Argus Security Scan ResultsStatus: PASS ✅ Threshold: high Summary
Scanner Resultsbandit (489 findings)View 489 findings
Generated by Argus |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the
uv lock --checkfailure on the open release PR (#4).The bug
uv.lockrecords the project's own version in its[[package]]table:Release Please rewrites
pyproject.toml,__version__, and the manifest — but not this. So everyrelease PR leaves
uv.lockstale and failsuv lock --checkin CI.The fix
A
uv.lockentry inextra-filesusing the TOML updater.The JSONPath filters on
@.name.value, not@.name. That is not a typo: Release Please parsesTOML with a format-preserving parser that wraps each scalar as
{start, end, value}so it cansplice the file by byte range instead of re-serialising it.
@.namematches nothing — and aJSONPath that matches nothing is a silent no-op, not an error. This cost a round of debugging,
so
CONTRIBUTING.mdexplains it and a test pins the expression.Verification
Ran the actual
GenericTomlupdater (release-please 17.11.2) against the realuv.lock:pyproject.tomlbumped to 0.1.1 alongside it,uv lock --checkpassesBoth new tests were mutation-checked: staling the lockfile version and "correcting" the JSONPath to
@.nameeach fail the suite. Fullci.ymlparity locally — format, lint, mypy, pylint, 246 unit +28 integration tests,
uv lock --check.Note on #4
This only fixes the lockfile check. #4 proposes 0.2.0 with the entire project history as its
changelog because the repo has zero tags, so Release Please has no anchor. Tagging
v0.1.0at3de90f8(the pre-automation tip, with both historicalfeat:commits below it) would turn #4into a clean
0.1.1. Happy to do that separately — it's outward-facing, so I haven't.Also still outstanding: squash merging is not enabled (#2 and #3 landed as merge commits, so every
branch commit is on
mainand gets parsed by Release Please).🤖 Generated with Claude Code