From c4c1e1dff96d04b27c8ac55994e35037e0627fb3 Mon Sep 17 00:00:00 2001 From: thePR0M3TH3AN Date: Thu, 20 Aug 2026 09:36:26 -0400 Subject: [PATCH] Compile requirements.lock on the lowest supported Python, and verify it once MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Windows job could never install from this lockfile and the Linux/macOS jobs could never verify it, for the same underlying reason: pip-compile resolves version-conditional dependencies for the interpreter it runs on and emits no markers, so 3.10 and 3.11 produce genuinely different files — 135 lines apart, argon2-cffi-bindings among them. Which direction matters. A 3.10 resolution is a superset: it carries async-timeout, which aiohttp requires below 3.11, and installs cleanly under --require-hashes on 3.11. A 3.11 resolution is missing it, so on 3.10 pip tries to fetch async-timeout unpinned and --require-hashes refuses — which is exactly how the Windows job died. So the lockfile is now compiled on 3.10, the minimum in pyproject's `python = ">=3.10,<3.13"`, and verified to install on both 3.10 and 3.11. Verification moves out of the build matrix into its own job pinned to that same interpreter. Regenerate-and-diff answers "did this file really come from src/requirements.txt", which is one question about one artifact and wants asking once, on the interpreter that produced it — not once per matrix entry on whichever Python that entry happens to use. Every platform still installs with --require-hashes, which is the part that had to stay everywhere. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN --- .github/workflows/python-ci.yml | 49 ++++++++++++++++++++++----------- requirements.lock | 27 ++++++++++++++++-- 2 files changed, 58 insertions(+), 18 deletions(-) diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index 94ea7f02..23473d00 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -9,6 +9,39 @@ on: - cron: '0 3 * * *' jobs: + # Regenerating the lockfile and diffing it proves the committed file really + # came from src/requirements.txt. It has to happen on ONE interpreter, and + # specifically on LOCK_PYTHON below, so it cannot ride the build matrix. + # + # pip-compile resolves version-conditional dependencies for the interpreter + # it runs on, and the result carries no markers. Python 3.10 needs + # async-timeout (aiohttp requires it below 3.11) and 3.11 does not, so the + # two resolutions are genuinely different files -- 135 lines apart, + # argon2-cffi-bindings among them. One committed lockfile cannot equal both. + # + # Compiling on the LOWEST supported version is what makes a single lockfile + # work everywhere: 3.10's resolution is a superset, and it installs cleanly + # under --require-hashes on 3.11. The reverse does not -- a 3.11 lockfile + # is missing async-timeout, so on 3.10 pip tries to fetch it unpinned and + # --require-hashes refuses. Both halves of that were failing here: the diff + # could never match on one platform, and the install could never succeed on + # the other. + lockfile: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + # Must equal the minimum in pyproject's `python = ">=3.10,<3.13"`. + # Raising that floor means regenerating requirements.lock here. + python-version: "3.10" + - name: Verify the lockfile matches src/requirements.txt + run: | + python -m pip install --upgrade pip + pip install pip-tools + pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt + git diff --exit-code requirements.lock + secret-scan: name: Secret Scan runs-on: ubuntu-latest @@ -76,22 +109,6 @@ jobs: key: ${{ runner.os }}-pip-${{ hashFiles('requirements.lock') }} restore-keys: | ${{ runner.os }}-pip- - # Regenerating the lockfile and diffing it proves the committed file - # really came from src/requirements.txt. It can only be done on ONE - # interpreter: pip-compile resolves version-conditional dependencies - # per Python version, so 3.10 and 3.11 produce genuinely different - # files (argon2-cffi-bindings among others), and a single committed - # lockfile cannot equal both. Run as written across this matrix the - # check was unsatisfiable -- whichever version the lockfile was built - # on, the other job failed. Linux/3.11 is the canonical generator, so - # the verification lives there. - - name: Verify the lockfile matches src/requirements.txt - if: runner.os == 'Linux' - run: | - python -m pip install --upgrade pip - pip install pip-tools - pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt - git diff --exit-code requirements.lock - name: Install dependencies run: | python -m pip install --upgrade pip diff --git a/requirements.lock b/requirements.lock index cc71e088..6a370055 100644 --- a/requirements.lock +++ b/requirements.lock @@ -1,5 +1,5 @@ # -# This file is autogenerated by pip-compile with Python 3.11 +# This file is autogenerated by pip-compile with Python 3.10 # by the following command: # # pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt @@ -181,6 +181,10 @@ argon2-cffi-bindings==25.1.0 \ --hash=sha256:da0c79c23a63723aa5d782250fbf51b768abca630285262fb5144ba5ae01e520 \ --hash=sha256:e2fd3bfbff3c5d74fef31a722f729bf93500910db650c925c2d6ef879a7e51cb # via argon2-cffi +async-timeout==5.0.1 \ + --hash=sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c \ + --hash=sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3 + # via aiohttp attrs==26.1.0 \ --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \ --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32 @@ -1010,6 +1014,13 @@ ed25519-blake2b-fork==1.4.2 \ --hash=sha256:f3cc0523703bd1e5ccb4ca332d75b1011e74ad5b4c89c0cc7098a2d8a9588979 \ --hash=sha256:fc13ddb5968e3b16fd6ed4fd6433b005a6e8c435bdc7f9214f1032f51a62ca17 # via bip-utils +exceptiongroup==1.3.1 \ + --hash=sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219 \ + --hash=sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598 + # via + # anyio + # hypothesis + # pytest execnet==2.1.2 \ --hash=sha256:63d83bfdd9a23e35b9c6a3261412324f964c2ec8dcd8d3c6916ee9373e0befcd \ --hash=sha256:67fba928dd5a544b783f6056f449e5e3931a5c378b128bc18501f7ea79e296ec @@ -2464,6 +2475,10 @@ toga-dummy==0.5.6 \ --hash=sha256:5f34d8620bfcc6569aa9f3abbfebe9b5fc3d5d6b410e63fd91290ef88b5bac76 \ --hash=sha256:7d6f43c5cca7300767850ba57d9e808ead58763012ffeb753ba5d05beefe2ef9 # via -r src/requirements.txt +toml==0.10.2 \ + --hash=sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b \ + --hash=sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f + # via mutmut tomli==2.4.1 \ --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \ --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \ @@ -2512,7 +2527,10 @@ tomli==2.4.1 \ --hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \ --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \ --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049 - # via -r src/requirements.txt + # via + # -r src/requirements.txt + # coverage + # pytest travertino==0.5.6 \ --hash=sha256:9eafb6f7db785f7fde8a10054418288e67299094fe3dd4cb09ed9c7a96572791 \ --hash=sha256:ebe7d196398bd48bea9a2acc8c095f5ecff1f1dc081d33b8040810ef9f93b0d9 @@ -2529,14 +2547,19 @@ typing-extensions==4.16.0 \ # aiosignal # anyio # bip-utils + # cryptography + # exceptiongroup # fastapi # limits + # multidict # pydantic # pydantic-core + # pyjwt # pytoniq-core-fork # starlette # textual # typing-inspection + # uvicorn typing-inspection==0.4.4 \ --hash=sha256:547274fa6b0a561ccf549cc9524b999a578e737d015d8709d021f9d0d13bea47 \ --hash=sha256:65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147