ci(runtime-pin-compat): test the PR-built wheel, not PyPI-latest - #2196
Merged
HongmingWang-Rabbit merged 1 commit intoApr 28, 2026
Merged
Conversation
Closes #128's chicken-and-egg. The original gate installed the CURRENTLY-PUBLISHED molecule-ai-workspace-runtime from PyPI, then overlaid workspace/requirements.txt, then smoke-imported. That catches problems with the already-shipped artifact (the daily-cron upstream-yank case), but it cannot catch problems introduced by the PR itself: the imports it exercises are from the OLD wheel, not the PR's source. A PR that adds `from a2a.utils.foo import bar` (where `bar` is added in a2a-sdk 1.5 and the runtime currently pins 1.3) slips through: 1. Pip resolves the existing PyPI wheel + a2a-sdk 1.3. 2. Smoke imports the OLD main.py — no reference to `bar` → green. 3. Merge → publish-runtime.yml ships a wheel WITH the new import. 4. Tenant images redeploy → all crash on first boot with ImportError: cannot import name 'bar' from 'a2a.utils.foo'. Splits the workflow into two jobs: - pypi-latest-install (renamed from default-install): unchanged behavior. Runs on the daily cron and on requirements.txt / workflow edits. Catches upstream PyPI yanks + the already-shipped artifact going stale. - local-build-install (new): runs scripts/build_runtime_package.py on the PR's workspace/, builds the wheel with python -m build (mirroring publish-runtime.yml byte-for-byte), installs that wheel, then runs the same smoke import. Tests the artifact that WOULD be published if this PR merges. Path filter widened to workspace/** so any runtime-source change triggers the local-build job. The pypi-latest job's filter is the same union; its internal logic is unchanged so the daily-cron and upstream-detection use cases continue to work. Verified locally: built the wheel from current workspace/ source via the same script + python -m build invocation, installed into a fresh venv, imported from molecule_runtime.main import main_sync successfully. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
April 28, 2026 00:39
HongmingWang-Rabbit
enabled auto-merge
April 28, 2026 00:40
This was referenced Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #128. The original
runtime-pin-compat.ymlgate installed the CURRENTLY-PUBLISHEDmolecule-ai-workspace-runtimefrom PyPI before smoke-importing — catching upstream PyPI yanks but not problems introduced by the PR itself. A PR that adds an import requiring a newer SDK could pass the gate (smoke runs against the OLD wheel) and then break every tenant image after merge → publish.What changes
Splits into two jobs:
pypi-latest-install(renamed fromdefault-install): unchanged behavior. Daily-cron +requirements.txt/ workflow edits. Catches upstream PyPI yanks + already-shipped artifact going stale.local-build-install(new): runsscripts/build_runtime_package.pyon the PR'sworkspace/, builds the wheel withpython -m build(mirroringpublish-runtime.ymlbyte-for-byte), installs that wheel, then smoke-imports. Tests the artifact that WOULD be published if this PR merges.Path filter widened to
workspace/**so any runtime-source change triggers the local-build job.Verification
Built the wheel from current
workspace/source via the same script +python -m buildinvocation, installed into a fresh venv, imported successfully:Test plan
workspace/main.py, both jobs run (thepypi-latest-installagainst PyPI, thelocal-build-installagainst the new source)🤖 Generated with Claude Code