chore(renovate): canary — pip-compile manager regenerates requirements.lock (Workflows only) - #2411
Conversation
…quirements.lock
Renovate doesn't touch uv-pip-compile `requirements.lock` files by default,
so Renovate-driven dep bumps leave the lock stale (the reusable Python CI
installs `-r requirements.lock`). Enable Renovate's pip-compile manager so it
regenerates the lock IN its own PR/commit — which keeps platformAutomerge
intact (unlike a CI workflow committing back, which marks the branch modified
and a GITHUB_TOKEN push doesn't re-trigger the required gate check).
CANARY scope: Workflows' own renovate.json only (NOT the shared fleet preset).
Promote the pip-compile block into renovate-presets/fleet.json once proven.
Key gotcha (found via local `renovate --dry-run`): Renovate's pip-compile
manager parses the lock header and requires EVERY option in equals form
(`--python-version=3.12`, `--extra=dev`, `--output-file=...`); uv's default
space form ("--extra dev") makes it throw "Option ... must have equal sign"
and silently skip the lock. Regenerated the lock with full equals form
(content byte-identical) and updated maint-51 (the scheduled refresher that
runs on Workflows) to emit equals form so it doesn't revert the header.
pip_requirements is disabled for requirements.txt only (it's a pip-compile
source — Renovate docs: disable source managers to avoid duplicate PRs);
tools/requirements-llm.txt keeps pip_requirements (standalone LLM pins).
Open follow-ups (see PR body): maint-51 still passes `--upgrade`, which lands
in the header; verify Renovate's regen ignores it or replace maint-51 with
Renovate lockFileMaintenance. pep621/pip-compile overlap on pyproject.toml is
untested (no pending pip bump) — watch the first live Renovate pip update.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThe Changesrequirements.lock pipeline: workflow and Renovate alignment
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Workflow source neededPR #2411 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
GitHub Actions
Inactive
Automated Status SummaryHead SHA: 665304a
Coverage Overview
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 058b4d5d72
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "matchManagers": ["pip_requirements"], | ||
| "matchFileNames": ["requirements.txt"], | ||
| "enabled": false |
There was a problem hiding this comment.
Because this canary makes requirements.lock a pip-compile output whose header names both pyproject.toml and requirements.txt as sources, suppressing only pip_requirements still leaves Renovate's default pep621 manager running independently on pyproject.toml. Renovate's pip-compile docs say source managers should be disabled to avoid running the same source twice; in this repo pre-commit==4.6.0/flake8==7.3.0 are non-excluded optional-dependency pins, so a pep621-only bump can still change pyproject.toml without regenerating requirements.lock, recreating the stale-lock PRs this change is meant to prevent. Add a scoped pep621 disable for pyproject.toml (or exclude those pins) alongside this rule.
Useful? React with 👍 / 👎.
…tenance (#2413) Renovate's pip-compile manager (enabled on requirements.lock via the canary renovate.json #2411 + fleet preset #2406) already owns periodic lock regeneration: supportsLockFileMaintenance=true and its defaultConfig enables lockFileMaintenance by default (branchTopic `pip-compile-refresh`), recompiling the lock from scratch on a schedule. That makes maint-51-dependency-refresh.yml's scheduled `uv pip compile --upgrade` a duplicate refresher (and it had failed every run since ~March until #2404). Retire it. Verified the feared `--upgrade`-in-header risk does NOT exist: - uv omits `--upgrade` from the recorded lock header (empirically: compiles with and without `--upgrade` produce byte-identical headers). - Even if it appeared, Renovate's pip-compile header parser (common.ts throwForUnknownOption) would throw `Option --upgrade not supported (yet)` and skip the file; it never re-runs a mass `--upgrade` (per-dep bumps are scoped via `--upgrade-package` in artifacts.ts). maint-51's other steps remain covered: sync_test_dependencies.py --verify runs in reusable-10-ci-python on every PR; dev-tool pin alignment is enforced on schedule by maint-auto-update-pypi-versions + maint-sync-env-from-pyproject (--apply). - delete .github/workflows/maint-51-dependency-refresh.yml - drop its EXPECTED_NAMES entry in tests/workflows/test_workflow_naming.py - remove it from docs/ci/WORKFLOWS.md (link guard), WORKFLOW_SYSTEM.md, WORKFLOW_GUIDE.md, DEPENDENCY_TESTING.md; document lockFileMaintenance ownership in renovate.json Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
Goal
Close the lock-regen gap going forward: Renovate does not touch
uv pip compilerequirements.lockfiles by default, so every Renovate dep bump leaves the lock stale — and the reusable Python CI installs-r requirements.lock(reusable-10-ci-python.yml), so stale = CI silently installs old deps. (The already-stale lock was fixed in #2404.)Chosen mechanism: Renovate's pip-compile manager, so Renovate regenerates the lock in its own commit. This keeps
platformAutomergeintact — unlike a CI workflow committing back, which marks the branch "modified" and (with aGITHUB_TOKENpush) does not re-trigger the requiredsummarygate check, stalling auto-merge.CANARY scope
Workflows' own
renovate.jsononly — NOT the shared fleet preset. Prove it here (dogfood), then promote thepip-compileblock intorenovate-presets/fleet.jsonfor the fleet.Validated in-session (local
renovate@43 --dry-runagainst this branch)requirements.lock, parses the uv header, and builds the correct source graph (pyproject.toml,requirements.txt→requirements.lock).--python-version 3.12,--extra dev) with "Option … must have equal sign" and silently skips the lock. Fix: regenerated with full equals form (--python-version=3.12 --extra=dev --extra=langchain --output-file=…) — content byte-identical — and updatedmaint-51(the scheduled refresher that runs on Workflows) to emit equals form so it doesn't revert the header.setuptools/wheel"not found in lock" (build-backend deps, not in the resolved lock by design).pip_requirementsdisabled forrequirements.txtonly (it's a pip-compile source — Renovate docs say disable source managers to avoid duplicate PRs).tools/requirements-llm.txtkeepspip_requirements(standalone LLM pins, not a lock source).Open follow-ups (before fleet promotion)
--upgrade: maint-51 still passes--upgrade, which lands in the lock header on its next run (Jul 1). Verify Renovate's pip-compile parser tolerates--upgrade(and that its regen doesn't inherit it), or replace maint-51 with RenovatelockFileMaintenance(the pip-compile manager supports it) and retire the now-redundant scheduled refresher.pyproject.tomlis also managed bypep621. Workflows' pyproject uses ranges for runtime (langchain) — Renovate won't bump those, so no overlap there — but pinned, non-excluded dev tools (pre-commit,flake8) live in both pyproject and the lock and could draw duplicate proposals. Confirm on the first live Renovate pip bump; if duplicates appear, scopepep621forpyproject.tomlsimilarly.pip-compileblock + the equals-form generator fix intorenovate-presets/fleet.jsonand update the consumer-side generators (incl.maint-69integration-repo). Gate consumer rollout on each repo being on Renovate.🤖 Generated with Claude Code
Summary by CodeRabbit