From 058b4d5d72b8c88dc7373edf51989f859641fdb4 Mon Sep 17 00:00:00 2001 From: Tim Stranske Date: Mon, 15 Jun 2026 01:01:07 -0500 Subject: [PATCH] =?UTF-8?q?chore(renovate):=20canary=20=E2=80=94=20enable?= =?UTF-8?q?=20pip-compile=20manager=20to=20regenerate=20requirements.lock?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate doesn't touch uv-pip-compile `requirements.lock` files by default, so Renovate-driven dep bumps leave the lock stale (the reusable Python CI installs `-r requirements.lock`). Enable Renovate's pip-compile manager so it regenerates the lock IN its own PR/commit — which keeps platformAutomerge intact (unlike a CI workflow committing back, which marks the branch modified and a GITHUB_TOKEN push doesn't re-trigger the required gate check). CANARY scope: Workflows' own renovate.json only (NOT the shared fleet preset). Promote the pip-compile block into renovate-presets/fleet.json once proven. Key gotcha (found via local `renovate --dry-run`): Renovate's pip-compile manager parses the lock header and requires EVERY option in equals form (`--python-version=3.12`, `--extra=dev`, `--output-file=...`); uv's default space form ("--extra dev") makes it throw "Option ... must have equal sign" and silently skip the lock. Regenerated the lock with full equals form (content byte-identical) and updated maint-51 (the scheduled refresher that runs on Workflows) to emit equals form so it doesn't revert the header. pip_requirements is disabled for requirements.txt only (it's a pip-compile source — Renovate docs: disable source managers to avoid duplicate PRs); tools/requirements-llm.txt keeps pip_requirements (standalone LLM pins). Open follow-ups (see PR body): maint-51 still passes `--upgrade`, which lands in the header; verify Renovate's regen ignores it or replace maint-51 with Renovate lockFileMaintenance. pep621/pip-compile overlap on pyproject.toml is untested (no pending pip bump) — watch the first live Renovate pip update. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/maint-51-dependency-refresh.yml | 7 ++++--- renovate.json | 15 +++++++++++++-- requirements.lock | 2 +- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/.github/workflows/maint-51-dependency-refresh.yml b/.github/workflows/maint-51-dependency-refresh.yml index ac3e1d53ea..4c31e3d552 100644 --- a/.github/workflows/maint-51-dependency-refresh.yml +++ b/.github/workflows/maint-51-dependency-refresh.yml @@ -61,7 +61,7 @@ jobs: - name: Refresh requirements.lock run: | set -euo pipefail - uv pip compile --python-version 3.12 --upgrade pyproject.toml --extra dev --extra langchain requirements.txt --universal -o requirements.lock + uv pip compile --python-version=3.12 --upgrade --extra=dev --extra=langchain --universal --output-file=requirements.lock pyproject.toml requirements.txt - name: Verify lockfile aligns with current compile env: @@ -84,8 +84,9 @@ jobs: continue if re.match(r'^#\s*uv pip compile.*', stripped): lines.append( - '# uv pip compile --python-version 3.12 pyproject.toml --extra dev ' - '--extra langchain requirements.txt --universal -o requirements.lock' + '# uv pip compile --python-version=3.12 --extra=dev ' + '--extra=langchain --universal --output-file=requirements.lock ' + 'pyproject.toml requirements.txt' ) continue if ( diff --git a/renovate.json b/renovate.json index c743ffb686..655ebe2ab7 100644 --- a/renovate.json +++ b/renovate.json @@ -1,5 +1,16 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "description": "Workflows Renovate config — extends the stranske fleet-shared preset (renovate-presets/fleet.json), the single source of truth for grouping, automerge-on-green, dev-tool exclusions, and the vendored-minimatch cascade. Workflows dogfoods the same preset every consumer repo extends. Repo-specific overrides, if ever needed, go in packageRules below.", - "extends": ["github>stranske/Workflows//renovate-presets/fleet"] + "description": "Workflows Renovate config — extends the stranske fleet-shared preset (renovate-presets/fleet.json), the single source of truth for grouping, automerge-on-green, dev-tool exclusions, and the vendored-minimatch cascade. Workflows dogfoods the same preset every consumer repo extends. CANARY (do not promote to the fleet preset until proven here): the pip-compile manager block regenerates requirements.lock (a `uv pip compile` output) in-PR, because Renovate does NOT touch uv-pip-compile locks by default and the reusable Python CI installs `-r requirements.lock`. Renovate parses the lock header to find the source files + command — it requires `--python-version=3.12` (equals form) in the header. requirements.txt is a pip-compile source, so pip_requirements is disabled for it (Renovate docs: avoid double-managing source files); tools/requirements-llm.txt stays on pip_requirements (standalone LLM pins, not a lock source).", + "extends": ["github>stranske/Workflows//renovate-presets/fleet"], + "pip-compile": { + "managerFilePatterns": ["/(^|/)requirements\\.lock$/"] + }, + "packageRules": [ + { + "description": "requirements.txt is a pip-compile source for requirements.lock; let the pip-compile manager own it to avoid duplicate PRs.", + "matchManagers": ["pip_requirements"], + "matchFileNames": ["requirements.txt"], + "enabled": false + } + ] } diff --git a/requirements.lock b/requirements.lock index f5e110663c..22b2d62f24 100644 --- a/requirements.lock +++ b/requirements.lock @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile --python-version 3.12 pyproject.toml --extra dev --extra langchain requirements.txt --universal -o requirements.lock +# uv pip compile --python-version=3.12 --extra=dev --extra=langchain --universal --output-file=requirements.lock pyproject.toml requirements.txt aiohappyeyeballs==2.6.2 # via aiohttp aiohttp==3.14.1