Skip to content

[CLIENT-4036] CI/CD: Lock pip dependencies #913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
juliannguyen4 wants to merge 24 commits into
base: dev
Choose a base branch
from
Draft

[CLIENT-4036] CI/CD: Lock pip dependencies #913

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
3160cca
pytest-cov is only used by cicd pipeline
juliannguyen4 Dec 31, 2025
81d4c37
Update dependabot.yml
juliannguyen4 Dec 31, 2025
b5606bc
Revert "Update dependabot.yml"
juliannguyen4 Dec 31, 2025
c2c8026
Merge remote-tracking branch 'origin/dev' into CLIENT-4036-cicd-use-p…
juliannguyen4 Dec 31, 2025
9ddcac3
delocate already comes with cibuildwheel
juliannguyen4 Dec 31, 2025
e1a52cc
Lock delvewheel properly
juliannguyen4 Dec 31, 2025
809a8a4
delvewheel is a build dep so it belongs in root level requirements.txt
juliannguyen4 Dec 31, 2025
f207f02
Add workflow to create pylock.toml
juliannguyen4 Dec 31, 2025
d7b4a3f
Register
juliannguyen4 Dec 31, 2025
14f2792
Revert "Register"
juliannguyen4 Dec 31, 2025
a0f7a8e
uv not installed on windows-2022 image
juliannguyen4 Dec 31, 2025
cc20a21
Probably should generate lock files for each python version
juliannguyen4 Dec 31, 2025
bca764e
uv probably failing because project doesn't use it.
juliannguyen4 Dec 31, 2025
b0ba4f6
fail fast false
juliannguyen4 Dec 31, 2025
b17f5ed
only lock delvewheel and deps
juliannguyen4 Dec 31, 2025
374c091
set permissions
juliannguyen4 Dec 31, 2025
7b582d2
Add to .github instead of .github/workflows because of permission errors
juliannguyen4 Dec 31, 2025
c489b2e
Prevent conflicts
juliannguyen4 Dec 31, 2025
6bf2834
Fix.
juliannguyen4 Dec 31, 2025
1ca38c2
Prevent race condition
juliannguyen4 Dec 31, 2025
f145bb4
Test in cibuildwheel
juliannguyen4 Dec 31, 2025
34fefd2
Use the lock file for the correct python version
juliannguyen4 Dec 31, 2025
ae0d7a2
Try passing github.ref explicitly to get the latest commit for branch
juliannguyen4 Dec 31, 2025
258b258
Fix
juliannguyen4 Dec 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions .github/workflows/build-wheels.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,11 +311,15 @@ jobs:
CIBW_ENVIRONMENT_LINUX: LD_LIBRARY_PATH=/usr/local/lib64
CIBW_ENVIRONMENT_PASS_LINUX: ${{ inputs.unoptimized && 'UNOPTIMIZED' || '' }}
CIBW_BUILD: ${{ env.BUILD_IDENTIFIER }}
CIBW_BUILD_FRONTEND: build
CIBW_BUILD_FRONTEND: build[uv]
CIBW_BEFORE_ALL_LINUX: >
yum install libyaml-devel -y
# delvewheel is not enabled by default but we do need to repair the wheel
CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel==1.*"
CIBW_BEFORE_BUILD_WINDOWS: >
PYTHON_TAG=${{ matrix.python-tag }}
PYTHON_VERSION="${PYTHON_TAG/cp/}"
PYTHON_VERSION="${PYTHON_VERSION/3/3.}"
uv sync -p $PYTHON_VERSION
# We want to check that our wheel links to the new openssl 3 install, not the system default
# This assumes that ldd prints out the "soname" for the libraries
# We can also manually verify the repair worked by checking the repaired wheel's compatibility tag
Expand Down
41 changes: 41 additions & 0 deletions .github/workflows/create-pylock-file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
permissions:
contents: write

on:
workflow_dispatch:

jobs:
create-lock-file-for-windows:
# Should be same environment used to build wheels on Windows
runs-on: windows-2022
strategy:
matrix:
python-version:
- '3.10'
- '3.11'
- '3.12'
- '3.13'
- '3.14'
fail-fast: false
max-parallel: 1
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
with:
egress-policy: audit

- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
ref: ${{ github.ref }}
- run: pip install delvewheel -c requirements.txt
working-directory: .github/workflows
- run: |
pip lock delvewheel -o pylock-${{ matrix.python-version }}.toml
git add pylock-${{ matrix.python-version }}.toml
working-directory: .github
- name: Commit lock file
uses: step-security/git-auto-commit-action@905c3cd6e9ed2b67b4d46ff401fdb6d745d0ff9d # v7.1.0
with:
commit_message: 'Generate lock file'
commit_author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
branch: ${{ github.ref }}
2 changes: 1 addition & 1 deletion .github/workflows/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
parver==0.5
crudini==0.9.4
delocate==0.10.4
mypy==1.17.1
pytest-cov==4.1.0
1 change: 1 addition & 0 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
build==1.2.2.post1
delvewheel==1.11.2
2 changes: 0 additions & 2 deletions test/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1 @@
pytest==7.4.0
# To generate coverage reports in the Github Actions pipeline
pytest-cov==4.1.0
Loading