Skip to content

Commit cd343d7

Browse files
cursor[bot]cursoragentkevinmessiaen
authored
chore: pin downstream packages to giskard-checks 1.0.3 (#2804)
* chore: pin downstream packages to giskard-checks 1.0.3 The 1.0.3 release bump left root extras and giskard-scan on >=1.0.2, so check-extra-pins failed on main. Align lower bounds with the workspace member version. Co-authored-by: Kevin Messiaen <kevinmessiaen@users.noreply.github.com> * fix(release): sync workspace pins when bumping a package version The extra-pins check is meant to stay strict. After uv version, rewrite matching >= pins in the root extras and downstream libs, verify them, and include those pyproject files in the release commit so the next tag cannot leave main red. Co-authored-by: Kevin Messiaen <kevinmessiaen@users.noreply.github.com> * fix(release): verify PACKAGE pins in root and libs check-extra-pins still only audits the root file for everyday CI. After a version bump, Verify now runs check-workspace-pins so every versioned PEP 508 requirement naming PACKAGE (root + libs/*) has a single >= bound equal to VERSION, catching stale giskard-scan pins the root-only check would miss. Co-authored-by: Kevin Messiaen <kevinmessiaen@users.noreply.github.com> * chore: update third-party notices for boto3 1.43.81 make check / check-notices failed on PR CI because licensecheck now reports boto3/botocore 1.43.81 while THIRD_PARTY_NOTICES.md still listed 1.43.80. Co-authored-by: Kevin Messiaen <kevinmessiaen@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Kevin Messiaen <kevinmessiaen@users.noreply.github.com>
1 parent b558f56 commit cd343d7

9 files changed

Lines changed: 446 additions & 22 deletions

File tree

.github/workflows/release.yml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,20 @@ jobs:
165165
echo "tag=$PACKAGE/v$NEW_VERSION" >> $GITHUB_OUTPUT
166166
fi
167167
168+
# check-extra-pins requires root extras to match the member version.
169+
# Rewrite those pins (and the same >= pins in downstream libs) in the
170+
# same commit as the version bump so main CI stays green after a release.
171+
# Verify walks the same files Sync writes, scoped to PACKAGE/VERSION.
172+
- name: Sync workspace dependency pins
173+
env:
174+
VERSION: ${{ steps.bump.outputs.new_version }}
175+
run: make bump-workspace-pins
176+
177+
- name: Verify extra pins
178+
env:
179+
VERSION: ${{ steps.bump.outputs.new_version }}
180+
run: make check-workspace-pins
181+
168182
- name: Update lockfile
169183
run: uv lock
170184

@@ -181,7 +195,7 @@ jobs:
181195
run: |
182196
git config user.name "github-actions[bot]"
183197
git config user.email "github-actions[bot]@users.noreply.github.com"
184-
git add "$PKG_DIR/pyproject.toml" "uv.lock"
198+
git add "$PKG_DIR/pyproject.toml" "uv.lock" "pyproject.toml" libs/*/pyproject.toml
185199
git commit -m "chore($PACKAGE): bump version to $NEW_VERSION"
186200
187201
- name: Push to main

Makefile

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ LIBS := giskard-core giskard-llm giskard-agents giskard-checks giskard-scan
55
# "test the metapackage" means "test everything it pins", i.e. all of LIBS.
66
METAPACKAGE := giskard
77
PACKAGE ?= # Optional package to test (e.g., giskard-core, giskard-agents, giskard-checks)
8+
VERSION ?= # Optional, for bump-workspace-pins (e.g. VERSION=1.0.3)
89
AGENT_NAME ?= # Optional, for setup-for-agents telemetry
910
REASON ?= # Optional, for setup-for-agents telemetry
1011

@@ -105,7 +106,7 @@ test-unit-minimal: ## Run unit tests on minimal deps (no provider SDKs), optiona
105106
$(foreach lib,$(TEST_LIBS),uv run pytest libs/$(lib) -m "not functional" &&) true
106107

107108
test-examples: ## Run canonical examples and README snippet lint
108-
uv run pytest examples tools/test_lint_readme_snippets.py -q
109+
uv run pytest examples tools -q
109110
uv run python tools/lint_readme_snippets.py
110111

111112
test-no-providers: ## Run tests that verify behavior when provider SDKs are missing
@@ -208,6 +209,16 @@ check-notices: ## Check that THIRD_PARTY_NOTICES.md is up to date (run make gene
208209
check-extra-pins: ## Assert root pyproject lower bounds match workspace member versions
209210
uv run python tools/check_extra_pins.py
210211

212+
check-workspace-pins: ## Assert PACKAGE pins equal VERSION in root and libs (used by the release workflow)
213+
@test -n "$(PACKAGE)" || { echo "PACKAGE is required (e.g. PACKAGE=giskard-checks VERSION=1.0.3)"; exit 1; }
214+
@test -n "$(VERSION)" || { echo "VERSION is required (e.g. PACKAGE=giskard-checks VERSION=1.0.3)"; exit 1; }
215+
uv run python tools/check_extra_pins.py "$(PACKAGE)" "$(VERSION)"
216+
217+
bump-workspace-pins: ## Rewrite >= pins for PACKAGE to VERSION (used by the release workflow)
218+
@test -n "$(PACKAGE)" || { echo "PACKAGE is required (e.g. PACKAGE=giskard-checks VERSION=1.0.3)"; exit 1; }
219+
@test -n "$(VERSION)" || { echo "VERSION is required (e.g. PACKAGE=giskard-checks VERSION=1.0.3)"; exit 1; }
220+
uv run python tools/bump_workspace_pins.py "$(PACKAGE)" "$(VERSION)"
221+
211222
check: lint check-format check-compat typecheck security check-licenses check-notices check-extra-pins ## Run all checks
212223

213224
clean: ## Clean up build artifacts and caches

THIRD_PARTY_NOTICES.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,14 +157,14 @@ Find a list of packages below
157157
- License: MIT License
158158
- Compatible: True
159159

160-
### boto3-1.43.80
160+
### boto3-1.43.81
161161

162162
- HomePage: https://github.com/boto/boto3
163163
- Author: Amazon Web Services
164164
- License: Apache-2.0
165165
- Compatible: True
166166

167-
### botocore-1.43.80
167+
### botocore-1.43.81
168168

169169
- HomePage: https://github.com/boto/botocore
170170
- Author: Amazon Web Services

libs/giskard-scan/pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ license = { text = "Apache Software License 2.0" }
77
authors = [{ name = "Giskard R&D", email = "rnd@giskard.ai" }]
88
requires-python = ">=3.12"
99
dependencies = [
10-
"giskard-checks>=1.0.2,<2",
10+
"giskard-checks>=1.0.3,<2",
1111
"giskard-agents>=1.0.2,<2",
1212
"numpy>=2.4.1,<3",
1313
"huggingface-hub>=1.11.0,<2",

pyproject.toml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ classifiers = [
1919
"Programming Language :: Python :: 3.14",
2020
]
2121

22-
dependencies = ["giskard-checks>=1.0.2,<2"]
22+
dependencies = ["giskard-checks>=1.0.3,<2"]
2323

2424
requires-python = ">=3.12"
2525

@@ -34,7 +34,7 @@ azure = ["giskard-llm[azure]>=1.0.0,<2"]
3434
litellm = ["giskard-agents[litellm]>=1.0.2,<2"]
3535

3636
# Optional checks dependencies
37-
regorus = ["giskard-checks[regorus]>=1.0.2,<2"]
37+
regorus = ["giskard-checks[regorus]>=1.0.3,<2"]
3838

3939
# Optional giskard libs
4040
scan = ["giskard-scan>=1.0.0,<2"]
@@ -45,7 +45,7 @@ deepteam = ["giskard-scan[deepteam]>=1.0.0,<2"] # Heavy dep, not included by def
4545

4646
# Aggregated packages
4747
all-llms = ["giskard-llm[all]>=1.0.0,<2"] # Install all native LLM providers
48-
all-checks = ["giskard-checks[all]>=1.0.2,<2"] # Install all optional checks dependencies
48+
all-checks = ["giskard-checks[all]>=1.0.3,<2"] # Install all optional checks dependencies
4949
full = ["giskard[all-llms,all-checks,scan,litellm]"]
5050

5151
[project.urls]

tools/bump_workspace_pins.py

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
"""Rewrite >= lower bounds for a workspace package across pyproject files.
2+
3+
Used by the release workflow after ``uv version`` so root extras (and
4+
downstream lib pins) stay aligned with the member version that
5+
``check_extra_pins PACKAGE VERSION`` enforces.
6+
"""
7+
8+
import re
9+
import sys
10+
from pathlib import Path
11+
12+
from packaging.utils import canonicalize_name
13+
from packaging.version import InvalidVersion, Version
14+
15+
REPO_ROOT = Path(__file__).resolve().parents[1]
16+
17+
# PEP 508 name + optional extras + >= lower bound. Trailing upper bounds,
18+
# markers, and comments are left untouched.
19+
_PIN_RE = re.compile(
20+
r"(?P<name>[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)"
21+
r"(?P<extra>\[[^\]]+\])?"
22+
r"(?P<op>\s*>=\s*)"
23+
r"(?P<version>[^,<\"'\s]+)"
24+
)
25+
26+
27+
def rewrite_text(text: str, package: str, new_version: str) -> tuple[str, int]:
28+
"""Replace ``>=`` pins for ``package`` in a pyproject document.
29+
30+
Parameters
31+
----------
32+
text : str
33+
Raw ``pyproject.toml`` contents.
34+
package : str
35+
Distribution name to update (hyphen or underscore form).
36+
new_version : str
37+
Replacement lower bound (PEP 440).
38+
39+
Returns
40+
-------
41+
tuple[str, int]
42+
Rewritten text and the number of pins that named ``package``.
43+
"""
44+
target = canonicalize_name(package)
45+
count = 0
46+
47+
def repl(match: re.Match[str]) -> str:
48+
nonlocal count
49+
if canonicalize_name(match.group("name")) != target:
50+
return match.group(0)
51+
count += 1
52+
extra = match.group("extra") or ""
53+
return f"{match.group('name')}{extra}{match.group('op')}{new_version}"
54+
55+
return _PIN_RE.sub(repl, text), count
56+
57+
58+
def pyproject_paths(repo_root: Path) -> list[Path]:
59+
"""Return root and ``libs/*/pyproject.toml`` paths that exist."""
60+
paths = [repo_root / "pyproject.toml"]
61+
libs = repo_root / "libs"
62+
if libs.is_dir():
63+
paths.extend(sorted(libs.glob("*/pyproject.toml")))
64+
return [path for path in paths if path.is_file()]
65+
66+
67+
def bump_pins(
68+
repo_root: Path, package: str, new_version: str
69+
) -> list[tuple[Path, int]]:
70+
"""Write updated pins for ``package`` under ``repo_root``.
71+
72+
Parameters
73+
----------
74+
repo_root : Path
75+
Monorepo root containing ``pyproject.toml`` and ``libs/``.
76+
package : str
77+
Distribution name whose ``>=`` pins should move.
78+
new_version : str
79+
Replacement lower bound (PEP 440).
80+
81+
Returns
82+
-------
83+
list[tuple[Path, int]]
84+
Files that changed, with the pin count in each file.
85+
"""
86+
try:
87+
Version(new_version)
88+
except InvalidVersion as exc:
89+
raise SystemExit(f"invalid version {new_version!r}: {exc}") from exc
90+
91+
results: list[tuple[Path, int]] = []
92+
for path in pyproject_paths(repo_root):
93+
original = path.read_text(encoding="utf-8")
94+
updated, count = rewrite_text(original, package, new_version)
95+
if updated == original:
96+
continue
97+
path.write_text(updated, encoding="utf-8")
98+
results.append((path, count))
99+
return results
100+
101+
102+
def main(argv: list[str] | None = None) -> int:
103+
"""Rewrite pins for ``PACKAGE VERSION``. Returns a process exit code."""
104+
args = sys.argv[1:] if argv is None else argv
105+
if len(args) != 2:
106+
print("usage: bump_workspace_pins.py PACKAGE VERSION", file=sys.stderr)
107+
return 2
108+
109+
package, version = args
110+
results = bump_pins(REPO_ROOT, package, version)
111+
if not results:
112+
print(f"No {package} pins to update.")
113+
return 0
114+
for path, count in results:
115+
print(f"Updated {count} pin(s) in {path.relative_to(REPO_ROOT)}")
116+
return 0
117+
118+
119+
if __name__ == "__main__":
120+
raise SystemExit(main())

0 commit comments

Comments
 (0)