Skip to content

Commit 280b956

Browse files
authored
ci: run the floors job on pull requests and drop the release floors gate (#257)
1 parent c312fd2 commit 280b956

5 files changed

Lines changed: 10 additions & 83 deletions

File tree

‎.github/scripts/report-scheduled-failure.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,10 @@ gh label create "$LABEL" \
1616
existing=$(gh issue list --label "$LABEL" --state open --json number --jq '.[0].number // empty')
1717

1818
if [ -z "$existing" ]; then
19-
body=$(printf '%s\n\n%s\n\n%s\n\n%s\n\n%s' \
19+
body=$(printf '%s\n\n%s\n\n%s\n\n%s' \
2020
"The scheduled dependency check failed." \
2121
"First failing run: ${RUN_URL}" \
2222
"Likely cause, if a lint or pytest job failed: a dev or lint dependency (ruff, ty, eof-fixer, pytest, typing-extensions) released a breaking change. Reproduce locally with \`just install\` then \`just lint\` and \`just test\`." \
23-
"Likely cause, if a lowest-direct job failed: a declared floor in \`pyproject.toml\` no longer installs or bootstraps, usually because an upstream package changed metadata under it. Reproduce with \`uv pip install --resolution lowest-direct '.[<extras>]'\` then \`python scripts/floor_smoke.py <target>\`, reading both off the failing job's matrix." \
2423
"Close this issue once fixed. The next scheduled failure will open a fresh issue.")
2524
gh issue create --title "$TITLE" --label "$LABEL" --body "$body"
2625
else

‎.github/scripts/require-floor-run.sh‎

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎.github/workflows/_checks.yml‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,6 @@
11
name: checks
22
on:
3-
workflow_call:
4-
inputs:
5-
lowest-direct:
6-
description: >-
7-
Run the declared dependency floors. Off for PRs: the job resolves direct dependencies at
8-
their floor and transitives at their newest, so a release published upstream today can
9-
turn it red for reasons no PR here caused. scheduled.yml turns it on, where that failure
10-
opens a tracking issue instead of blocking a merge.
11-
type: boolean
12-
default: false
3+
workflow_call: {}
134

145
jobs:
156
lint:
@@ -131,7 +122,7 @@ jobs:
131122
if [ -n "$failed" ]; then echo "::error::extras failed isolated install+import:$failed"; exit 1; fi
132123
echo "all extras install and import in isolation"
133124
134-
lowest-direct:
125+
floors:
135126
# Every other job resolves newest, so a declared floor is a claim nothing checks. This one
136127
# pins each direct dependency to the floor pyproject.toml declares and bootstraps against it.
137128
# Per framework rather than all-extras at once: a floor declared in one extra pulls the shared
@@ -141,7 +132,7 @@ jobs:
141132
# deliberately did not install as unresolved. So nothing type-checks at the floor - an
142133
# annotation naming an optional dependency's internals has to span the declared range, and only
143134
# a human checks that.
144-
if: inputs.lowest-direct
135+
if: github.event_name != 'schedule'
145136
runs-on: ubuntu-latest
146137
strategy:
147138
fail-fast: false

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,22 @@ name: Release
44
# GitHub Release. Replaces the old `on: release: published` publish.yml — that
55
# trigger is removed so the published Release this workflow creates can't re-fire
66
# it (double-publish). The tag is the sole entry point; by convention a tag is
7-
# only cut off a green main, so the sole in-workflow gate is floors-gate below,
8-
# covering the one check that never runs on pull requests.
7+
# only cut off a green main, so there is no in-workflow CI gate.
98
on:
109
push:
1110
tags:
1211
- '[0-9]+.[0-9]+.[0-9]+' # stable: 2.7.2
1312
- '[0-9]+.[0-9]+.[0-9]+[a-z]+[0-9]+' # pre-release: 2.0.0rc1, 4.0.0a2
1413

15-
permissions: {}
14+
# contents: write -> create the GitHub Release; id-token: write -> OIDC for PyPI Trusted Publishing.
15+
permissions:
16+
contents: write
17+
id-token: write
1618

1719
jobs:
18-
# Gates the tag on the dependency floors, which _checks.yml runs only for scheduled.yml, never
19-
# for pull requests. A floor break can therefore merge with every check green, which is how the
20-
# crash in 1.8.0 reached PyPI (#245). Placed before release so a failure costs nothing.
21-
floors-gate:
22-
runs-on: ubuntu-latest
23-
# contents: read -> the history the ancestor check walks; actions: read -> list workflow runs.
24-
permissions:
25-
contents: read
26-
actions: read
27-
steps:
28-
- uses: actions/checkout@v6
29-
with:
30-
fetch-depth: 0 # the ancestor check needs history, not just the tagged commit
31-
- run: .github/scripts/require-floor-run.sh
32-
env:
33-
GH_TOKEN: ${{ github.token }}
34-
3520
release:
36-
needs: floors-gate
3721
runs-on: ubuntu-latest
3822
environment: pypi # scopes the PyPI Trusted Publisher; hook for approval rules
39-
# contents: write -> create the GitHub Release; id-token: write -> OIDC for PyPI Trusted Publishing.
40-
permissions:
41-
contents: write
42-
id-token: write
4323
steps:
4424
- uses: actions/checkout@v6
4525
- uses: extractions/setup-just@v4

‎.github/workflows/scheduled.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: scheduled-dep-check
22
on:
33
schedule:
4-
# Daily: both resolutions here are unpinned, so an upstream release can break main
4+
# Daily: the resolution here is unpinned, so an upstream release can break main
55
# between runs. Daily bounds that window at a day and attributes the failure to upstream
66
# (a tracking issue) instead of to whichever pull request happens to run next.
77
- cron: "0 6 * * *" # daily 06:00 UTC
@@ -14,8 +14,6 @@ concurrency:
1414
jobs:
1515
checks:
1616
uses: ./.github/workflows/_checks.yml
17-
with:
18-
lowest-direct: true
1917

2018
report-failure:
2119
needs: checks

0 commit comments

Comments
 (0)