ci: locked dependency installs — stop lane-pin thrash from PyPI drift #48

Merged

core-labs merged 1 commit from fix/ci-locked-installs into main

2026-07-16 12:56:27 +00:00

core-labs commented

2026-07-16 02:48:47 +00:00

Owner

Summary

PRs #46/#47 both failed lane-shas with diffs no lane executes, while main stayed green — classic environment drift: workflows install unlocked (uv pip install -e ., floor-only specs) although uv.lock exists. A PyPI release between runs shifts the runner's resolved deps and the byte-exact lane pins move with it (the remaining vector of the #37-era pin-thrash class).

Fix: all six workflows install the locked universe (uv sync --locked, --extra dev where [dev] was installed). Lane pins can now only move when code moves; a stale lock fails loudly instead of resolving silently.

Evidence: identical failing-PR tree verifies 9/9 pinned SHAs locally against the locked venv; uv lock --check clean; local smoke 175 passed. Self-validating — this PR's own lane-shas run uses this branch's workflow.

After merge: I update #46/#47 branches so their re-runs inherit the fix.

[Verification]: Smoke suite passed locally (175 passed); lane repro 9/9; lock check clean

## Summary PRs #46/#47 both failed lane-shas with diffs no lane executes, while main stayed green — classic environment drift: workflows install unlocked (`uv pip install -e .`, floor-only specs) although `uv.lock` exists. A PyPI release between runs shifts the runner's resolved deps and the byte-exact lane pins move with it (the remaining vector of the #37-era pin-thrash class). **Fix:** all six workflows install the locked universe (`uv sync --locked`, `--extra dev` where `[dev]` was installed). Lane pins can now only move when code moves; a stale lock fails loudly instead of resolving silently. **Evidence:** identical failing-PR tree verifies **9/9 pinned SHAs locally** against the locked venv; `uv lock --check` clean; local smoke 175 passed. Self-validating — this PR's own lane-shas run uses this branch's workflow. **After merge:** I update #46/#47 branches so their re-runs inherit the fix. [Verification]: Smoke suite passed locally (175 passed); lane repro 9/9; lock check clean

core-labs added 1 commit 2026-07-16 02:48:56 +00:00

ci: install locked dependency universe in all workflows (uv sync --locked)

smoke / smoke (-m "not quarantine") (pull_request) Failing after 1m13s

Details

lane-shas / verify pinned lane SHAs (pull_request) Failing after 16m56s

Details

576c2e13e3

Root cause of the simultaneous lane-shas failures on PRs #46 and #47:
workflows installed with unlocked 'uv pip install -e .' against floor-only
specs (numpy>=1.26, ...) while the repo maintains uv.lock — so a PyPI
release landing between runs shifts the runner's resolved set, and the
byte-exact lane SHA pins move with it. Timeline: main lane run green at
23:40Z, both PR runs (diffs no lane executes) red after 00:02Z; the
identical trees verify 9/9 locally against the locked venv, and
'uv lock --check' is clean.

All six workflows now 'uv sync --locked' (--extra dev where [dev] was
installed) — CI tests the locked universe, so lane pins can only move when
code moves. Locked-sync also fails loudly on a stale lock instead of
silently resolving fresh.

Self-validating: this PR's own lane-shas run uses this branch's workflow.

[Verification]: smoke suite passed locally (175 passed); lane repro on the
failing PRs' tree: 9/9 pinned SHAs; uv lock --check clean.