Repository navigation
Provide a full local CI profile for WUP code and dependency changes #9
Description
The deployed OneDev profile for semcod/wup runs only the locked-manifest gate. PR #5 at 730fb74 fails exact merge-result validation with LOCKED_MANIFEST_DIFF_SCOPE_MISMATCH because it changes application code and refreshes pyproject.toml/uv.lock. The profile also pins the old main digests, so it cannot validate dependency updates.
Acceptance criteria:
- Replace or extend the WUP local verification profile with a protected, networkless exact-merge-result suite that covers root WUP on Python 3.10+ and workspace packages on their declared Python 3.11+ floor, plus required dependency lock checks.
- Bake a pinned wheelhouse for the selected test group into the protected image; the suite must not depend on a mutable host cache or network access.
- Keep the profile scope and immutable dependency inputs explicit; do not use a mutable host checkout or a self-reported status.
- Deploy through the OneDev configuration process and obtain a successful canary status for a deliberately valid WUP PR.
- Add a regression test for the profile and document supported change classes.
The deployed OneDev profile for semcod/wup runs only the locked-manifest gate. PR #5 at 730fb74 fails exact merge-result validation with LOCKED_MANIFEST_DIFF_SCOPE_MISMATCH because it changes application code and refreshes pyproject.toml/uv.lock. The profile also pins the old main digests, so it cannot validate dependency updates.
Acceptance criteria:
- Replace or extend the WUP local verification profile with a protected, networkless exact-merge-result suite that covers root WUP on Python 3.10+ and workspace packages on their declared Python 3.11+ floor, plus required dependency lock checks.
- Bake a pinned wheelhouse for the selected test group into the protected image; the suite must not depend on a mutable host cache or network access.
- Keep the profile scope and immutable dependency inputs explicit; do not use a mutable host checkout or a self-reported status.
- Deploy through the OneDev configuration process and obtain a successful canary status for a deliberately valid WUP PR.
- Add a regression test for the profile and document supported change classes.
Activity
tom-sapletta-com commentedon Sep 14, 2026
2026-09-14 evidence: exact local retry of PR #5 at
eec8225bc09c864f26411ed9f7dc63d9ffeb7258failed because the deployed executor lacks/app/docker/pr/check-locked-manifest.py, while its protected configuration invokes that path. The source repository contains the script, so this is an image/config deployment mismatch. The profile remains declared/configured only; it is not deployed or verified until image and profile reconciliation plus a successful canary.tom-sapletta-com commentedon Sep 14, 2026
Root-cause automation is tracked in https://github.com/subactor/onedev-agent/issues/341. It will reject a deployed executor image when any configured verification command is absent, bind image/config digests into the receipt, and require a configured-profile canary.
tom-sapletta-com commentedon Sep 14, 2026
Deployment candidate is now validated upstream:
ifuri-onedev-agent:locked-manifest-333contains the checker and its 28 locked-manifest regressions pass. The live executor still selects a different image, so PR #5 remains correctly unverified until protected deployment and a real canary. Tracking: https://github.com/subactor/onedev-agent/issues/333tom-sapletta-com commentedon Sep 14, 2026
Deployed canary receipt, 2026-09-14: image/profile digest
1d587d1fa59bce9843dba8253654c3426acd6ffb3dc1cb5b38ecb57bc984da80executed WUP PR #5 headeec8225bc09c864f26411ed9f7dc63d9ffeb7258against mainc12616662a5d958714b797eee7a6e668a16313b3. The checker file is now present. It failed with the intendedLOCKED_MANIFEST_DEPENDENCY_PIN_MISMATCH, proving the remaining blocker is the stale manifest-only profile, not executor deployment. The full protected WUP test profile in this issue remains required.tom-sapletta-com commentedon Sep 14, 2026
Implementation-ready profile contract: build an immutable WUP test lane from the merged
uv.lock, install only--no-default-groups --group test(the automation group remains excluded), and runpytest -qplusruff check .against the exact merge result. The root project declares Python >=3.10; its six workspace packages need their declared 3.11+ floor, so the protected profile must include the required interpreter matrix. Candidate execution must use the baked wheelhouse and--no-index; it must reject changed/missing lock inputs and never let a PR install dependencies. The existing manifest-only checker cannot be repinned as a substitute because PR #5 also changes implementation and tests.tom-sapletta-com commentedon Sep 14, 2026
Additional matrix finding: root WUP declares
requires-python >=3.10, while every workspace package (uri2wup,dsl2wup,nlp2wup,cli2wup,mcp2wup,rest2wup) declares>=3.11and all are in the currenttestdependency group. Therefore a fulluv sync --group testcannot be the Python 3.10 lane. The profile must split a root-only 3.10 test group from workspace-inclusive 3.11+ lanes, with separate locked inputs and offline wheelhouses.tom-sapletta-com commentedon Sep 14, 2026
WUP head is
a4cd89196d16cf52114601e1ac91d8fae54373a2.The workspace package metadata now declares the same Python 3.10 floor as WUP, after full validation established that the code and locked dependency set support it. The test lanes are explicit:
test-rootis a small WUP-only lane andtestremains the complete WUP/workspace lane. This removes the resolver conflict that previously prevented a Python 3.10 protected image.Exact input digests for the next profile image:
pyproject.toml:8b2f878c512c84520cdffe50864a164e86d3f853631d8b2181e1c6f2e1cf1da8uv.lock:1ce1a3d00aa495c86746835aadadce926b2880746d33df213f4b6d5de874d2f7Verification:
uv lock --check; completetestgroup on CPython 3.10.20 and CPython 3.13.12:399 passedin each lane; Ruff passed in both lanes.tom-sapletta-com commentedon Sep 14, 2026
The protected full WUP profile is proposed in subactor/onedev-agent PR #343 (head
a4ad78ca767104c370878d0178b1b795d46a57b1). It binds the current WUP source revisione3ac729038a1f6c0c0425e40700f8fc3aaf12919; the pinnedpyproject.tomlanduv.lockhashes remain unchanged.Profile tests, configuration and documentation passed locally (45 tests), and the derived-image preflight verified both WUP input hashes before creating the locked Python environments. This is proposed source evidence only. The required next evidence is protected-image build/deployment, independent Validator review and an exact-head/current-base/merge canary for WUP PR #5.
6 remaining items