Repository navigation
🐛 fix(cooled-prek): parse static f-string pins - #61
Merged
Merged
Conversation
This was referenced Nov 10, 2026
gaborbernat
added a commit
that referenced
this pull request
Nov 10, 2026
Windows builds that install release tools through `install-locked-tools` fail at `📦 Install lock reader` since [#61](#61) moved the installer to Python: [tox-dev/pipdeptree#884](tox-dev/pipdeptree#884) lost all seven Windows wheel jobs to `failed to copy file ... to C:\a\_temp\lock-reader\Scripts\python.exe: The process cannot access the file`. 🐛 Linux and macOS jobs were unaffected. The action ran the installer with the lock reader's own interpreter, and the installer's first step recreates that same environment. Windows does not let a running `python.exe` be replaced, so `uv venv` failed. The installer now runs on a separate Python 3.15 and still installs into the lock reader. On the Windows VM, the old invocation fails with `Access is denied` while the new one installs `packaging`.
gaborbernat
added a commit
to tox-dev/pipdeptree
that referenced
this pull request
Nov 10, 2026
Older cooldown workflows can reject a hook bump when its package pin is a static f-string, even if the package meets the cutoff ([shared fix](tox-dev/github-workflows#61)). pipdeptree's CI calls the shared workflow for its hook gate; pinning that call to [6.7.3](https://github.com/tox-dev/github-workflows/releases/tag/6.7.3) gives maintainers the fix.
gaborbernat
added a commit
to tox-dev/python-sbom
that referenced
this pull request
Nov 10, 2026
Older cooldown workflows can reject a hook bump when its package pin is a static f-string, even if the package meets the cutoff ([shared fix](tox-dev/github-workflows#61)). python-sbom's CI calls the shared workflow for its hook gate; pinning that call to [6.7.3](https://github.com/tox-dev/github-workflows/releases/tag/6.7.3) gives maintainers the fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
virtualenv#3535 cannot install the bumped
typoshook under the seven-day cooldown. The hook's pinnedsetup.pydeclares its PyPI dependency through a static f-string, which the shared workflow did not recognize. This affects maintainers of projects that use the shared cooldown workflow.The cooldown reader now extracts static pins from hook package source and sets a per-package cutoff just after each pinned release's upload time. This lets the exact pin install under the seven-day cooldown. The reader does not execute the package source.
The three Bash helpers in
tools/handled cooled hooks, live tool installs, and pluralized output. They are now Python scripts, removing every Bash file from that directory. The cooldown reader's package metadata logic no longer lives inside a shell script. The locked-tools Action invokes the installer through its managed interpreter, so it does not depend onpython3being on PATH.