Repository navigation
build(docker): install image dependencies from uv.lock - #65
Merged
Merged
Conversation
The image resolved dependencies fresh from pyproject.toml's lower bounds, so the same commit could build different images over time and the versions CI tested and pip-audit scanned were not necessarily the ones shipped. Export the lock to a hashed requirements file and install from it, then install the project with --no-deps. CI now runs `uv sync --locked`, so a lock left stale after a pyproject.toml edit fails CI instead of being silently re-resolved — otherwise the image (installing --frozen) would ship versions CI never ran. uv is pinned in the image so the export is stable across builds. The exact idc-index pin stays as the explicit statement of the served IDC release; its comment and the deployment docs now describe the lock as what makes rebuilds deterministic. Closes #57 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟢 Approval recommended
The focused installation and documentation changes are consistent, with no unresolved findings.
No open issues 🎉
What changed in this PR
Aligns Docker runtime dependencies with the lockfile used by CI, addressing dependency drift described in #57.
Changes:
- Pins uv and installs image dependencies from
uv.lock. - Makes CI reject stale lockfiles with
uv sync --locked. - Documents lockfile updates while retaining the exact IDC release pin.
| File | Description |
|---|---|
| pyproject.toml | Updates comments explaining the retained IDC pin. |
| Dockerfile | Installs locked dependencies, then the project without dependency resolution. |
| dev/developer_guide.md | Documents CI’s stale-lockfile check. |
| dev/deployment.md | Updates dependency and IDC release procedures. |
| .github/workflows/ci.yml | Adds --locked to dependency installation. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #57.
What
uv.lockand install from it (option B from the issue):uv export --frozen --no-dev --no-emit-project→uv pip install --system -r, thenuv pip install --system --no-deps ..--no-emit-projectis needed because the default export includes an unhashed-e .line. uv is pinned (0.12.24) so the export is stable across builds.uv sync --locked. Without it, apyproject.tomledit with a stale lock would be silently re-resolved in CI while the image installed the stale lock — CI and image would diverge again, just in the other direction.idc-index==0.13.1pin kept as the explicit statement of the served IDC release (and a guard againstuv lock --upgrademoving it). Its comment anddev/deployment.md§ Updating for a new IDC release now say: bump the pin,uv lock, commit both.dev/developer_guide.mdnotes the--lockedbehavior.No CHANGELOG entry — nothing user-visible changes.
Verification
docker buildsucceeds; the DuckDB bake step runs in the same system environment.uv pip list --system) match the lock export exactly — no lock-only or image-only packages besidespip/uvthemselves./v3/version→{"idc_version":"v25","idc_index_data_version":"25.0.1","api_version":"3.0.0b6"}.idc_apiis installed as a regular (non-editable) package in site-packages.uv sync --locked --extra devpasses locally.🤖 Generated with Claude Code