Pin the four dependency branches left floating in the lockfiles - #4244
Open
tas50 wants to merge 1 commit into
Open
Pin the four dependency branches left floating in the lockfiles#4244tas50 wants to merge 1 commit into
tas50 wants to merge 1 commit into
Conversation
Six lockfile entries across the three services record a branch instead of a commit: bookshelf erlcloud chef/erlcloud CHEF-11677/CHEF-12498/lbaker bookshelf erlsom chef/erlsom integer_long_string_probs2 bookshelf mini_s3 chef/mini_s3 CHEF-11677/CHEF-12498/lbaker bookshelf sqerl chef/sqerl shahid/sqerl-erl27.3-pg16.1 oc_bifrost sqerl chef/sqerl shahid/sqerl-erl27.3-pg16.1 oc_erchef sqerl chef/sqerl shahid/sqerl-erl27.3-pg16.1 A branch in rebar.config is a statement of intent; a branch in rebar.lock defeats the point of the lock. Two builds of the same chef-server commit can embed different dependency code with no record of either, and the build breaks outright if one of these branches is force-pushed, renamed or deleted. Three of the four are personal or ticket branches rather than a maintained line, and sqerl is pinned this way in all three services. Each entry is pinned to the commit its branch points at today, so this records what is already being built rather than moving anything: erlcloud 398d67ecfe6d398a444d42ab9e94e8b1df0171a5 (2024-11-26) erlsom 131e660ee39254a58b75075e07dfd742f445bfce (2013-04-06) mini_s3 aa206d4d5a8380aff68629b46c15b87931e5c801 (2025-07-27) sqerl bc1fbb57df0ce1c3d7aeb8733c1ffa2b8ebbca2c (2026-05-08) The rebar.config entries are left alone: the lock is what governs resolution, and changing the declared branches is a separate decision about which line each dependency should track. Verified in erlang:26 containers: bookshelf (all four dependencies) and oc_bifrost both compile from a clean _build, and oc_bifrost fetches sqerl at exactly bc1fbb57df0ce1c3d7aeb8733c1ffa2b8ebbca2c. No lockfile entry now records a branch. Signed-off-by: Tim Smith <tim@mondoo.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Six lockfile entries across the three services record a branch instead of a commit:
erlcloudchef/erlcloudCHEF-11677/CHEF-12498/lbakererlsomchef/erlsominteger_long_string_probs2mini_s3chef/mini_s3CHEF-11677/CHEF-12498/lbakersqerlchef/sqerlshahid/sqerl-erl27.3-pg16.1sqerlchef/sqerlshahid/sqerl-erl27.3-pg16.1sqerlchef/sqerlshahid/sqerl-erl27.3-pg16.1A branch in
rebar.configis a statement of intent. A branch inrebar.lockdefeats the point of the lock. Two builds of the same chef-server commit can embed different dependency code with no record of either, and the build breaks outright if one of these branches is force-pushed, renamed or deleted.Three of the four are personal or ticket branches rather than a maintained line, and
sqerlis pinned this way in all three services.What this changes
Each entry is pinned to the commit its branch points at today, so this records what is already being built rather than moving anything:
erlcloud398d67ecfe6d398a444d42ab9e94e8b1df0171a5erlsom131e660ee39254a58b75075e07dfd742f445bfcemini_s3aa206d4d5a8380aff68629b46c15b87931e5c801sqerlbc1fbb57df0ce1c3d7aeb8733c1ffa2b8ebbca2cThe
rebar.configentries are deliberately left alone: the lock governs resolution, and changing the declared branches is a separate decision about which line each dependency should track.Verified
In
erlang:26containers, from a clean_build:sqerlat exactlybc1fbb57df0ce1c3d7aeb8733c1ffa2b8ebbca2c.