dependency-security-sync: generate stylechecker with --dev-only#231
Merged
Conversation
The stylechecker image only needs the dev tool-chain (flake8/black/isort). pipenv requirements --dev emits dev deps PLUS the full runtime graph (~55 extra pins), bloating stylechecker/requirements.txt. --dev-only emits just the dev group, matching the images intent and prior hand-maintained content. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Fix A: the sync workflow now repoints the citus PR image_suffix at the freshly built the-process dev image (-dev-<tp_sha>) so citus CI validates the newly synced requirements instead of a stale committed image. Post-merge dev->stable swap broadened to also recognize a -dev-<hex> suffix (delimiter switched | -> # so the (v|dev-) alternation is valid); output stays stable -v<merge_sha>. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The requirements-generation step in
dependency-security-sync.ymlbuilds thestylecheckerimage'srequirements.txtwith:pipenv requirements --devemits the dev group plus the entire runtimedependency graph (~55 extra pins). The stylechecker image only needs the dev
tool-chain (flake8 / black / isort), so this bloats
circleci/images/stylechecker/files/etc/requirements.txton every sync run anddiverges from the prior hand-maintained content.
Fix
Use
--dev-only, which emits just the dev group. Two edits (+2/-2): thegeneration command and the matching
dev_headercomment string.Notes
phased scope. Auth continues to use the
vars.GH_APP_IDapp-token pattern.regenerated (clean,
--dev-only) stylechecker so it does not regress master;this PR fixes the generator so future runs stay clean.
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com