From 29fe074b0f387be67bf0cf0c68b60e1331b8bb8a Mon Sep 17 00:00:00 2001
From: Copilot App <223556219+Copilot@users.noreply.github.com>
Date: Thu, 2 Jul 2026 03:15:02 +0000
Subject: [PATCH 1/2] dependency-security-sync: generate stylechecker with
 --dev-only

The stylechecker image only needs the dev tool-chain (flake8/black/isort). pipenv requirements --dev emits dev deps PLUS the full runtime graph (~55 extra pins), bloating stylechecker/requirements.txt. --dev-only emits just the dev group, matching the images intent and prior hand-maintained content.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/dependency-security-sync.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependency-security-sync.yml b/.github/workflows/dependency-security-sync.yml
index 7e4fa00..2f72441 100644
--- a/.github/workflows/dependency-security-sync.yml
+++ b/.github/workflows/dependency-security-sync.yml
@@ -120,11 +120,11 @@ jobs:
         run: |
           cd citus/src/test/regress
           base=$(pipenv requirements)
-          dev=$(pipenv requirements --dev)
+          dev=$(pipenv requirements --dev-only)
           cd "$GITHUB_WORKSPACE"
           ref="citusdata/citus#${CITUS_PR}"
           base_header=$'# generated from Citus\'s Pipfile.lock (in src/test/regress) as of '"${ref}"$'\n# using `pipenv requirements > requirements.txt`, so as to avoid the\n# need for pipenv/pyenv in this image\n\n'
-          dev_header=$'# generated from Citus\'s Pipfile.lock (in src/test/regress) as of '"${ref}"$'\n# using `pipenv requirements --dev > requirements.txt`, so as to avoid the\n# need for pipenv/pyenv in this image\n\n'
+          dev_header=$'# generated from Citus\'s Pipfile.lock (in src/test/regress) as of '"${ref}"$'\n# using `pipenv requirements --dev-only > requirements.txt`, so as to avoid the\n# need for pipenv/pyenv in this image\n\n'
           for f in \
             circleci/images/citusupgradetester/files/etc/requirements.txt \
             circleci/images/failtester/files/etc/requirements.txt \

From 7345d965f88eb11f72645c8c69bc94c1c8cdbc79 Mon Sep 17 00:00:00 2001
From: Ibrahim Halatci <ihalatci@gmail.com>
Date: Thu, 2 Jul 2026 05:48:22 +0000
Subject: [PATCH 2/2] Point citus CI at the-process dev image; broaden
 post-merge swap

Fix A: the sync workflow now repoints the citus PR image_suffix at the
freshly built the-process dev image (-dev-<tp_sha>) so citus CI validates
the newly synced requirements instead of a stale committed image.

Post-merge dev->stable swap broadened to also recognize a -dev-<hex>
suffix (delimiter switched | -> # so the (v|dev-) alternation is valid);
output stays stable -v<merge_sha>.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../dependency-security-post-merge.yml        |  2 +-
 .../workflows/dependency-security-sync.yml    | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dependency-security-post-merge.yml b/.github/workflows/dependency-security-post-merge.yml
index 83f085a..9579af7 100644
--- a/.github/workflows/dependency-security-post-merge.yml
+++ b/.github/workflows/dependency-security-post-merge.yml
@@ -119,7 +119,7 @@ jobs:
           postfix="-v${short_sha}"
 
           cd citus
-          sed -i -E "s|(image_suffix:\s*)\"-v[0-9a-f]+\"|\1\"${postfix}\"|" .github/workflows/build_and_test.yml
+          sed -i -E "s#(image_suffix:\s*)\"-(v|dev-)[0-9a-f]+\"#\1\"${postfix}\"#" .github/workflows/build_and_test.yml
 
           if git diff --quiet -- .github/workflows/build_and_test.yml; then
             echo "No build_and_test.yml image_suffix change needed."
diff --git a/.github/workflows/dependency-security-sync.yml b/.github/workflows/dependency-security-sync.yml
index 2f72441..ff7c0b3 100644
--- a/.github/workflows/dependency-security-sync.yml
+++ b/.github/workflows/dependency-security-sync.yml
@@ -184,6 +184,28 @@ jobs:
           fi
           echo "THE_PROCESS_PR=$pr_number" >> "$GITHUB_ENV"
 
+      - name: Point citus CI at the-process dev image
+        if: steps.sync.outputs.addressed != ''
+        run: |
+          # Synced requirements ship in the-process dev images tagged -dev-<sha>
+          # built when the automation branch is pushed. Point the citus PR at that
+          # image so its CI validates the new deps (skip if nothing was rebuilt).
+          if [ "$(git rev-list --count origin/master..HEAD)" -eq 0 ]; then
+            echo "No the-process commit; leaving citus image_suffix unchanged."
+            exit 0
+          fi
+          tp_sha=$(git rev-parse --short HEAD)
+          cd citus
+          source "$GITHUB_WORKSPACE/.github/scripts/safe_push.sh"
+          sed -i -E "s|(image_suffix:\s*)\"[^\"]*\"|\1\"-dev-${tp_sha}\"|" .github/workflows/build_and_test.yml
+          if git diff --quiet -- .github/workflows/build_and_test.yml; then
+            echo "citus image_suffix already -dev-${tp_sha}."
+          else
+            git add .github/workflows/build_and_test.yml
+            git commit -m "Point CI at the-process dev image for synced requirements"
+            safe_push automation/dependency-security-sync origin/main
+          fi
+
       - name: Summary
         if: steps.alerts.outputs.count != '0'
         run: |