sneak/prompts

Keep a Python test phase's lockfile install in check builds #135

Open

clawbot wants to merge 4 commits from issue-133-python-lockfile-install into next

Author	SHA1	Message	Date
sneak	14e79875e1	Say what a kept Python layer may not share with a new install (closes #133 ) check / check (push) Waiting to run Details A kept layer holds nothing a new install would refuse, since pip and pipenv checked every package against its hash. A package built from source uses build tools pip downloads without a hash check, and system packages may be newer in a new install, so those two can differ. The TODO.md entry says the same. Model: opus-5-5	2026-10-21 16:21:30 +00:00
sneak	899beebc1f	Name no package the virtualenv gets (closes #133 ) check / check (push) Canceled after 0s Details virtualenv adds setuptools to a new virtualenv only on Python before 3.12, so the policy now says "the packages virtualenv puts into" the virtualenv instead of naming pip and setuptools. Model: opus-5-5	2026-10-21 16:06:05 +00:00
sneak	a3ec8461af	Pin pipenv by hash and keep one form of the Python lockfile install (closes #133 ) check / check (push) Canceled after 0s Details Rework of #135 on the review at #135 (comment). A Python test phase now has one form: COPY script/, COPY Pipfile Pipfile.lock, RUN script/bootstrap, then ARG CACHEBUST, and every list of what goes above the line names that step. In that step script/bootstrap installs only system packages, pipenv and its dependencies by hash with pip --require-hashes, and the lockfile's packages, and no Python. The claim about a kept layer covers only what is pinned by hash and says its system packages may be older. The bold rule is conditional, the script/cibuild items expect the step to show CACHED, and the example says why it installs make and git. Model: opus-5-5	2026-10-21 15:48:09 +00:00
sneak	83f148f3b2	Keep a Python test phase's lockfile install in check builds (closes #133 ) check / check (push) Canceled after 0s Details On sneak's ruling in sneak/rfscan#80 (comment), a Python test phase installs its packages from Pipfile.lock above ARG CACHEBUST, so Docker keeps them until the base image, Pipfile, Pipfile.lock or a line up to the install changes. The step is COPY Pipfile Pipfile.lock ./ and one RUN of pipenv install --deploy, or a script/bootstrap that installs nothing beyond system packages, the pinned pipenv and the lockfile's packages. --deploy installs only what the lockfile names and checks its hashes. The tests, and every other stage's Python installs, stay after the line. REPO_POLICIES.md gains a short example; both checklists and the README state the rule the same way. Model: opus-5-5	2026-10-21 15:11:57 +00:00