sneak/prompts

0 Fork 0

Keep a Python test phase's lockfile install in check builds #135

Merged

clawbot merged 6 commits from issue-133-python-lockfile-install into next

2026-10-26 20:39:00 +01:00

Author	SHA1	Message	Date
sneak	a1c58d5899	Split the virtualenv sentence and date the changed documents (closes #133 ) check / check (push) Canceled after 0s Details The kept-layer sentence about the packages virtualenv adds is now two short sentences with the verb early. The policy and both checklists carry today's date as last_modified. Model: opus-5-5	2026-10-26 19:01:19 +00:00
sneak	3215261bbc	List the steps above ARG CACHEBUST and split the long Python install sentences (closes #133 ) check / check (push) Canceled after 0s Details The ARG CACHEBUST rule and the CACHED expectation now list their steps as bullets, the same way in the policy, the README and both checklists. The checklists' Python item and the policy's Python point use shorter sentences with the verb early. The TODO entry no longer counts "no Python" as an install or says "except" where only a difference is meant. Model: opus-5-5	2026-10-26 18:28:35 +00:00
sneak	14e79875e1	Say what a kept Python layer may not share with a new install (closes #133 ) check / check (push) Canceled after 0s Details A kept layer holds nothing a new install would refuse, since pip and pipenv checked every package against its hash. A package built from source uses build tools pip downloads without a hash check, and system packages may be newer in a new install, so those two can differ. The TODO.md entry says the same. Model: opus-5-5	2026-10-21 16:21:30 +00:00
sneak	899beebc1f	Name no package the virtualenv gets (closes #133 ) check / check (push) Canceled after 0s Details virtualenv adds setuptools to a new virtualenv only on Python before 3.12, so the policy now says "the packages virtualenv puts into" the virtualenv instead of naming pip and setuptools. Model: opus-5-5	2026-10-21 16:06:05 +00:00
sneak	a3ec8461af	Pin pipenv by hash and keep one form of the Python lockfile install (closes #133 ) check / check (push) Canceled after 0s Details Rework of #135 on the review at #135 (comment). A Python test phase now has one form: COPY script/, COPY Pipfile Pipfile.lock, RUN script/bootstrap, then ARG CACHEBUST, and every list of what goes above the line names that step. In that step script/bootstrap installs only system packages, pipenv and its dependencies by hash with pip --require-hashes, and the lockfile's packages, and no Python. The claim about a kept layer covers only what is pinned by hash and says its system packages may be older. The bold rule is conditional, the script/cibuild items expect the step to show CACHED, and the example says why it installs make and git. Model: opus-5-5	2026-10-21 15:48:09 +00:00
sneak	83f148f3b2	Keep a Python test phase's lockfile install in check builds (closes #133 ) check / check (push) Canceled after 0s Details On sneak's ruling in sneak/rfscan#80 (comment), a Python test phase installs its packages from Pipfile.lock above ARG CACHEBUST, so Docker keeps them until the base image, Pipfile, Pipfile.lock or a line up to the install changes. The step is COPY Pipfile Pipfile.lock ./ and one RUN of pipenv install --deploy, or a script/bootstrap that installs nothing beyond system packages, the pinned pipenv and the lockfile's packages. --deploy installs only what the lockfile names and checks its hashes. The tests, and every other stage's Python installs, stay after the line. REPO_POLICIES.md gains a short example; both checklists and the README state the rule the same way. Model: opus-5-5	2026-10-21 15:11:57 +00:00