From 1f7897c7f0482b3b761c5836a27efd31dd1e4ad9 Mon Sep 17 00:00:00 2001 From: Brett Adams Date: Sat, 22 Aug 2026 11:12:12 +1000 Subject: [PATCH] ci: gate on lockfile drift and regenerate uv.lock for 1.10.1 uv.lock's root package version had drifted behind pyproject.toml (1.10.0 vs 1.10.1), and no workflow ever asserted the lockfile against pyproject.toml, so drift shipped silently. Add --locked to the existing uv sync steps in ci.yml and release.yml so a stale lock fails the build, and document the uv lock regeneration step in the release process. --- .github/workflows/ci.yml | 4 ++-- .github/workflows/release.yml | 2 +- AGENTS.md | 2 +- uv.lock | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29724d7..1ff6791 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: with: enable-cache: true - name: Install dependencies - run: uv sync + run: uv sync --locked - name: Ruff run: uv run ruff check tesla_fleet_api tests - name: Pyright @@ -38,7 +38,7 @@ jobs: - name: Set up Python ${{ matrix.python-version }} run: uv python install ${{ matrix.python-version }} - name: Install dependencies - run: uv sync --python ${{ matrix.python-version }} + run: uv sync --locked --python ${{ matrix.python-version }} - name: Pytest run: uv run pytest tests -q diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0aea1ca..46f8cf5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: - name: Set up Python ${{ env.PYTHON_VERSION }} run: uv python install ${{ env.PYTHON_VERSION }} - name: Install dependencies - run: uv sync --python ${{ env.PYTHON_VERSION }} + run: uv sync --locked --python ${{ env.PYTHON_VERSION }} - name: Ruff run: uv run ruff check ${{ env.PACKAGE_DIR }} tests - name: Pyright diff --git a/AGENTS.md b/AGENTS.md index ed684cf..445b996 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -93,7 +93,7 @@ Scope flags on `TeslaFleetApi.__init__` control which submodules are instantiate ### Release Process -No release-please or version-bump automation. To ship: bump `version` in `pyproject.toml` and `__version__` in `tesla_fleet_api/__init__.py` in a `Bump version to X.Y.Z` commit on `main`, then push a matching `vX.Y.Z` tag. `.github/workflows/release.yml` triggers directly on that tag push: it reruns the full CI gate (ruff, pyright, pytest, `uv build` + `twine check`) on the exact tagged commit, then requires approval on the `pypi` GitHub environment (required reviewers configured via the Environments API — there's no repo Settings UI for it) before publishing via the PyPA OIDC trusted-publishing action (with PEP 740 attestations) and cutting the GitHub Release. It is a plain top-level workflow, not a `workflow_call` reusable one — the PyPI trusted publisher for this project is configured as workflow `release.yml` + environment `pypi`, and a reusable-workflow caller's signing identity doesn't match that publisher/attestation identity. Sibling repos each carry their own local copy of this workflow rather than calling it cross-repo. +No release-please or version-bump automation. To ship: bump `version` in `pyproject.toml` and `__version__` in `tesla_fleet_api/__init__.py`, then run `uv lock` to regenerate `uv.lock` so its root package version matches, in a `Bump version to X.Y.Z` commit on `main`, then push a matching `vX.Y.Z` tag. CI (`ci.yml`) and the release gate (`release.yml`) run `uv sync --locked`, which fails the build if `uv.lock` doesn't match `pyproject.toml` — a version bump that skips `uv lock` is caught before merge/tag rather than shipping a stale lockfile. `.github/workflows/release.yml` triggers directly on that tag push: it reruns the full CI gate (ruff, pyright, pytest, `uv build` + `twine check`) on the exact tagged commit, then requires approval on the `pypi` GitHub environment (required reviewers configured via the Environments API — there's no repo Settings UI for it) before publishing via the PyPA OIDC trusted-publishing action (with PEP 740 attestations) and cutting the GitHub Release. It is a plain top-level workflow, not a `workflow_call` reusable one — the PyPI trusted publisher for this project is configured as workflow `release.yml` + environment `pypi`, and a reusable-workflow caller's signing identity doesn't match that publisher/attestation identity. Sibling repos each carry their own local copy of this workflow rather than calling it cross-repo. ### Error Handling diff --git a/uv.lock b/uv.lock index f9dd776..bc12d3d 100644 --- a/uv.lock +++ b/uv.lock @@ -740,7 +740,7 @@ wheels = [ [[package]] name = "tesla-fleet-api" -version = "1.10.0" +version = "1.10.1" source = { editable = "." } dependencies = [ { name = "aiofiles" },