kingchenc
5b23b36261
* ci: use npm ci instead of npm install for reproducible installs Pins the node binding dependency install to the committed package-lock.json integrity hashes (OpenSSF Scorecard PinnedDependencies). npm ci installs strictly from the lockfile; npm install could resolve newer patch versions. Covers ci.yml and both release.yml node steps. * ci: hash-pin Python dev tooling in ci.yml (Scorecard #19) Replaces the unpinned 'pip install maturin pytest numpy hypothesis' with a hash-locked '--require-hashes -r' install (OpenSSF Scorecard PinnedDependencies). Two lock files are needed because numpy publishes no single release with wheels for both cp39 and cp313 (<=2.0.2 has cp39 only, >=2.1 drops cp39): ci-dev-py39.txt numpy 2.0.2 (Python 3.9, + tomli/exceptiongroup) ci-dev-py3.txt numpy 2.4.6 (Python 3.10+) The step selects the file by matrix.python-version under shell: bash. Both are generated from ci-dev.in via uv (scripts/update-lockfiles.sh, added next). * ci: hash-pin Python deps in bench.yml (Scorecard #16) Replaces the unpinned 'pip install maturin numpy pandas talipp finta' with a hash-locked '--require-hashes -r .github/requirements/bench.txt' install. bench.yml runs on a single Python version (3.11), so one lock file (generated from bench.in via uv) is sufficient. * build: add scripts/update-lockfiles.sh to regenerate all lockfiles One command refreshes every committed lockfile across languages: Cargo.lock and fuzz/Cargo.lock (cargo update), the Node binding package-lock.json, and the hash-pinned Python requirements under .github/requirements/ (uv pip compile --generate-hashes). Uses uv for the Python locks so a target Python version's hashed transitive closure can be resolved without that interpreter installed (needed for the numpy cp39/cp313 split); bootstraps uv if absent. .gitattributes pins *.sh to LF so the script stays runnable on Linux/macOS. * ci: split ci-dev requirements per Python version + Dependabot rehash Splits the single ci-dev.in into ci-dev-py39.in (numpy <2.1, the last series with cp39 wheels) and ci-dev-py3.in (3.10+), giving a 1:1 .in->.txt layout. The cap keeps Python 3.9 permanently installable and stops Dependabot from proposing 3.9-breaking numpy bumps. Adds a Dependabot pip entry on /.github/requirements so the hash-locked tooling is kept current automatically; the canonical manual refresh stays scripts/update-lockfiles.sh. Only the '# via -r' provenance lines in the .txt change; no package versions or hashes move. * ci: cache pip and npm downloads in the PR-loop jobs Adds setup-python cache: pip (ci.yml python matrix + bench.yml, keyed on the hash-locked requirements) and setup-node cache: npm (ci.yml node job, keyed on bindings/node/package-lock.json), on both the primary and retry setup steps. Scoped to jobs that actually install dependencies; the examples-smoke and clippy-bindings jobs install nothing and are left uncached. release.yml is intentionally left out: it runs only on tag push (not the PR loop) and is the publish-critical path, so no caching is added there. * docs: document hash-pinned requirements and update-lockfiles.sh Updates the lockfile-policy table: the bindings/python row no longer claims CI installs tooling unpinned, and a new .github/requirements row documents the hash-locked CI/bench tooling and the per-Python-version ci-dev split. Adds a paragraph pointing contributors at scripts/update-lockfiles.sh (uv-based, self-bootstrapping) as the canonical lockfile refresh. * docs: changelog entry for hash-pinned CI dependency installs
47 lines
2.1 KiB
Bash
Executable File
47 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Regenerate every committed lockfile in the workspace:
|
|
# - Rust: Cargo.lock, fuzz/Cargo.lock (cargo update)
|
|
# - Node: bindings/node/package-lock.json (npm install --package-lock-only)
|
|
# - Python: .github/requirements/*.txt (uv pip compile --generate-hashes)
|
|
#
|
|
# Run from anywhere; the script cd's to the repo root itself:
|
|
#
|
|
# ./scripts/update-lockfiles.sh
|
|
#
|
|
# The Python locks are hash-pinned (OpenSSF Scorecard PinnedDependencies) and
|
|
# generated with uv rather than pip-tools because uv can resolve a *target*
|
|
# Python version's full transitive closure — with hashes — without that
|
|
# interpreter being installed locally. That is required for the numpy cp39/cp313
|
|
# split: numpy ships no single release with wheels for both, so ci-dev is locked
|
|
# twice (Python 3.9 and Python 3.10+). If uv is not on PATH the script
|
|
# bootstraps a local copy (Linux/macOS); on Windows install uv first
|
|
# (https://docs.astral.sh/uv/getting-started/installation/).
|
|
#
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$repo_root"
|
|
|
|
echo "==> Rust (Cargo.lock, fuzz/Cargo.lock)"
|
|
cargo update
|
|
(cd fuzz && cargo update)
|
|
|
|
echo "==> Node (bindings/node/package-lock.json)"
|
|
(cd bindings/node && npm install --package-lock-only --no-audit --no-fund)
|
|
|
|
echo "==> Python (.github/requirements/*.txt via uv)"
|
|
if ! command -v uv >/dev/null 2>&1; then
|
|
echo " uv not found on PATH; bootstrapping a local copy..."
|
|
curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
fi
|
|
|
|
req=".github/requirements"
|
|
cc="./scripts/update-lockfiles.sh"
|
|
uv pip compile --quiet --python-version 3.9 --generate-hashes --custom-compile-command "$cc" "$req/ci-dev-py39.in" -o "$req/ci-dev-py39.txt"
|
|
uv pip compile --quiet --python-version 3.11 --generate-hashes --custom-compile-command "$cc" "$req/ci-dev-py3.in" -o "$req/ci-dev-py3.txt"
|
|
uv pip compile --quiet --python-version 3.11 --generate-hashes --custom-compile-command "$cc" "$req/bench.in" -o "$req/bench.txt"
|
|
|
|
echo "==> Done. Review 'git diff' before committing."
|