build: Pin hatchling version #1989
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Building a specific release with specific build tools feels like correct choice for reproducibility in general. It's also practically required as the hatchling version is embedded in the WHEEL file: this means updating the build tool modifies the resulting build artifact. Pin hatchling version. This version should be kept up-to-date: my working assumption is that Dependabot will handle it. Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
Pull Request Test Coverage Report for Build 2239220688
💛 - Coveralls |
jku
commented
Apr 28, 2022
| [build-system] | ||
| requires = ["hatchling>=0.21.0"] | ||
| # hatchling pinned for reproducibility: version should be kept up-to-date | ||
| requires = ["hatchling==0.22.0"] |
There was a problem hiding this comment.
Actually current version is 0.23.0 now... but maybe this is a good way to test what dependabot actually does (set version to less than current, expect dependabot to file an issue) ?
joshuagl
approved these changes
Apr 28, 2022
There was a problem hiding this comment.
I think we want to do something like this: IMO our build artifacts should not change if hatchling releases a new version (which is what happened right after we released 1.1.0: now
verify_releasewill say the artifacts do not match because WHEEL file includes the hatchling version number).
💯 – very strongly agree.
Change LGTM, lets see if dependabot does pick it up.
| [build-system] | ||
| requires = ["hatchling>=0.21.0"] | ||
| # hatchling pinned for reproducibility: version should be kept up-to-date | ||
| requires = ["hatchling==0.22.0"] |
lukpueh
approved these changes
Apr 28, 2022
|
Not yet dependabot/dependabot-core#3290 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pin hatchling version. This version should be kept up-to-date: my working assumption is that Dependabot will handle it.
I think we want to do something like this: IMO our build artifacts should not change if hatchling releases a new version (which is what happened right after we released 1.1.0: now
verify_releasewill say the artifacts do not match because WHEEL file includes the hatchling version number).Whether this exact change is the correct one, I'm not sure. Does dependabot update
build-system.requires? I'm hoping so but I don't know 🤷