-
Notifications
You must be signed in to change notification settings - Fork 269
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
build: Pin hatchling version #1989
Conversation
Building a specific release with specific build tools feels like correct choice for reproducibility in general. It's also practically required as the hatchling version is embedded in the WHEEL file: this means updating the build tool modifies the resulting build artifact. Pin hatchling version. This version should be kept up-to-date: my working assumption is that Dependabot will handle it. Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
Pull Request Test Coverage Report for Build 2239220688
💛 - Coveralls |
[build-system] | ||
requires = ["hatchling>=0.21.0"] | ||
# hatchling pinned for reproducibility: version should be kept up-to-date | ||
requires = ["hatchling==0.22.0"] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actually current version is 0.23.0 now... but maybe this is a good way to test what dependabot actually does (set version to less than current, expect dependabot to file an issue) ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Clever :-)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we want to do something like this: IMO our build artifacts should not change if hatchling releases a new version (which is what happened right after we released 1.1.0: now
verify_release
will say the artifacts do not match because WHEEL file includes the hatchling version number).
💯 – very strongly agree.
Change LGTM, lets see if dependabot does pick it up.
[build-system] | ||
requires = ["hatchling>=0.21.0"] | ||
# hatchling pinned for reproducibility: version should be kept up-to-date | ||
requires = ["hatchling==0.22.0"] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Clever :-)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, @jku
Not yet dependabot/dependabot-core#3290 |
Pin hatchling version. This version should be kept up-to-date: my working assumption is that Dependabot will handle it.
I think we want to do something like this: IMO our build artifacts should not change if hatchling releases a new version (which is what happened right after we released 1.1.0: now
verify_release
will say the artifacts do not match because WHEEL file includes the hatchling version number).Whether this exact change is the correct one, I'm not sure. Does dependabot update
build-system.requires
? I'm hoping so but I don't know 🤷