Repository navigation
Pin the build backend to hashes - #74
Merged
Merged
Conversation
uv build now takes its build requirements from build-requirements.txt with --require-hashes, so CI and release builds fail on any build requirement that is unpinned or whose hash differs. Renovate updates the pins as one grouped pull request. Amp-Thread-ID: https://ampcode.com/threads/T-01a1ca38-20a5-7436-a7ae-1f2bce712489 Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
uv buildresolvedhatchlingandhatch-vcsfresh from PyPI on every CI and release run, so the code that builds the published wheel was unpinned and unverified.build-requirements.txtpins both, and everything they install, to exact versions and sha256 hashes.--build-constraints build-requirements.txt --require-hashes. A build requirement that is missing from the file, or whose hash differs, fails the build.pip_requirementsmanager picks the file up by name and updates versions and hashes. A package rule groups those updates into one pull request.build-requirements.txtnow triggers the package build job.Test plan
Ran the CI build step locally under uv 0.11.7 and uv 0.13.4 with an empty cache; both built the wheel and source distribution.
With an empty cache, a changed
hatchlinghash failed withHash mismatch for hatchling==1.33.0, and removing thepathspecpin failed withIn --require-hashes mode, all requirements must be pinned upfront.The release workflow uses the same flags but only runs on a tag, so it is untested until the next release.