Repository navigation
feat: verify installed wheels, Odoo.sh submodule checks, PyPI auto-update - #34
Merged
Merged
Conversation
odx verify --installed <venv or site-packages> checks every distribution uv.lock knows: the locked version, the locked commit for packages from git, and for packages from an index the files of the locked wheel (its RECORD, from the cache or downloaded and hash-checked, against the installed RECORD), so a substituted wheel with the same version is found. Files changed after installation are reported too.
odx verify reports a submodule that .gitmodules names without a committed commit, and checks that a submodule at a locked repository's target_dir pins a commit whose tree is the locked result. For the odoo-sh profile, odx verify --requirements refuses lines Odoo.sh cannot install. odx vendor --requirements works without groups to vendor into.
odx lock --auto-update asks the index (ODX_PYPI_URL, default PyPI) for newer releases of every allowed index addon package in uv.lock. Only an update of the fifth version segment (OCA post-releases included) is taken, and with content_check only when every changed addon file matches allowed_paths (the manifest version line excepted); the locked and the new wheel are downloaded hash-checked. Exact pins in pyproject.toml move along before uv lock --upgrade-package. The rest is listed for review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 5, the remaining verification and update pieces (three commits).
odx verify --installed <venv or site-packages>uv.lockknows: the locked version; the locked commit for git packages (direct_url.json); for index packages the files of the locked wheel (its RECORD, fetched hash-checked from cache or index, against the installed RECORD), so a substituted wheel with the same version is found; files changed after installation (installed RECORD hashes).uv syncvenv with two OCA 17.0 wheels: passes; an edited manifest is reported.Odoo.sh
odx verify: a.gitmodulesentry without a committed gitlink is unpinned; a submodule at a locked repository'starget_dirmust pin a commit whose tree is the locked result.odx verify --requirements(odoo-sh): refusesname @ git+…,-eand other option lines.odx vendor --requirementsworks without groups.odx lock --auto-updateuv.lockmatchingallow/notdeny; releases fromODX_PYPI_URL(default PyPI JSON API,file://for mirrors and tests).content_check, locked and new wheel compared, manifest version line ignored, every changed path must matchallowed_paths.==pins in[project], extras and dependency groups move along (formatting kept), thenuv lock --upgrade-package.account_statement_base17.0.1.5.0 → 17.0.1.5.0.2 (translations only) auto-updated with real uv;web_responsive17.0.1.1.8 → 17.0.1.1.10 held for review (JS/XML changes).set_manifest_versionmoved to odx-analyze;odx_vendor::archive::getshared for HTTP/file reads.