Repository navigation
feat(build): wheels of locked addons with content-derived versions - #35
Merged
Merged
Conversation
odx build exports every selected addon of the locked repositories, every locked package and, with --project, the project's own addons from the git cache, builds each with uv build and its backend (whool when none is declared), and rewrites the wheel to <version>+odx[.pr<N>].<tree> with fixed timestamps, where <tree> is the addon directory's git tree, so the same source gives the same version and bytes. Wheels are recorded under [wheels] in odx.lock; --publish uploads them with uv publish to a non-PyPI [[tool.uv.index]]. verify --installed also checks built wheel versions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 5:
odx build [--publish] [--index] [--addon GLOB] [--project] [--out-dir].--projectthe project's addons from the committed HEAD; all exported from git, so builds never see uncommitted changes. An addon that comes from two sources is refused.uv build --wheelwith the addon's backend (a default whoolpyproject.tomlwhen it has none),SOURCE_DATE_EPOCHandWHOOL_POST_VERSION_STRATEGY_OVERRIDE=none; the scratch directory is made its own git repository with everything staged, because whool lists files with git when inside a repository.<version>+odx.<tree12>(+odx.pr<N>.<tree12>for PR packages). Deviation from the design note: the label uses the addon directory's git tree instead of the result commit. It is equally content-derived, identical on every machine (result commits carry timestamps), and per addon, so untouched addons keep their version.odx_platform::wheel::retagrewrites dist-info, METADATA and RECORD with fixed timestamps.[wheels.<dist>]inodx.lock(version, sha256, index, source, tree); render/parse fixed point, tree validated.uv publish --index <name>; index from--index,[tool.odx.platform] index, elseprivate; must be a[[tool.uv.index]]; PyPI refused.odx verify --installedreports an installed version that differs from the built one.Merger::objectresolves<rev>:<path>.odx lock+odx buildof OCAweb_responsive18.0 from a local clone, built by whool:18.0.1.0.3+odx.0dfc9a0d7a69, identical sha256 on a second build; the wheel installs with uv and reports that version. The real-uv CI test builds the locked packages twice and compares.--sbom; pointing dependency groups at published versions.