ci(deps): make setup-micromamba consistent, pinned and Dependabot-visible - #151
Conversation
94da85c to
33b7093
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe pull request pins micromamba version ChangesCI dependency contracts
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…ible Two silent-drift traps converge on setup-micromamba, and nothing was watching either. 1. The composite action was invisible to Dependabot. Its `github-actions` ecosystem with `directory: "/"` scans only `.github/workflows` plus a ROOT-level action.yml — never `.github/actions/**` (dependabot-core#6345). That is how `.github/actions/setup-env` sat on setup-micromamba v2 (node20) while packaging.yml and release.yml were bumped to v3.0.0. The skew was inverted from where you would want it: the composite feeds SEVEN workflows including the required 3-OS `test` matrix and schema-guard, so the *required* CI ran the old pin while the two zero-CI-coverage workflows ran the new one. 2. `micromamba-version` was unset at all three call sites, so the binary re-resolved to `latest` on every run. Upstream setup-micromamba#306 (STATUS_ACCESS_VIOLATION on windows-latest, fixed in micromamba 2.6.2) and #307 (sharded-repodata resolution failures, fixed in 2.7.0) each turned floating consumers red overnight with no repo-side change. A signed release must not re-resolve its own toolchain (pin-and-hold, PRD §4.1). Bump setup-env to the v3.0.0 SHA, pin micromamba-version to 2.8.1-0 at all three call sites, and add a second `github-actions` Dependabot entry using `directories:` (the only key that supports globbing) scoped to `/.github/actions/*`. The glob is deliberately not `**/*`, which would re-match `.github/workflows` and produce duplicate PRs for every action (dependabot-core#10884). Three contract tests keep both closed: every call site must carry its own pin and all pins must agree; every composite action on disk must fall inside some update entry's scope; and no glob may overlap the workflows directory. Call sites are discovered by glob over `.github/`, never a hardcoded list, so a fourth cannot float unnoticed. Coverage matching uses `PurePosixPath.match`, not `fnmatch.fnmatch`, because Dependabot expands with `Dir.glob` where `*` does not cross a `/` — `fnmatch` would false-pass a nested action that Dependabot skips. Scope, stated honestly: only setup-env restores a conda-lock with micromamba. packaging.yml/release.yml solve a throwaway `pkgbuild` tool env from create-args and never exercise the restore path, so a shared value is maintenance convenience (one number to bump), not a CI-matches-the-signed-release guarantee. The larger reproducibility gap — constructor, conda-standalone, python-build, pip and wheel are unpinned in create-args — is untouched here. Expect one cold environment rebuild on all three OSes on the first run after merge: v3 changed the cache-key computation. That is not a failure. Verified: `2.8.1-0` is the current micromamba-releases stable (2026-06-09) and clears both the #306 and #307 floors; the `-0` build suffix is required by the action's input regex. All three committed locks are pure conda (0 `manager: pip` entries), so the mamba#4332 win-64 restore bug is unreachable today. Five mutations — pin removed, pin diverged, composite entry deleted, glob widened to overlap, nested action added — each turned the intended guard red. Refs: PRD §4.1, §12.6, §12.8.
33b7093 to
a5eb13f
Compare
1 participant
Summary
Two silent-drift traps converge on
setup-micromamba, and nothing was watching either.1. The composite action was invisible to Dependabot. Its
github-actionsecosystem withdirectory: "/"scans only.github/workflowsplus a root-levelaction.yml— never.github/actions/**(dependabot-core#6345). That is how.github/actions/setup-envsat on setup-micromamba v2 (node20) whilepackaging.ymlandrelease.ymlwere bumped to v3.0.0 in #149. The skew was inverted from where you'd want it: the composite feeds seven workflows including the required 3-OStestmatrix andschema-guard, so the required CI ran the old pin while the two zero-CI-coverage workflows ran the new one.2.
micromamba-versionwas unset at all three call sites, so the binary re-resolved tolateston every run. Upstream setup-micromamba#306 (STATUS_ACCESS_VIOLATION onwindows-latest, fixed in micromamba 2.6.2) and #307 (sharded-repodata resolution failures, fixed in 2.7.0) each turned floating consumers red overnight with no repo-side change. A signed release must not re-resolve its own toolchain (pin-and-hold, PRD §4.1).Linked tracking
Type of change
feat— new capabilityfix— bug fixci— CI / dependency configuration!/BREAKING CHANGE:— a deliberate schema-version bump (the only sanctioned breaking change)Self-review checklist (PRD §12.4)
.tetherHDF5 change; CI/config only.schema-guardgreen.conda-lock-verifygreen. Themamba#4332win-64 restore bug is unreachable — all three committed locks are pure conda (0manager: pipentries).tests/test_marker_contract.py(stdlib + pyyaml, OS-agnostic, required 3-OS matrix); CodeQL clean. No GUI surface..tether.MICROMAMBA_PINis the single source in the contract test and every call site is bound to it.GPL-3.0-or-later); no scientific claims;reuse lintunaffected.What
.github/actions/setup-env/action.ymlto the v3.0.0 SHA (d7c9bd84), matching the workflows.micromamba-version: "2.8.1-0"at all three call sites (setup-env, packaging.yml, release.yml).2.8.1-0is the current micromamba-releases stable (2026-06-09) and clears both the build(packaging): pin and hash the bundled setuptools wheel, with one source of truth #306 and fix(agents): the round counter OVERCOUNTS — GitHub rewrites an inline comment's commit_id #307 floors; the-0build suffix is required by the action's input regex.github-actionsDependabot entry usingdirectories:(the only key that supports globbing) scoped to/.github/actions/*. Deliberately not**/*, which would re-match.github/workflowsand produce duplicate PRs for every action (dependabot-core#10884).Scope, stated honestly
Only
setup-envrestores a conda-lock with micromamba.packaging.yml/release.ymlsolve a throwawaypkgbuildtool env fromcreate-argsand never exercise the restore path — so a shared pin value is maintenance convenience (one number to bump), not a CI-matches-the-signed-release guarantee. The larger reproducibility gap (constructor,conda-standalone,python-build,pip,wheelunpinned increate-args) is untouched — a good follow-up.Testing
pytest tests/test_marker_contract.py→ 24 passed (rebased on fix(release): assert the installers actually staged before publishing #150, so A's 5 staging tests and B's 3 new tests coexist);ruff check+format --checkclean at 0.15.19; all four touched YAML files parse.setup-envwere exercised on this branch (no PR run covers them): deps-audit ✅, large-fixtures ✅, sidecar-measure ✅.sidecar/parityanddeep/smoke(both consume the composite) are green on the PR.What this does NOT cover
directories:glob expands in production is the one link not verifiable from CI. Source-verified against dependabot-core; a non-expanding multi-directory glob fails loudly (red Dependabot job), not silently. One-time post-merge check: Insights → Dependency graph → Dependabot → latestgithub-actionsjob log; confirm/.github/actions/setup-envis enumerated. If absent, swap to the literaldirectories: ["/.github/actions/setup-env"]— the contract test passes either way.with:input values generally — Dependabot still never watches them; onlymicromamba-versionis now guarded.Summary by CodeRabbit
Build and Release
Maintenance
Tests