From 2526132b39c39ce028d6d4d34cdb3bc2a702c465 Mon Sep 17 00:00:00 2001 From: Aaron Elliot Ross Date: Thu, 27 Aug 2026 16:37:46 +0200 Subject: [PATCH 1/2] python: declare role = "library" and gate on ci-workflows python-pins requires-python stays ">=3.11" on purpose. Six repos import this library from an unpinned git URL and they span 3.11 to 3.14, so no single ==X.Y.* satisfies all of them: ==3.11.* would break every 3.14 consumer's lock and ==3.14.* would break fundraiser-api's. The `library` role opts out of the ==X.Y.* form rule only -- the values still have to agree with each other. Adds a ci.yml as well; this repo had no PR gate at all. The action ref is pinned to a ci-workflows commit rather than @v14 because v14 has not been moved yet -- this PR is the first real-repo trial of the check. Switch to @v14 before merge. See docs/python-pins.md in WeMoveEU/dependency-policy. --- .github/workflows/ci.yml | 18 ++++++++++++++++++ pyproject.toml | 7 +++++++ 2 files changed, 25 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..c940223 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,18 @@ +name: CI + +# This repo has no PR gate. The pins check is the whole job -- it is cheap, needs +# no secrets, and stops the Dockerfile and the manifest drifting apart again. +# Adding it does NOT make this repo tier 2: nothing here auto-merges. + +on: + pull_request: + +permissions: + contents: read + +jobs: + ci: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: WeMoveEU/ci-workflows/.github/actions/python-pins@2e7432e38558f800d0ba71e813dac22cffdc2076 diff --git a/pyproject.toml b/pyproject.toml index 8cd4579..5c73574 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -21,6 +21,13 @@ build-backend = "setuptools.build_meta" [tool.setuptools] packages = ["actionkit"] +[tool.python-pins] +# requires-python is a compatibility range here, not a runtime pin: six repos +# import this library from an unpinned git URL and they span 3.11 to 3.14, so no +# single ==X.Y.* satisfies all of them. `library` opts out of the form rule only +# -- the values still have to agree with each other. +role = "library" + [dependency-groups] dev = [ "pytest>=7.0.1", From eba2d24887082836860154d999b9f4a778b22b15 Mon Sep 17 00:00:00 2001 From: Aaron Elliot Ross Date: Thu, 27 Aug 2026 16:39:24 +0200 Subject: [PATCH 2/2] TEMPORARY: prove the gate goes red on a disagreeing pin Do not merge. A Dockerfile on python:3.14 against a manifest resolving to 3.11 -- the exact shape of the drift that hit seven repos. This branch exists only to show that ci fails on it, and gets closed unmerged. --- Dockerfile | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..25aa97d --- /dev/null +++ b/Dockerfile @@ -0,0 +1,3 @@ +# TEMPORARY -- do not merge. Mimics the real incident: Dependabot walks the base +# image ahead of the manifest, which stays green because a floor accepts it. +FROM python:3.14-slim