Add lowest-direct resolution input and Dependabot config#2
Open
nicoloesch wants to merge 4 commits into
Open
Conversation
Adds an optional `resolution` input (default `highest`) to build-test.yml and build-test-postgres.yml, forwarded to `uv sync --resolution`, so consumers can add a second CI job verifying that a declared dependency floor is actually sufficient (not just the latest resolvable version). Adds a canonical templates/dependabot.yml scoped to the CAVA sibling packages, pre-labelled `dependencies` so opened PRs flow through the existing label-gate/release-drafter pipeline. Not yet merged to main. Being piloted on a branch against cava-ci-test first per the CAVA dependency-range-bump plan.
Without this, Dependabot's default versioning strategy rewrites the manifest's lower-bound constraint to match whatever it just bumped to, not just uv.lock -- silently collapsing every declared range down to "whatever was last merged" and making lowest-direct floor-testing meaningless. Confirmed via the cava-ci-test pilot (round 1 exhibited this exact bug; round 2 verifies the fix).
- build-test-postgres.md was missing the resolution input added earlier to build-test-postgres.yml itself -- brings it in line with build-test.md. - docs/index.md component table now lists templates/dependabot.yml. - setup-new-repo.md gets a new step 4 covering when/how to widen a sibling dependency to a range, add Dependabot (with the required versioning-strategy: lockfile-only), and add the lowest-direct CI job. Subsequent steps renumbered 5-7.
This was referenced Jul 23, 2026
uv sync --resolution <mode> tags the lock with that resolution mode, but a plain `uv run <cmd>` with no --resolution flag defaults to expecting `highest` -- it treats a lowest-direct-tagged lock as stale and silently re-resolves everything back to highest before running the command. Confirmed directly: after `uv sync --resolution lowest-direct` installed ruff==0.4.0, a subsequent `uv run ruff --version` logged "Ignoring existing lockfile due to change in resolution mode: lowest-direct vs. highest" and ended up on a completely different ruff version. This meant the lowest-direct job never actually tested the floor -- every step after the initial sync silently upgraded back to highest, making it a redundant, no-op duplicate of the regular highest job. Fixes it by passing --resolution explicitly to the ty/ruff/pytest uv run steps too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
build-test.ymlandbuild-test-postgres.yml: add optionalresolutioninput (defaulthighest), forwarded touv sync --resolution. No change to existing callers since the default preserves current behaviour.templates/dependabot.yml:package-ecosystem: "uv",versioning-strategy: "lockfile-only") scoped tooa-configurator,orm-loader,omop-alchemy,omop-emb,omop-graph;dependencieson new releases, touching onlyuv.lock.docs/workflows/build-test.mdanddocs/workflows/build-test-postgres.mddocument the new input plus a "Minimum-version testing" example;docs/index.mdlists the new template;docs/guides/setup-new-repo.mdgets a new step 4 covering the whole dependency-range + Dependabot + lowest-direct pattern for onboarding repos (steps renumbered 5-7).Piloted end-to-end in
cava-ci-test.