Goal
Make centrally managed Python build-tool upgrades reproducible and smooth across Odoo tenant repositories while preserving exact artifact provenance.
Current Status
State: Active implementation workstream on August 16, 2026. PR cbusillo/odoo-tenant-opw#115 demonstrated that Dependabot can update addon build-system pins without changing uv.lock while the devkit support/runtime catalog remains on the prior exact version. Opus and Gemini independently validated a catalog-owner plus immutable-tenant-input architecture.
Finish Line
Devkit-owned build-tool updates produce validated atomic tenant changes without floating cross-repo CI inputs or noisy tenant Dependabot PRs.
Acceptance Criteria
- Add dedicated uv Dependabot coverage and CI lock validation for docker/runtime-python.
- Give tenant CI a checked-in immutable devkit input without breaking sibling-repo local DX.
- Preserve exact addon build-system pins and require_staged_build_requirements_supplied behavior.
- Provide machine-readable plan/check/apply tooling for atomic tenant pin updates.
- Validate a devkit candidate SHA against tenant changes before merge.
- Keep GitHub PR transport and credentials in Launchplane rather than duplicating orchestration in devkit.
- Document rollout, rollback, security ownership, and stale-pin detection.
Relationships
Next Action
Land the non-overlapping devkit catalog/CI guardrails and OPW immutable CI pin, then integrate pin synchronization with the dependency normalization command from #97.
Goal
Make centrally managed Python build-tool upgrades reproducible and smooth across Odoo tenant repositories while preserving exact artifact provenance.
Current Status
State: Active implementation workstream on August 16, 2026. PR cbusillo/odoo-tenant-opw#115 demonstrated that Dependabot can update addon build-system pins without changing uv.lock while the devkit support/runtime catalog remains on the prior exact version. Opus and Gemini independently validated a catalog-owner plus immutable-tenant-input architecture.
Finish Line
Devkit-owned build-tool updates produce validated atomic tenant changes without floating cross-repo CI inputs or noisy tenant Dependabot PRs.
Acceptance Criteria
Relationships
Next Action
Land the non-overlapping devkit catalog/CI guardrails and OPW immutable CI pin, then integrate pin synchronization with the dependency normalization command from #97.