Repository navigation
fix(deps): regenerate drifted lockfiles + add lock self-heal workflow - #638
Conversation
Root cause: Dependabot bumps ranges in pyproject.toml but cannot run uv pip compile, so it opens PRs whose committed requirements.lock is stale. The required "Dependency drift (lock vs pyproject)" gate then fails on every dependency PR and blocks the merge queue (#633-#637). Two-part fix: 1. Regenerate requirements.lock + requirements.txt from the current pyproject.toml (uv 0.12.10, --python-version 3.11) so main is consistent again. Every PR that does not itself touch pyproject.toml (all npm/frontend and github-actions PRs) goes green because the gate compares the committed lock against a fresh compile. 2. Add .github/workflows/dependency-autoregen.yml: on any pyproject.toml change reaching main it regenerates and commits the artifacts in place (main can never stay drifted); on PRs that move pyproject.toml it pushes the regenerated artifacts onto the PR branch and re-requests the check suites. Idempotent - converges after one commit.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🔴 NSE Evidence Report — #638Status: FAIL · Branch: 🔗 Revision
Overall🔴 FAIL Required CI checks contain failures. Primary affected files:
🧪 Test Matrix
🔴 Affected Files
|
| Workflow | Job | Status | Details |
|---|---|---|---|
CI |
Aggregate CI Results |
⏭️ SKIPPED | logs |
CI |
Heavy CI (${{ matrix.suite }}) |
⏭️ SKIPPED | logs |
CI |
Extended Validation (Tier 2) |
⏭️ SKIPPED | logs |
CI |
Full Runtime Overall Verdict |
✅ SUCCESS | logs |
CI |
DB Fabric Certification (SQLite ↔ PostgreSQL) |
✅ SUCCESS | logs |
GitHub Advanced Security |
CodeQL |
✅ SUCCESS | logs |
Docs |
Deploy GitHub Pages |
⏭️ SKIPPED | logs |
GitHub Advanced Security |
osv-scanner |
✅ SUCCESS | logs |
GitHub Advanced Security |
Trivy |
✅ SUCCESS | logs |
Socket Security |
Socket Security: Pull Request Alerts |
✅ SUCCESS | logs |
Socket Security |
Socket Security: Project Report |
✅ SUCCESS | logs |
Code scanning AI findings on PR #638 |
github-advanced-security |
❌ FAILURE | logs |
OSV Dependency Scan |
OSV Scanner / osv-scan |
✅ SUCCESS | logs |
Docs |
Validate documentation |
✅ SUCCESS | logs |
CI |
MetaTrader 5 Wine Runtime |
✅ SUCCESS | logs |
CI |
Code Quality & Tests |
✅ SUCCESS | logs |
CI |
CI Integrity and Change Classification |
✅ SUCCESS | logs |
Security |
Trivy Vulnerability Scan |
✅ SUCCESS | logs |
CI |
Full NSE Runtime (sqlite) |
✅ SUCCESS | logs |
Dependency Lock & Migration Safety |
Dependency drift (lock vs pyproject) |
✅ SUCCESS | logs |
JS Tests |
Frontend JS Unit Tests |
✅ SUCCESS | logs |
Security |
CodeQL Analysis |
✅ SUCCESS | logs |
CI |
Full NSE Runtime (postgres) |
✅ SUCCESS | logs |
Lockfile Diff |
Dependency Manifest Diff |
✅ SUCCESS | logs |
Dependency Lock & Migration Safety |
Migration safety (fail-loud + version postconditions) |
✅ SUCCESS | logs |
Tests (OS Matrix) |
Py Tests (macos-latest) |
✅ SUCCESS | logs |
Tests (OS Matrix) |
Py Tests (windows-latest) |
✅ SUCCESS | logs |
✅ Final Verdict — Merge? Yes — already merged
Already merged — mergeability is history, not a question:
- Already merged on 2026-10-05T19:07:47Z.
NSE Evidence Report — generated by nse pr report. Statuses are deterministic: 🟢 PASS · 🟡 IN PROGRESS · 🟠 BLOCKED · 🔴 FAIL · ⚪ UNKNOWN. unknown = the evidence did not determine it. This comment is updated in place; it never duplicates.
1 participant
Root cause
Dependabot bumps the version ranges in
pyproject.tomlbut it cannot runuv pip compile, so every dependency PR it opens carries a stalerequirements.lock. The requiredDependency drift (lock vs pyproject)gate then fails on all of them and blocks the merge queue (#633, #634, #635, #636, #637).Fix (two parts)
pyproject.toml(uv 0.12.10,--python-version 3.11) somainis internally consistent again. This alone turns every PR green that does not itself touchpyproject.toml— all npm/frontend and github-actions PRs — because the gate compares the committed lock against a fresh compile ofpyproject.toml..github/workflows/dependency-autoregen.yml— a self-heal keeper:pushto main/develop onpyproject.toml→ regenerate + commit in place.maincan never stay drifted.pull_requestthat movespyproject.toml→ push the regenerated artifacts onto the PR branch and re-request the check suites (aGITHUB_TOKENpush emits no workflow events, so the gates must be nudged).--regenrewrites the same bytes and nothing is committed. Converges after at most one extra commit.Test plan
Dependency drift (lock vs pyproject)passes on this PRCode Quality & Tests,Frontend JS Unit Testsunaffected (lock-only change + one new workflow file)pyproject.tomlchange) pass their drift gateCloses the drift blocker behind #633-#637.