From c78b97a1acd2881a2dc532f4577853805aea47d6 Mon Sep 17 00:00:00 2001 From: Don Kendall Date: Thu, 4 Jun 2026 08:56:19 -0400 Subject: [PATCH] [CI] test-migration: resolve the google-auth / cloud_storage_google conflict MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit google-auth requires cryptography>=38, which evicts Odoo's pinned cryptography==3.4.8 and desyncs the matched pyopenssl==21.0.0 / urllib3 1.26 stack (X509_V_FLAG_NOTIFY_POLICY and hazmat.backends.openssl.x509 are gone in modern cryptography) → import OpenSSL fails, base won't load, every migration run dies before a script executes. #103 added google-auth on 2026-06-03 and silently broke this. The only thing that needs google-auth is cloud_storage_google, whose 19.0 manifest declares it as an external dependency (18.0 didn't). It's only in the enriched seed. - Per-PR (test-migration.yml): drop google-auth — the OCA seed has no google-auth-dependent module, so this restores Odoo 18's matched crypto stack and greens the per-PR test. - Enriched (test-migration-enriched.yml): drop google-auth AND mark cloud_storage_google uninstalled post-restore so OpenUpgrade skips it (nothing depends on it; its 18->19 change needs live Google config to exercise). Both halves keep cryptography untouched. Restores both migration gates, which had been red since #103 (per-PR) and longer (enriched, on cloud_storage_google's missing dep then the crypto break). --- .github/workflows/test-migration-enriched.yml | 14 +++++++++++++- .github/workflows/test-migration.yml | 7 ++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test-migration-enriched.yml b/.github/workflows/test-migration-enriched.yml index 9f28c89a482c..707d3822adf6 100644 --- a/.github/workflows/test-migration-enriched.yml +++ b/.github/workflows/test-migration-enriched.yml @@ -75,6 +75,13 @@ jobs: run: | wget -q -O- $DOWNLOADS/$SEED_NAME | pg_restore -d $DB --no-owner psql $DB -c "UPDATE ir_module_module SET demo=False" + # cloud_storage_google (installed in this seed) gains a hard google-auth + # external dependency in 19.0, and google-auth's cryptography>=38 is + # incompatible with Odoo 18's pinned pyopenssl/urllib3 stack (it breaks + # `import OpenSSL`, so base won't load). Nothing depends on it, so skip it: + # mark uninstalled pre-migration so OpenUpgrade doesn't load/upgrade it. + # Its 18->19 change needs live Google config to exercise anyway. + psql $DB -c "UPDATE ir_module_module SET state='uninstalled' WHERE name = 'cloud_storage_google'" - name: Check out Odoo uses: actions/checkout@v4 with: @@ -126,7 +133,12 @@ jobs: pip install coverage # this is for account_peppol pip install phonenumbers - pip install geoip2 google-auth + # NB: google-auth is intentionally NOT installed here. It needs + # cryptography>=38, which evicts Odoo's pinned cryptography 3.4.8 and + # breaks the matched pyopenssl 21 / urllib3 1.26 stack (base won't + # import). cloud_storage_google/google_gmail (enriched seed only) need + # it — handle their dep without disturbing the base crypto stack. + pip install geoip2 - name: Test data run: | if test -n "$(ls openupgrade/openupgrade_scripts/scripts/*/tests/data*.py 2> /dev/null)"; then diff --git a/.github/workflows/test-migration.yml b/.github/workflows/test-migration.yml index 0a7ebcefe57f..13b936f19d0b 100644 --- a/.github/workflows/test-migration.yml +++ b/.github/workflows/test-migration.yml @@ -126,7 +126,12 @@ jobs: pip install coverage # this is for account_peppol pip install phonenumbers - pip install geoip2 google-auth + # NB: google-auth is intentionally NOT installed here. It needs + # cryptography>=38, which evicts Odoo's pinned cryptography 3.4.8 and + # breaks the matched pyopenssl 21 / urllib3 1.26 stack (base won't + # import). cloud_storage_google/google_gmail (enriched seed only) need + # it — handle their dep without disturbing the base crypto stack. + pip install geoip2 - name: Test data run: | if test -n "$(ls openupgrade/openupgrade_scripts/scripts/*/tests/data*.py 2> /dev/null)"; then