4b0ec87f69dc4244045bbfee8b1863fd7cf4e331
2
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Jatin K Malik |
4b0ec87f69 |
chore(deps): bump the pip group across 2 directories with 4 updates (#1015)
* chore(deps): bump the pip group across 2 directories with 4 updates Bumps the pip group with 4 updates in the / directory: [setuptools](https://github.com/pypa/setuptools), [black](https://github.com/psf/black), [filelock](https://github.com/tox-dev/py-filelock) and [virtualenv](https://github.com/pypa/virtualenv). Bumps the pip group with 4 updates in the /requirements directory: [setuptools](https://github.com/pypa/setuptools), [black](https://github.com/psf/black), [filelock](https://github.com/tox-dev/py-filelock) and [virtualenv](https://github.com/pypa/virtualenv). Updates `setuptools` from 84.0.0 to 84.1.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](https://github.com/pypa/setuptools/compare/v84.0.0...v84.1.0) Updates `black` from 26.5.1 to 26.10.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/compare/26.5.1...26.10.1) Updates `filelock` from 3.32.3 to 4.2.1 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/py-filelock/compare/3.32.3...4.2.1) Updates `virtualenv` from 21.14.12 to 21.14.13 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](https://github.com/pypa/virtualenv/compare/21.14.12...21.14.13) Updates `setuptools` from 84.0.0 to 84.1.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](https://github.com/pypa/setuptools/compare/v84.0.0...v84.1.0) Updates `black` from 26.5.1 to 26.10.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/compare/26.5.1...26.10.1) Updates `filelock` from 3.32.3 to 4.2.1 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/py-filelock/compare/3.32.3...4.2.1) Updates `virtualenv` from 21.14.12 to 21.14.13 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](https://github.com/pypa/virtualenv/compare/21.14.12...21.14.13) --- updated-dependencies: - dependency-name: setuptools dependency-version: 84.1.0 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 26.10.1 dependency-type: direct:development dependency-group: pip - dependency-name: filelock dependency-version: 4.2.1 dependency-type: direct:production dependency-group: pip - dependency-name: virtualenv dependency-version: 21.14.13 dependency-type: direct:development dependency-group: pip - dependency-name: setuptools dependency-version: 84.1.0 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 26.10.1 dependency-type: direct:development dependency-group: pip - dependency-name: filelock dependency-version: 4.2.1 dependency-type: direct:production dependency-group: pip - dependency-name: virtualenv dependency-version: 21.14.13 dependency-type: direct:development dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): sync uv.lock with dependabot pip bump --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com> |
||
|
|
498d876627 |
ci(release): pin build tooling and gate reproducible wheels (#945)
* feat(build): add locked reproducible wheel gate Build independently in clean source trees and virtualenvs, compare wheel bytes, and stage only verified canonical distributions. Safely clean recognized prior outputs on repeat runs. Part of #701 * ci(release): verify wheel reproducibility before publishing Run the shared gate in PR and tag workflows, preserve failure diagnostics, and keep verification artifacts out of release checksums. Make Snap Store publication wait for the gate and reuse the canonical distributions for PyPI. Part of #701 * docs(release): document reproducible wheel validation Describe the locked toolchain, canonical publication boundary, same-platform scope, diagnostic outputs, and safe automatic cleanup. * chore(scripts): update executable permissions * fix(build): isolate release tooling and preserve cleanup retries Exclude host site-packages from build-only virtualenvs so unlocked setuptools plugins cannot affect verified distributions. Delete staged artifacts before canonical ownership evidence to recover safely from interrupted cleanup. Add regression tests and document the build-only environment exception. * fix(release): make reproducible builds retryable and refresh tools Regenerate release build exports from uv.lock. Hold a checkout lock through cleanup and staging, and atomically rename complete archives into dist. Cover interrupted staging, competing processes, and lock release with regression tests. --------- Co-authored-by: Kanishk Pachauri <itskanishkp.py@gmail.com> Co-authored-by: sesav <1636488+sesav@users.noreply.github.com> |