Skip to content

chore(lock): read the lock as written; drop the pre-release spellings - #9

Open
devin-ai-integration[bot] wants to merge 1 commit into
developfrom
chore/drop-lock-compat
Open

devin-ai-integration[bot] wants to merge 1 commit into
developfrom
chore/drop-lock-compat

Conversation

@devin-ai-integration

@devin-ai-integration devin-ai-integration Bot commented Nov 12, 2026 •

Copy link
Copy Markdown
Contributor

Summary

0.1.0 shipped two translations for lock formats no release ever wrote. They go:

  • lock.Usage.UnmarshalJSON accepted a bare string ("usage": ["pkg:…@1.2.0"]) beside the {resource, versionConstraint} object. Removed; a string usage is now a JSON decode error from lock.Parse.

  • install.keyResources re-parsed every lock resource through origin.Parse and replaced it with its key, which silently upgraded pkg:git/host/path and bare git+ssh://… resources to pkg:generic/…?vcs_url=…. It still maps a canonical identity to its key (that is how repo.git and repo meet, a 0.1.0 behaviour that stays), but any resource whose Identity() is not the text in the lock is now an error:

    .project.lock.json: packages[0] resource pkg:git/example.org/team/widgets is not canonical
    (this tool writes pkg:generic/widgets?vcs_url=git%2Bhttps:%2F%2Fexample.org%2Fteam%2Fwidgets); delete the lock and run syspi lock
    

Tests: TestParseLegacyStringUsages replaced by TestParseRejectsStringUsages; TestKeyResources now asserts the refusal for pkg:git/…, a bare URL, and a versioned identity; the install round-trip test asserts the error instead of a silent rewrite; TestLockMatchesAcrossGitSuffixSpellings keeps all four usage spellings but feeds only canonical lock spellings. docs/packages.md states the rule; changelog fragment under removed.

Gate: go build/vet, gofmt -l empty, SYSPI_REQUIRE_VCS=1 go test -count=1 ./... green locally.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/68b5a820c94c465ba03856b204dbd50d
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/68b5a820c94c465ba03856b204dbd50d?variant=devin
Requested by: @HuiJun


🟢 Devin Review found nothing to fix · View findings

Devin Review

No release wrote pkg:git/… or bare-URL lock resources or string usages, so the translation of them goes; a non-canonical resource is now refused with the form this tool writes.

Co-Authored-By: jason.han <hanhuijun@gmail.com>
@devin-ai-integration

Copy link
Copy Markdown
Contributor Author

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

  • Disable automatic comment, CI, and merge conflict monitoring

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant