fix(ci): compare requirements.txt drift against git, not a scratch export - #967
Merged
Conversation
…port The guard added in #966 exports to /tmp/requirements.check.txt and diffs it against the checked-in file. uv stamps the -o path it was given into the export's header comment, so the two files differ on line 2 no matter how fresh the checked-in export is: -# uv export --no-hashes -o requirements.txt +# uv export --no-hashes -o /tmp/requirements.check.txt Every lane that has a requirements.txt fails: examples/ag-ui e2e and the six cockpit/ag-ui cockpit e2e caps. Regenerate in place with the exact command the error message tells you to run, and let `git diff --exit-code` decide — that compares against the committed file, so real drift is still caught. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Follow-up to the header fix in this branch. Two more ways the guard disagreed with reality: - Three lanes export with --no-dev (their header records it), but the guard always ran a bare --no-hashes export, so it demanded that pytest and pytest-asyncio be committed into the files the Railway images install from. - cockpit/langgraph/streaming/python/requirements.txt is hand-maintained loose pins, not a uv export at all; the guard would have replaced it wholesale with a 257-line resolved export. The guard now reads the command uv stamps into each file's own header: it skips files that aren't uv exports, and mirrors --no-dev when the header used it. aws-strands and microsoft-agent-framework are re-exported so their headers record the --no-dev they were actually built with. Content is byte-identical — the change is one header line each, no package added or removed from any image. Verified across all 12 lanes that have a requirements.txt: 9 clean, 1 skipped as hand-maintained, 2 corrected here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
blove
added a commit
that referenced
this pull request
Sep 3, 2026
…e-export (#970) #967 re-exported cockpit/runtimes/{aws-strands,microsoft-agent-framework} requirements.txt so their headers record the --no-dev they were actually built with. deployments/ag-ui-dev/deps/ is generated from those files, so its copies still carried the old header and the Railway deploy's drift check failed on main. The Deploy AG-UI Railway workflow only runs on push to main, so neither #967 nor #963 exercised this check before merge. Content is unchanged — two header lines, no package added or removed. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
requirements.txtdrift guard added in #966 can never pass, and disagrees with reality in three ways. All lanes that have arequirements.txtcurrently fail onmainand on every open PR:examples/ag-ui — e2eplus the eightCockpit — e2e (cockpit-*)caps.1. The header records the
-opath. The guard exported to/tmp/requirements.check.txtand diffed that against the checked-in file, butuvstamps the-opath it was given into the export's header comment, so line 2 always differs:2. Some lanes export with
--no-dev.cockpit/ag-ui/subagents,cockpit/runtimes/aws-strandsandcockpit/runtimes/microsoft-agent-frameworkdeclare adevdependency group. The guard always ran a bare--no-hashesexport, so it demanded thatpytestandpytest-asynciobe committed into the files the Railway images install from.3. One lane isn't a uv export.
cockpit/langgraph/streaming/python/requirements.txtis hand-maintained loose pins (langgraph>=0.2.0, …). The guard would have replaced it wholesale with a 257-line resolved export.The guard now regenerates in place using the command
uvstamps into each file's own header — skipping files that aren't uv exports, and mirroring--no-devwhen the header used it — and letsgit diff --exit-codecompare against the committed file, so real drift is still caught.aws-strandsandmicrosoft-agent-frameworkare re-exported so their headers record the--no-devthey were actually built with. Content is byte-identical; the change is one header line each. No package is added to or removed from any deployed image.Verification
requirements.txtunder the new logic — 9 clean, 1 skipped as hand-maintained, 2 corrected here.ag-ui-protocol==0.1.19, re-ran the guard → exit 1. The guard is not vacuous.Known gap (not fixed here)
cockpit/langgraph/streaming/python/requirements.txtis now explicitly skipped because it is hand-maintained with>=pins — which is exactly the silent-drift risk the guard exists to prevent. Converting it to a pinned uv export changes what that deployment installs, so it deserves its own PR rather than riding along with a CI fix.🤖 Generated with Claude Code