[TODO] Stability improvement: Implement a pip-tools-managed constraints file #101
Labels
enhancement
New feature or request
Comments
andrewpollock
referenced
this issue
in google/osv.dev
Dec 5, 2022
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish) | action | minor | `v1.5.1` -> `v1.6.1` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish</summary> ### [`v1.6.1`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.6.1) [Compare Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.6.0...v1.6.1) #### What's happened?! There was a sneaky bug in v1.6.0 which caused Twine to be outside the import path in the Python runtime. It is fixed in v1.6.1 by updating `$PYTHONPATH` to point to a correct location of the user-global `site-packages/` directory. **Full Diff**: pypa/gh-action-pypi-publish@v1.6.0...v1.6.1 ### [`v1.6.0`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.6.0) [Compare Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.5.2...v1.6.0) #### Anything's changed? The only update is that the Python runtime has been upgraded from 3.9 to 3.11. There are no functional changes in this release. **Full Changelog**: pypa/gh-action-pypi-publish@v1.5.2...v1.6.0 ### [`v1.5.2`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.5.2) [Compare Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.5.1...v1.5.2) #### What's Improved - Implemented the Twine transitive dependency tree pinning using pip-tools-generated constraint files. See [https://github.com/pypa/gh-action-pypi-publish/issues/107](https://togithub.com/pypa/gh-action-pypi-publish/issues/107) and [https://github.com/pypa/gh-action-pypi-publish/issues/101](https://togithub.com/pypa/gh-action-pypi-publish/issues/101) for details. **Full Diff**: pypa/gh-action-pypi-publish@v1.5.1...v1.5.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/google/osv.dev). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40OC4xIiwidXBkYXRlZEluVmVyIjoiMzQuNDguMSJ9-->
](https://renovatebot.com){kind=link}
|
@webknjaz is this ticket resolved? |
|
Kind of. I think I'll wrap the automation with tox and GHA before closing. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
It's got my attention that sometimes problems with transitive dependencies may reflect poorly on this action's ability to fulfil its purpose.
Here's what's happened in the past:
gccmissing #50The text was updated successfully, but these errors were encountered: