fix(job-analysis): declare a Python floor its owned dependencies can install - #305
fix(job-analysis): declare a Python floor its owned dependencies can install#305seonghobae wants to merge 7 commits into
Conversation
…install services/job-analysis-api/pyproject.toml advertised requires-python >=3.11, but both mandatory owned distributions it pins require >=3.12: packages/hris-kernel (0.4.0) and packages/keyverse-adapter (0.1.0). A 3.11 interpreter therefore cannot install the service's declared dependency closure, while source-tree PYTHONPATH test execution hid the contradiction. Raise the declared floor to >=3.12 and add a metadata regression that reads the owned package pyprojects, asserts the exact internal pins match the canonical package names and versions, and asserts the service Python floor is not below any owned dependency floor. This mirrors the equivalent People API contract so the same class of stale metadata cannot return unnoticed.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough서비스의 최소 Python 버전을 3.12로 변경했습니다. 테스트는 프로젝트 메타데이터를 읽고, 내부 의존성의 정규화된 이름과 정확한 버전 고정을 검증합니다. Changes런타임 및 내부 의존성 일관성
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The service now declares the dependency-required Python 3.12 floor, with metadata checks guarding its owned dependency pins. No merge-blocking risk was identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The change correctly raises the service Python floor to >=3.12 to match the floors of its owned runtime dependencies (orgmetra-hris-kernel and orgmetra-keyverse-adapter). The new test reads each package's actual pyproject metadata and verifies that the service floor covers every owned package floor, protecting against stale or incompatible pins. The floor bump is both necessary and sufficient per the test assertions, and no regressions or correctness issues were found.
Reviewed changed lines
services/job-analysis-api/pyproject.toml:10 (RIGHT): The requires-python floor is raised from >=3.11 to >=3.12 to align with the owned package floors enforced by the new test.services/job-analysis-api/tests/test_internal_dependency_versions.py:48 (RIGHT): The assertion enforces that the service Python floor is >= each owned package floor, making the >=3.12 bump necessary and preventing future installability regressions.
Adversarial validation
services/job-analysis-api/pyproject.toml:10 (RIGHT)falsified: Raising requires-python to >=3.12 could break installation on Python 3.11 environments that previously worked. — The new test test_job_analysis_api_python_floor_covers_owned_runtime_dependencies reads the actual pyproject files of orgmetra-hris-kernel and orgmetra-keyverse-adapter and asserts their minimum Python floors are <= the service floor. Both packages declare floors that require >=3.12, so they cannot install on 3.11 regardless of this change. The service floor bump to >=3.12 therefore only reflects the mandatory requirement of its owned dependencies, and 3.11 was never actually installable.services/job-analysis-api/tests/test_internal_dependency_versions.py:48 (RIGHT)falsified: The new floor-coverage test could be circular or fail to catch a dependency floor raised above the service floor. — The test calls _project_metadata on the package paths (line 13) to read the current pyproject data from disk, then _minimum_python_version extracts the exact floor. The assertion at line 48 compares each package floor to the service floor. If a package floor were > service floor, the assertion would fail. This is not circular because the metadata is sourced directly from the owned packages, not from the service's own declaration.- Residual risk: Minimal residual risk; the test relies on exact >=major.minor parsing and would require updating if the contract changes to a different specifier format.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
d47e01468e55b365302b1ffaa7e1d5e73a0a95e3 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
Lane verification at adversarial head
|
1 participant
Scope
Protected base is
develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. This is a metadata/acceptance correctness repair for the Job Analysis service distribution; no runtime domain behavior, database schema, API, or employment-decision semantics change.Python-floor finding
services/job-analysis-api/pyproject.tomldeclaredrequires-python = ">=3.11"while both mandatory owned distributions it pins require>=3.12:packages/hris-kernel/pyproject.toml:requires-python = ">=3.12"(version0.4.0)packages/keyverse-adapter/pyproject.toml:requires-python = ">=3.12"(version0.1.0)A Python 3.11 interpreter therefore cannot install the service's declared dependency closure. Canonical Foundation runs the service tests with owned
srcdirectories onPYTHONPATH, which exercises source behavior without proving resolver/installability of the declared distribution closure. The unchanged-base regression fails withassert (3, 12) <= (3, 11);d47e01468e55b365302b1ffaa7e1d5e73a0a95e3raised the service floor to>=3.12and added metadata tests.Internal-pin false-greens found during review
Fresh review of
d47e014...found that the new test claimed to prove every declared internalorgmetra-*==versionpin was canonical but implemented onlyassert expected_dependencies <= declared_dependencies. That proves required pins are present, but an extra stale or unknown internal dependency would still pass.Test-first
361d48bcc15bb8de13df85f5dd08f4aa6b3d1b90added a negative regression for that extra-pin case while preserving the subset implementation. Its hosted generation was cancelled by immediate successor publication, so no hosted RED is claimed.66e2fcb93fea5d7d2624d2cbc8859511a119e6bfthen classified literalorgmetra-*declarations and required that set to equal the canonical ownedname==versionset. Foundation34577568833reached terminal SUCCESS on that exact head before the next finding; it is historical causal evidence only.A narrower packaging-identity audit found that literal
startswith("orgmetra-")is not a valid distribution-ownership classifier. PyPA's current Names and normalization specification requires comparison after lowercasing and replacing runs of.,_, or-with-; therefore underscore/dot/case variants are equivalent names for lookup/comparison. A stale internal pin using_or.could have been misclassified as a third-party dependency. Primary specification: https://packaging.python.org/en/latest/specifications/name-normalization/Test-first
b9e1daa73121bf0e6f126c42f8ecda41e8db2e33captured the underscore-form escape against the literal classifier; its hosted generation was cancelled by successor publication.2934ca96f73187ede10ed0a0fd08c6cd622fd62ethen normalized dependency names for Orgmetra-namespace classification while preserving canonical exact original pins.That first normalizing parser was itself too narrow: its lookahead admitted extras/direct references/operators/markers but rejected the standards-valid compatibility form
requests (>=2.0). PyPA's current Dependency specifiers grammar retains optional parentheses around a version specifier for PEP 345 compatibility and says consumers should accept them even though producers should not generate them: https://packaging.python.org/en/latest/specifications/dependency-specifiers/Test-first
538de7b45ed497737ec82cdc0f57337196a6cc4crequires an unrelated parenthesized third-party requirement to remain accepted by the ownership classifier; the exact hosted generation was cancelled by immediate successor publication, so no hosted RED is claimed. Minimal successor648aca54c30ee7879e85faeeab76609c0a70b1e5deliberately parses only the leading standards-valid distribution-name token needed for ownership classification, normalizes that name, and leaves full PEP 508 validation to packaging/build tooling. This avoids inventing a partial dependency grammar while still failing alternate/unknown Orgmetra declarations against the canonical exact pin set.The analogous People contract remains owned by #64 and received a non-competing normalization handoff. Repository-wide runtime compatibility remains #260; built wheel/sdist resolver-install acceptance remains #261. Durable baseline wording stays with #100.
Exact-head authority
develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f648aca54c30ee7879e85faeeab76609c0a70b1e5pyproject.tomlplus the owned metadata contract test34578195004is terminal SUCCESS; Repository quality job103195420990checked out the exact head and passed compilation, Foundation validation/dependency hygiene, owned unit/service contracts, isolated PostgreSQL contracts and read-only validation34578194933is terminal SUCCESS on the exact head34578194964is terminal FAILURE only at the authoritative Dependency Review availability boundary.dependency-reviewjob103196192506verified the exact head and then failed atCheck dependency review support; the pinned Dependency Review action was skipped. Independent Scorecard103196192467, OSV103196192491, and Trivy103196192518succeeded but are not substitutes. Fresh current-head canary is on canonical central ownerContextualWisdomLab/.github#810comment563208815134578194899is terminal FAILURE in the central consumer-before-producer settlement lane. Python consumer103196942801failed enforcement at08:28:47Zand Actions consumer103196942778at08:35:10Z; authoritative dispatch producer103200825822did not start until08:36:55Zand completed SUCCESS at08:37:03Z. Fresh current-head canary is on canonical central ownerContextualWisdomLab/.github#2040comment5632090449APPROVEDNoema review, but its own footer binds it to predecessord47e01468e55b365302b1ffaa7e1d5e73a0a95e3; it is stale after the six ordinary-forward hardening commits and is not current-head approval648aca54...head did not materialize any new exact-head OpenCode/Noema check identity or current-head Reviews API verdict. Existing OpenCode103197828450completed at08:26:45Zand Noema103196778350at08:30:22Z, both before Ready. Fresh lifecycle canary is onContextualWisdomLab/.github#2045comment5632112971The owned source/metadata acceptance is current-head GREEN; the terminal failures and review-materialization defect above are canonical central-owner incidents and are not reasons to churn this leaf source, weaken gates, or manufacture a verdict. Keep normal merge fail-closed until then-live central required workflows and current-head review governance are admissible.
Acceptance
-,_,., and case variants cannot evade the internal boundary.name==versionpin; missing, stale, alternatively spelled, or unknown internal dependencies fail closed.Summary by CodeRabbit
호환성 변경
품질 개선