Skip to content

[Supply Chain] Make dependency declarations and hash locks one atomic contract #369

Description

@seonghobae

Problem

Recent automated dependency PRs changed pyproject.toml and/or requirements.txt without updating requirements-lock.txt. CI installs the lock first and then installs the editable project with --no-deps, so those green checks exercised the previous dependency rather than the proposed version. This is false acceptance evidence and makes runtime, package metadata, and security scans disagree.

Required contract

  • Define the authoritative dependency inputs and generated lock outputs for runtime, web, MCP, transcription, development, and fuzz environments.
  • Regenerate every affected hash lock atomically from exact pins; no hand-edited partial graph unless a reviewed emergency runbook proves why.
  • Validate pyproject.toml base dependencies and every optional extra against the corresponding installed lock closure.
  • Validate exact pins in requirements.txt, requirements-*.in, and package metadata by normalized project name and environment marker.
  • Reject a PR when a direct dependency changes without all applicable locks, hashes, package extras, and runtime-version assertions changing together.
  • In CI, report installed versions from import/package metadata and prove the changed dependency is the one actually exercised.
  • Use binary-only installation where the supported platform contract permits it; fail closed on missing wheels rather than compiling pull-request-selected native source.
  • Preserve Python 3.10–current support policy explicitly and test marker-specific closures.
  • Generate a machine-readable dependency provenance manifest linking source declaration, lock entry, artifacts, hashes, interpreter/platform tags, and test lane.
  • Document rollback, emergency CVE patching, Dependabot configuration, release integration, SBOM reconciliation, CSAP/SOC 2 evidence, and APA 7 primary references.

Verification

TDD must cover stale-lock PRs matching the closed FastAPI #312 and httpx2 #314 shapes, marker differences, optional extras, renamed projects, duplicate/conflicting pins, missing hashes, source distributions, and installed-version mismatch. Require 100% statement/branch coverage and public docstrings for the validator, exact-current-head CI/security/SAST, and a clean package/wheel installation outside the source tree.

Integration

The validator should be reusable from central ContextualWisdomLab/.github while retaining a repository-local, offline executable contract. It must not depend on COPILOT_GITHUB_TOKEN or alter reviewer credentials.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: dependenciesDependency or lockfile maintenancearea: securitySecurity boundary, hardening, or vulnerability preventionmaintenancepriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: maintenanceMaintenance, build, dependency, or operational upkeep

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions