Skip to content

fix: data/*.json excluded from published package - #8

Merged
mwaseem-defendai merged 1 commit into
mainfrom
fix/wheel-missing-data-files
Jul 28, 2026
Merged

mwaseem-defendai merged 1 commit into
mainfrom
fix/wheel-missing-data-files

Conversation

@mwaseem-defendai

Copy link
Copy Markdown
Contributor

What

generation_param_defaults.json shipped in git but not in the built wheel/sdist
that got published as 2.9.4 — confirmed by downloading the actual PyPI
package and listing its contents.

Root cause

.gitignore's blanket *.json rule gets re-applied by hatchling at build time
regardless of the file being force-committed to git. Fixed at the source —
explicit force-include in the wheel/sdist build targets — plus a new CI job
that installs the built wheel in a clean venv and smoke-tests it, so this
class of bug can't pass CI silently again.

Verified against the real artifact, not just tests

Built wheel + sdist locally, listed contents to confirm the file is present,
installed the wheel into a clean venv, ran a full scan against demo/sample-repo,
confirmed generation-param provenance resolves correctly (framework_default/
not_applicable tiers populate, nothing silently degrades to unknown).

- generation_param_defaults.json was silently excluded from the published
  package (confirmed by inspecting the actual PyPI 2.9.4 sdist) — hatchling's
  default file selection re-applies .gitignore's blanket *.json rule at
  build time, independent of the file being force-added to git
- force-include data/*.json in both wheel and sdist targets
- add CI job that builds the wheel, installs it in a clean venv, and smoke-
  tests that generation_defaults actually loads — existing tests only ever
  ran against source, never caught this
- bump version to 2.9.5
@cursor

cursor Bot commented Jul 28, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@mwaseem-defendai
mwaseem-defendai merged commit 37be86d into main Jul 28, 2026
3 of 7 checks passed
@mwaseem-defendai
mwaseem-defendai deleted the fix/wheel-missing-data-files branch July 28, 2026 02:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant