Repository navigation
fix(gate): verify dependency pins against the local package version, not only npmjs - #327
Merged
Merged
Conversation
…not only npmjs The registry half of the version-parity gate only compared pins against npmjs, which made the pin lifecycle an unsolvable bind: after every crate publish, all open PRs go red until a fix(deps) chase lands, and a pin bumped ahead of the registry passed without being verified against anything (it could point at a version that will never exist). Rule now: for every exact pin whose target has a local sibling package under packages/, the pin must equal the LOCAL package version — the one the merge publishes. Offline-deterministic (holds even when the registry is unreachable; a network blip still degrades, never fails, a matching pin — AC3). Registry rule keeps precedence (a pin behind the published latest fails even when it matches local — rebase instead). Same gate-rejection vocabulary (dependency-pin-drift), no new kind. Red-first: 7 new tests, 4 failed before the implementation. Automated written using a AI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the registry-vs-local bind in the version-parity gate's
--pinshalf.The defect
The gate compared pins only against npmjs, so the pin lifecycle was unsolvable: after every crate publish, all open PRs go red until a
fix(deps)chase lands (live today: #325), and a pin bumped ahead of the registry passed without being verified against anything — it could point at a version that will never exist.The rule
For every exact pin whose target has a local sibling package under
packages/, the pin must equal the local package version — the one this merge publishes. Offline-deterministic: holds even when the registry is unreachable (a network blip still degrades, never fails, a matching pin — AC3). The registry rule keeps precedence (a pin behind the published latest fails even when it matches local — rebase instead). Same gate-rejection vocabulary (dependency-pin-drift), no new kind.Test-first
7 new tests; 4 red before the implementation (same-PR release pass, same-PR coupling fail, never-exists fail, offline fail). Root suite 929/929, package suite 471/471.
Note
This PR's own
--pinscheck is red until #325 merges (its checkout still pins 0.4.0) — the fixed gate correctly rejecting a stale pin is the fix working. Rebase after #325 and it goes green.AGENTS.md §Packages updated to the new rule.
Automated written using a AI