Repository navigation
Let consumers declare their gated Python with a committed .python-version - #30
Merged
Merged
Conversation
The shared gate hardcodes Python 3.12 and takes no inputs, so a consumer cannot move its gated interpreter. These rods pin the contract for a resolver step that reads the consumer's committed .python-version: 3.12 only when no file exists, a loud refusal for an empty or malformed file. They replace the rod that pinned the 3.12 literal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…version The shared gate hardcoded Python 3.12 and takes no inputs, so no consumer could move its gated interpreter. A resolver step now reads the consumer's committed .python-version in the consumer tree and feeds setup-python. No file keeps today's 3.12, said out loud. A committed file that is blank, multi-line or outside ^3.N(.N)? is refused with a typed error, never downgraded to the default. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The refusal rods measured only a nonzero exit and no version= line, which a bash crash would also satisfy. They now require exactly one typed ::error:: refusal line carrying the accepted grammar and the shell-quoted raw bytes, a loud ::notice:: on the default path, CRLF and padded accepts, and refusal (never fallback) for a dangling symlink or a directory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
The gate hardcoded
python-version: "3.12"and accepts no inputs by design, so no consumer could move the interpreter it is gated on. This PR adds one resolver step,id: python. It runs in the consumer tree after the consumer checkout and feedsactions/setup-pythonthrough${{ steps.python.outputs.version }}..python-versionversion=3.12plus a::notice::saying so. This is unchanged for every current consumer..python-version=3.14/3.14.8(CRLF or padding trimmed)^3\.[0-9]+(\.[0-9]+)?$::error::quality-gate refused: …line that names the shell-quoted raw bytes and the grammar. Never downgraded to 3.12.The zero-inputs doctrine is intact: the version comes from committed consumer state, never from a caller knob. No
inputs:, nocontinue-on-error, nopaths:filter, and everyuses:stays SHA-pinned.self-ci.yml(the kit's own CI) stays on 3.12 in this change.How it was proven
tests/test_gate_python_version.py, which replaces the literal-pinningtest_gate_uses_python_312) was committed first (c59c61e) and observed red: 14/14 driving tests failed, 35 inherited passed. The implementation (e41dbe9) came from a different author and is fenced out of the tests. A third pass (fc6445c) tightened the refusal rods so they prove a typed refusal and not merely a nonzero exit.run:script out of the parsed YAML and runs it withbash --noprofile --norc -eo pipefailagainst fixture consumer roots.cf-gate, which is what self-ci runs): PASS 11/11 on CPython 3.12.15 and 3.14.8. Suite: 606 passed on both.Owed (not fixed here, by design)
.python-version(directory, dangling symlink, permission error) fails throughcatunderbash -e. That is fail-safe but untyped.3.14would be accepted as3.14.After merge
Each private consumer gets one PR that adds
.python-version=3.14and bumps its kit pin to this merge commit. Every pin bump also pulls in the gauge changes between the old pin and this one, and each consumer PR will name its bump size.🤖 Generated with Claude Code