From a45eae63cd14b0c9d0650c91618dbdd4702e7113 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 29 Sep 2026 00:06:25 +0900 Subject: [PATCH] fix(ci): install defusedxml lock in trusted uv quality gate The full central test step collects the Noema document tests, which import defusedxml. The gate installed only the OpenCode review lock, so main runs failed at collection with ModuleNotFoundError. Install the hash-locked Noema document lock alongside it, matching the agent review runtime quality workflow, and pin the contract in its test. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01H8Nf6C8Cs5zDAF8z7MrgoB --- .github/workflows/trusted-uv-materializer-quality-ci.yml | 8 ++++++-- ...t_trusted_uv_materializer_quality_workflow_contract.py | 7 ++++++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trusted-uv-materializer-quality-ci.yml b/.github/workflows/trusted-uv-materializer-quality-ci.yml index db70ec324c..4b8e58092c 100644 --- a/.github/workflows/trusted-uv-materializer-quality-ci.yml +++ b/.github/workflows/trusted-uv-materializer-quality-ci.yml @@ -12,6 +12,7 @@ on: - "tests/test_uv*.py" - "tests/test_repository_branch_coverage_*.py" - "requirements-opencode-review-ci-hashes.txt" + - "requirements-noema-document-ci-hashes.txt" - "pyproject.toml" push: branches: [main] @@ -24,6 +25,7 @@ on: - "tests/test_uv*.py" - "tests/test_repository_branch_coverage_*.py" - "requirements-opencode-review-ci-hashes.txt" + - "requirements-noema-document-ci-hashes.txt" - "pyproject.toml" concurrency: @@ -104,10 +106,12 @@ jobs: with: python-version: "3.14" cache: pip - cache-dependency-path: requirements-opencode-review-ci-hashes.txt + cache-dependency-path: | + requirements-opencode-review-ci-hashes.txt + requirements-noema-document-ci-hashes.txt - name: Install hash-locked quality tooling - run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt + run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt -r requirements-noema-document-ci-hashes.txt - name: Run trusted uv tests with complete branch coverage run: | diff --git a/tests/test_trusted_uv_materializer_quality_workflow_contract.py b/tests/test_trusted_uv_materializer_quality_workflow_contract.py index 50a5ddb5fe..92e69149e9 100644 --- a/tests/test_trusted_uv_materializer_quality_workflow_contract.py +++ b/tests/test_trusted_uv_materializer_quality_workflow_contract.py @@ -26,6 +26,7 @@ def test_quality_workflow_runs_for_every_materializer_surface() -> None: '"tests/test_uv*.py"', '"tests/test_repository_branch_coverage_*.py"', '"requirements-opencode-review-ci-hashes.txt"', + '"requirements-noema-document-ci-hashes.txt"', '"pyproject.toml"', ) for required_path in required_paths: @@ -70,8 +71,12 @@ def test_full_quality_gate_proves_tests_coverage_docstrings_and_compilation() -> assert 'python-version: "3.14"' in workflow assert ( "python -m pip install --disable-pip-version-check --require-hashes " - "-r requirements-opencode-review-ci-hashes.txt" + "-r requirements-opencode-review-ci-hashes.txt " + "-r requirements-noema-document-ci-hashes.txt" ) in workflow + assert "defusedxml==0.7.1" in Path( + "requirements-noema-document-ci-hashes.txt" + ).read_text(encoding="utf-8") assert "branch = True" in workflow assert "scripts/ci/materialize_base_python_requirements.py" in workflow assert "fail_under = 100" in workflow