Skip to content

TST: towards reproducible builds for oldestdeps #18782

Closed
4 of 4 issues completed
Closed

Description

@neutrinoceros

This is a tracker issue for a general problem I've been trying to solve; to put it simply, I'm trying to make oldestdeps ci runs reproducible, i.e., have the tested environment stay exactly the same from one run to the next, eliminating a failure mode where newer versions of transitive dependencies break direct ones.
#16963 was a huge milestone towards this goal, but it's not sufficient in itself: transitive dependencies are still resolved to latest versions, which is not only orthogonal to the purpose of oldestdeps, but also actively harmful in the long run, as it leaves many opportunities for incompatibilities with our direct dependencies to creep in and bring oldestdeps down.

Exact reproducibility can be achieved with lock files (as described in #17596). However, there's another viable and, perhaps, more elegant strategy in the case of oldestdeps: we could leverage uv's --resolution=lowest, instead of the current --resolution=lowest-direct, which doesn't constrain transitive deps.

Getting there requires a coordination effort with upstream packages that currently do not declare lower bounds for their own direct dependencies (or have incorrect ones), which we've already started conducting.
It might take a while for upstream dependencies to absorb all contributions, and for us to be able to sufficiently bump our direct dependencies to benefit from it, but in the mean time, we have the ability to add the missing pieces of metadata to [tool.uv.constraints] to benefit immediately from the work done.

upstream

local

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions