From 5dd0c746610f21fe6e01fc95048ebf0df7c39617 Mon Sep 17 00:00:00 2001 From: Ibrahim Halatci Date: Mon, 5 Oct 2026 12:23:48 +0300 Subject: [PATCH 1/3] Pin platformdirs with a working pytest startup plugin Use 4.12.1, the first plugin release with the startup-import fix, and retain all other lock versions. Align the documented Python minimum with the installed dependencies. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 16db2b29-47c2-4bf8-992e-ed325051912e --- packaging_automation/README.md | 4 ++-- packaging_automation/requirements.in | 2 ++ packaging_automation/requirements.txt | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/packaging_automation/README.md b/packaging_automation/README.md index 64a9a899..dc6cf7f4 100644 --- a/packaging_automation/README.md +++ b/packaging_automation/README.md @@ -1,6 +1,6 @@ ## Python Environment Installation -Before using script, you need to make sure that Python > 3.8 is installed in your system. +Before using script, you need to make sure that Python >= 3.10 is installed in your system. ### Clone Tools Repository @@ -23,7 +23,7 @@ python -m pip --version Output should be like following ``` console -pip 21.1.2 from /home/vagrant/.local/lib/python3.8/site-packages/pip (python 3.8) +pip 22.0.2 from /usr/lib/python3/dist-packages/pip (python 3.10) ``` If you get error, you should first install pip diff --git a/packaging_automation/requirements.in b/packaging_automation/requirements.in index 7bcb04f7..d0683855 100644 --- a/packaging_automation/requirements.in +++ b/packaging_automation/requirements.in @@ -5,6 +5,8 @@ GitPython Jinja2 parameters_validation pathlib2 +# Include the pytest plugin and its startup-import fix. +platformdirs==4.12.1 psycopg2-binary pycurl PyGithub diff --git a/packaging_automation/requirements.txt b/packaging_automation/requirements.txt index a0c592d0..ec0f852c 100644 --- a/packaging_automation/requirements.txt +++ b/packaging_automation/requirements.txt @@ -136,8 +136,9 @@ pbr==6.0.0 # via stevedore pep8-naming==0.10.0 # via prospector -platformdirs==4.2.2 +platformdirs==4.12.1 # via + # -r tools/packaging_automation/requirements.in # black # pylint # pypistats From 03a1fc464fae0a1ca8c4ef5ca058524aba8fdc2b Mon Sep 17 00:00:00 2001 From: Ibrahim Halatci Date: Mon, 5 Oct 2026 12:55:33 +0300 Subject: [PATCH 2/3] Raise four packaging dependencies to verified security fixes Lock GitPython 3.1.62, PyJWT 2.15.0, urllib3 2.8.0 and AnyIO 4.14.2 with source minimum constraints. Preserve all other locked versions and the validated platformdirs pin. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 16db2b29-47c2-4bf8-992e-ed325051912e --- packaging_automation/requirements.in | 6 ++++-- packaging_automation/requirements.txt | 21 ++++++++++++--------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/packaging_automation/requirements.in b/packaging_automation/requirements.in index d0683855..70556b84 100644 --- a/packaging_automation/requirements.in +++ b/packaging_automation/requirements.in @@ -1,7 +1,8 @@ +anyio>=4.14.2 attrs black docker -GitPython +GitPython>=3.1.62 Jinja2 parameters_validation pathlib2 @@ -10,13 +11,14 @@ platformdirs==4.12.1 psycopg2-binary pycurl PyGithub +PyJWT[crypto]>=2.15.0 pytest python-gnupg python-string-utils PyYAML requests SQLAlchemy -urllib3 +urllib3>=2.8.0 wheel python-dotenv prospector[with_everything] diff --git a/packaging_automation/requirements.txt b/packaging_automation/requirements.txt index ec0f852c..3ce031bf 100644 --- a/packaging_automation/requirements.txt +++ b/packaging_automation/requirements.txt @@ -4,8 +4,10 @@ # # pip-compile --output-file=tools/packaging_automation/requirements.txt tools/packaging_automation/requirements.in # -anyio==4.4.0 - # via httpx +anyio==4.14.2 + # via + # -r tools/packaging_automation/requirements.in + # httpx astroid==2.15.8 # via # pylint @@ -65,7 +67,7 @@ flake8-polyfill==1.0.2 # via pep8-naming gitdb==4.0.11 # via gitpython -gitpython==3.1.58 +gitpython==3.1.62 # via # -r tools/packaging_automation/requirements.in # prospector @@ -171,8 +173,11 @@ pygments==2.20.0 # pyroma # pytest # rich -pyjwt[crypto]==2.13.0 - # via pygithub +pyjwt[crypto]==2.15.0 + # via + # -r tools/packaging_automation/requirements.in + # pygithub + # pyjwt pylint==2.17.7 # via # prospector @@ -248,9 +253,7 @@ six==1.16.0 smmap==5.0.1 # via gitdb sniffio==1.3.1 - # via - # anyio - # httpx + # via httpx snowballstemmer==2.2.0 # via pydocstyle sqlalchemy==2.0.30 @@ -296,7 +299,7 @@ typing-extensions==4.15.0 # pygithub # pyjwt # sqlalchemy -urllib3==2.7.0 +urllib3==2.8.0 # via # -r tools/packaging_automation/requirements.in # docker From 5f62ab5959e5fb75a9538e7f25787dd294fa174a Mon Sep 17 00:00:00 2001 From: Ibrahim Halatci Date: Mon, 5 Oct 2026 17:37:55 +0300 Subject: [PATCH 3/3] Complete packaging dependency hardening with compatible lint tooling Install setuptools 83 via an allow-unsafe lock, update wheel and Click, and use the minimum resolvable Prospector compatibility set. Pass the release validator namespace explicitly and cover its validation paths offline in CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 16db2b29-47c2-4bf8-992e-ed325051912e --- .github/workflows/tool-tests.yml | 3 ++ packaging_automation/prepare_release.py | 4 +-- packaging_automation/requirements.in | 7 ++-- packaging_automation/requirements.txt | 35 ++++++++++--------- .../tests/test_prepare_release_parameters.py | 33 +++++++++++++++++ 5 files changed, 60 insertions(+), 22 deletions(-) create mode 100644 packaging_automation/tests/test_prepare_release_parameters.py diff --git a/.github/workflows/tool-tests.yml b/.github/workflows/tool-tests.yml index a12e965f..23a73bfd 100644 --- a/.github/workflows/tool-tests.yml +++ b/.github/workflows/tool-tests.yml @@ -72,6 +72,9 @@ jobs: # - name: Unit tests for "Prepare Release" # run: python -m pytest -q packaging_automation/tests/test_prepare_release.py + - name: Unit tests for "Prepare Release" parameters + run: python -m pytest -q packaging_automation/tests/test_prepare_release_parameters.py + - name: Unit tests for "Update Docker" run: python -m pytest -q packaging_automation/tests/test_update_docker.py diff --git a/packaging_automation/prepare_release.py b/packaging_automation/prepare_release.py index 888528a2..ca1556a3 100644 --- a/packaging_automation/prepare_release.py +++ b/packaging_automation/prepare_release.py @@ -775,7 +775,7 @@ def create_new_sql_for_downgrade_path( CHECKOUT_DIR = "citus_temp" -def validate_parameters(major_release_flag: bool): +def validate_parameters(major_release_flag: bool, arguments: argparse.Namespace): if major_release_flag and arguments.cherry_pick_enabled: raise ValueError("Cherry pick could be enabled only for patch release") @@ -810,7 +810,7 @@ def validate_parameters(major_release_flag: bool): arguments = parser.parse_args() execution_path = f"{os.getcwd()}/{CHECKOUT_DIR}" major_release = is_major_release(arguments.prj_ver) - validate_parameters(major_release) + validate_parameters(major_release, arguments) try: initialize_env(execution_path, arguments.prj_name, CHECKOUT_DIR) diff --git a/packaging_automation/requirements.in b/packaging_automation/requirements.in index 70556b84..0add79c1 100644 --- a/packaging_automation/requirements.in +++ b/packaging_automation/requirements.in @@ -1,6 +1,7 @@ anyio>=4.14.2 attrs black +click>=8.3.3 docker GitPython>=3.1.62 Jinja2 @@ -19,8 +20,8 @@ PyYAML requests SQLAlchemy urllib3>=2.8.0 -wheel +wheel>=0.48.0 python-dotenv -prospector[with_everything] +prospector[with_everything]>=1.12.1 pypistats -setuptools==70.0.0 +setuptools>=83.0.0 diff --git a/packaging_automation/requirements.txt b/packaging_automation/requirements.txt index 3ce031bf..712219d6 100644 --- a/packaging_automation/requirements.txt +++ b/packaging_automation/requirements.txt @@ -2,13 +2,13 @@ # This file is autogenerated by pip-compile with Python 3.10 # by the following command: # -# pip-compile --output-file=tools/packaging_automation/requirements.txt tools/packaging_automation/requirements.in +# pip-compile --allow-unsafe --output-file=tools/packaging_automation/requirements.txt tools/packaging_automation/requirements.in # anyio==4.14.2 # via # -r tools/packaging_automation/requirements.in # httpx -astroid==2.15.8 +astroid==3.0.0 # via # pylint # pylint-celery @@ -35,8 +35,10 @@ chardet==5.2.0 # via mbstrdecoder charset-normalizer==3.3.2 # via requests -click==8.1.7 - # via black +click==8.3.3 + # via + # -r tools/packaging_automation/requirements.in + # black cryptography==50.0.0 # via pyjwt dataproperty==1.0.1 @@ -90,8 +92,6 @@ isort==5.13.2 # via pylint jinja2==3.1.6 # via -r tools/packaging_automation/requirements.in -lazy-object-proxy==1.10.0 - # via astroid markdown-it-py==3.0.0 # via rich markupsafe==2.1.5 @@ -148,7 +148,7 @@ pluggy==1.5.0 # via pytest prettytable==3.10.0 # via pypistats -prospector[with-everything]==1.10.3 +prospector[with-everything]==1.12.1 # via -r tools/packaging_automation/requirements.in psycopg2-binary==2.9.12 # via -r tools/packaging_automation/requirements.in @@ -178,7 +178,7 @@ pyjwt[crypto]==2.15.0 # -r tools/packaging_automation/requirements.in # pygithub # pyjwt -pylint==2.17.7 +pylint==3.0.0 # via # prospector # pylint-celery @@ -187,13 +187,12 @@ pylint==2.17.7 # pylint-plugin-utils pylint-celery==0.3 # via prospector -pylint-django==2.5.3 +pylint-django==2.6.1 # via prospector pylint-flask==0.6 # via prospector -pylint-plugin-utils==0.7 +pylint-plugin-utils==0.8 # via - # prospector # pylint-celery # pylint-django # pylint-flask @@ -238,7 +237,7 @@ requests==2.33.0 # docker # pygithub # pyroma -requirements-detector==1.2.2 +requirements-detector==1.3.1 # via prospector rich==13.7.1 # via bandit @@ -309,12 +308,14 @@ vulture==2.11 # via prospector wcwidth==0.2.13 # via prettytable -wheel==0.46.2 +wheel==0.48.0 # via -r tools/packaging_automation/requirements.in wrapt==1.16.0 - # via - # astroid - # deprecated + # via deprecated # The following packages are considered to be unsafe in a requirements file: -# setuptools +setuptools==83.0.0 + # via + # -r tools/packaging_automation/requirements.in + # pyroma + # pytablewriter diff --git a/packaging_automation/tests/test_prepare_release_parameters.py b/packaging_automation/tests/test_prepare_release_parameters.py new file mode 100644 index 00000000..7f204723 --- /dev/null +++ b/packaging_automation/tests/test_prepare_release_parameters.py @@ -0,0 +1,33 @@ +import argparse + +import pytest + +from ..prepare_release import validate_parameters + + +@pytest.mark.parametrize( + "major_release,cherry_pick,earliest_date,schema_version,error", + [ + (True, False, None, None, None), + (False, False, None, None, None), + (False, True, "2026.10.05", None, None), + (False, False, None, "15.0-1", None), + (True, True, None, None, "Cherry pick could be enabled only for patch release"), + (True, False, "2026.10.05", None, "earliest_pr_date could not be used"), + (True, False, None, "15.0-1", "schema_version could not be set"), + (False, True, None, None, "earliest_pr_date parameter could not be empty"), + ], +) +def test_validate_parameters( + major_release, cherry_pick, earliest_date, schema_version, error +): + arguments = argparse.Namespace( + cherry_pick_enabled=cherry_pick, + earliest_pr_date=earliest_date, + schema_version=schema_version, + ) + if error is None: + validate_parameters(major_release, arguments) + else: + with pytest.raises(ValueError, match=error): + validate_parameters(major_release, arguments)