Repository navigation
Conversation
A runpod entry in a resource's dependencies (or requirements.txt) was installed and then overlaid by sync_running_package, so the worker ran a silent mix of the two builds. Fail the build when a dependency resolves to the runpod distribution, naming RUNPOD_PACKAGE_SPEC as the supported way to pin the worker's runpod build. Detection covers version pins and runpod wheel/sdist URLs. - add reject_runpod_dependency, called before vendoring - tests cover a version pin, a wheel URL, and non-runpod lookalikes
celine-runpod
changed the title
celine-runpod
changed the title
runpod pin in dependencies=[...] silently produces a mixed install on workers (SLS-993)
Contributor
|
bugbot run |
deanq
changed the title
runpod pin in dependencies=[...] silently produces a mixed install on workers (SLS-993)runpod pin in dependencies=[...] silently produces a mixed install on workers
There was a problem hiding this comment.
🟡 Changes recommended
Dependency-name parsing still allows RunPod requirements to bypass the mixed-install guard and incorrectly rejects unrelated dependencies with hyphenated source archive names.
4 open issues
What changed in this PR
This PR adds an early build guard intended to prevent mixed worker SDK installations when applications declare runpod as a dependency, directing users to RUNPOD_PACKAGE_SPEC instead.
Changes:
- Adds distribution-name detection for requirement specs, archive paths, and URLs.
- Rejects detected
runpoddependencies before vendoring. - Adds rejection, lookalike-package, and build-order tests.
| File | Description |
|---|---|
| tests/test_apps/test_build.py | Tests dependency rejection, allowed alternatives, and failure before vendoring. |
| runpod/apps/build.py | Adds distribution detection and integrates the rejection guard into environment builds. |
Review effort: Balanced
Use packaging's Requirement and wheel/sdist filename parsers instead of hand-rolled name extraction so the guard recognises more runpod pins and stops rejecting unrelated distributions: - a direct reference (runpod @ https://.../sdk.tar.gz) and a bare wheel filename now resolve to runpod - the egg fragment is read before the query is stripped, so ...?release=1#egg=runpod is recognised - egg extras (#egg=runpod[all]) are parsed off before canonicalizing - wheel and sdist filenames are parsed per PEP 427/625, so a hyphenated sdist like runpod-cleanup-1.0.tar.gz is no longer misread as runpod Adds a test row for each case.
KAJdev
approved these changes
Nov 9, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A
runpodentry in a resource'sdependencies=[...](orrequirements.txt) was installed at deploy time and then overlaid bysync_running_package, which copies the client's ownrunpodtree on top. The worker ran a silent mix of the two builds with no warning.This fails the build when a declared dependency resolves to the
runpoddistribution, and points the user at theRUNPOD_PACKAGE_SPECenvironment variable, which is the supported way to choose the worker'srunpodbuild.Why
dependenciesis not a sound channel for pinning the SDK: the overlay always wins for the package tree while the pinned dist-info and any version-specific files remain, so the worker runs code the user did not pin. Failing fast with an actionable message is clearer than a mixed install that only surfaces as runtime behavior drift.Changes
reject_runpod_dependency, called inbuild_environmentbefore any vendoring runs.runpodwheel/sdist URLs (and#egg=fragments), without tripping on lookalikes likerunpodctlormy-runpod-helper.Test plan
reject_runpod_dependency: rejects barerunpod,runpod==X,runpod>=X, case variants, a wheel URL, a plainrunpod.tar.gzURL, and a local sdist path; passesnumpy,requests,runpod-cleanup,run_pod(a different distribution), and non-runpod URLs.build_environmentraises beforevendoris called when a resource listsrunpodindependencies.Known gap (out of scope): a
git+<repo>ref to the runpod repo with no#egg=fragment is not caught by filename parsing; version pins and wheel/sdist URLs are covered.