malkuthroandClaude Opus 4.7
b706a94030
Make the Python test-env bootstrap safe to auto-run so contributors and
agents no longer have to approve a fresh-worktree install every session.
* `constraints-test.txt` — pinned resolve of `.[test]` extras + their full
transitive closure (39 entries); committed lockfile becomes the
dependency-change review surface.
* `scripts/bootstrap_test_env.{sh,ps1}` — install via the lock when
present, then gate with `pip-audit` (a known CVE fails the bootstrap).
New flags: `--force`/`-Force`, `--relock`/`-Relock`,
`--no-audit`/`-NoAudit`. `--relock` without `--force` now warns
instead of silently no-op'ing.
* `tests/scripts/test_bootstrap_constraints.py` — guards the lock stays
in sync with the `[test]` extras declared in pyproject.toml.
* `CLAUDE.md` — documents that the bootstrap is pre-authorized to run
automatically and supersedes the global `/warmup` MISSING_VENV
hard-stop; dependency *changes* still land as a reviewed diff.
* `.gitattributes` — normalize `constraints-test.txt` to LF so the
PowerShell `--relock` path doesn't flip the file to CRLF.
CI still installs its own minimal `pytest`+`aiohttp` subset directly
(not yet on the lock/audit path) — noted in the CHANGELOG; CI hardening
left as a fast-follow.
Verified: `--force` rebuild from the lock → pip-audit clean → 235 tests
pass (231 + 4 new guards). bash `-n` syntax check OK; arg-error path
exits 2; `--relock` without `--force` warns + exits 0.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
88 lines
2.8 KiB
Bash
Executable File
88 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Bootstrap a repo-local .venv with the LOCKED, AUDITED test dependency set.
|
|
#
|
|
# * Reproducible -- installs against constraints-test.txt when present (a
|
|
# pinned resolve of `.[test]` + its full transitive closure). Pass
|
|
# --relock (with --force) to re-resolve and rewrite that lock; commit
|
|
# the diff as the dependency-change review surface.
|
|
# * Verified -- runs pip-audit after install; a known CVE fails the
|
|
# bootstrap (exit 1). Pass --no-audit to skip (e.g. offline).
|
|
# * Idempotent -- no-op if .venv already exists. Pass --force to recreate.
|
|
#
|
|
# Usage: bash scripts/bootstrap_test_env.sh [--force] [--relock] [--no-audit]
|
|
|
|
set -euo pipefail
|
|
|
|
FORCE=""
|
|
RELOCK=""
|
|
AUDIT="1"
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--force) FORCE="1" ;;
|
|
--relock) RELOCK="1" ;;
|
|
--no-audit) AUDIT="" ;;
|
|
*) echo "Unknown argument: $arg" >&2
|
|
echo "Usage: bash scripts/bootstrap_test_env.sh [--force] [--relock] [--no-audit]" >&2
|
|
exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
CONSTRAINTS="constraints-test.txt"
|
|
|
|
PYTHON_BIN="${PYTHON:-}"
|
|
if [ -z "$PYTHON_BIN" ]; then
|
|
if command -v python3 >/dev/null 2>&1; then
|
|
PYTHON_BIN="python3"
|
|
elif command -v python >/dev/null 2>&1; then
|
|
PYTHON_BIN="python"
|
|
else
|
|
echo "Could not find python3 or python on PATH." >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
if [ -d .venv ]; then
|
|
if [ -z "$FORCE" ]; then
|
|
if [ -n "$RELOCK" ]; then
|
|
echo "--relock requires --force (the lock is rewritten from a fresh resolve); nothing was changed." >&2
|
|
fi
|
|
echo ".venv already exists. Pass --force to recreate."
|
|
exit 0
|
|
fi
|
|
echo "Removing existing .venv ..."
|
|
rm -rf .venv
|
|
fi
|
|
|
|
echo "Creating .venv ..."
|
|
"$PYTHON_BIN" -m venv .venv
|
|
|
|
echo "Upgrading pip ..."
|
|
.venv/bin/python -m pip install --quiet --upgrade pip
|
|
|
|
if [ -f "$CONSTRAINTS" ] && [ -z "$RELOCK" ]; then
|
|
echo "Installing project + test extras (locked via $CONSTRAINTS) ..."
|
|
.venv/bin/python -m pip install --quiet -e '.[test]' -c "$CONSTRAINTS"
|
|
else
|
|
echo "Resolving + installing project + test extras ..."
|
|
.venv/bin/python -m pip install --quiet -e '.[test]'
|
|
echo "Writing locked set to $CONSTRAINTS ..."
|
|
.venv/bin/python -m pip freeze --exclude-editable > "$CONSTRAINTS"
|
|
fi
|
|
|
|
if [ -n "$AUDIT" ]; then
|
|
echo "Auditing installed set (pip-audit) ..."
|
|
if .venv/bin/pip-audit --skip-editable; then
|
|
echo "pip-audit: no known vulnerabilities."
|
|
else
|
|
echo "" >&2
|
|
echo "BLOCKER: pip-audit did not pass -- a known vulnerability was found," >&2
|
|
echo "or the audit could not complete. Review the output above." >&2
|
|
echo "To bootstrap anyway (e.g. offline), re-run with --no-audit." >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
echo ""
|
|
echo "Test env ready. Run tests with:"
|
|
echo " .venv/bin/python -m pytest"
|