Skip to content

Standardize lock generation on Python 3.12 - #80

Merged
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
SeanMooney:recovery/pr62-python312-locks-main
Aug 14, 2026
Merged

Standardize lock generation on Python 3.12#80
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
SeanMooney:recovery/pr62-python312-locks-main

Conversation

@SeanMooney

@SeanMooney SeanMooney commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Dependency lock generation currently depends on the Python minor version and resolver tooling installed on the host. Environment markers can therefore select different packages, while generated headers, annotations, and index directives add machine-specific noise.

This change:

  • requires Python 3.12 for source and lock generation
  • pins pip, pip-tools, and pybuild-deps
  • isolates generator caches within the tox environment
  • removes resolver annotations, generated headers, and package-index directives from lockfiles
  • regenerates the tracked Base, Cinder, Cyborg, Glance, Manila, Tempest, and Watcher lockfiles
  • adds CI that regenerates locks from committed source pins and requires a clean containers/ tree
  • documents the canonical lockfile regeneration command

Validation

  • commit-time pre-commit checks
  • git diff --check
  • source reproducibility CI

@SeanMooney
SeanMooney force-pushed the recovery/pr62-python312-locks-main branch from dc4edb9 to 438f40d Compare August 14, 2026 14:28
This was referenced Aug 14, 2026
Open
Closed
@SeanMooney
SeanMooney force-pushed the recovery/pr62-python312-locks-main branch 2 times, most recently from b89a715 to 5da406d Compare August 14, 2026 15:39
@SeanMooney SeanMooney mentioned this pull request Aug 14, 2026
Closed
@SeanMooney
Standardize lock generation on Python 3.12
fca5b8f 
Dependency markers are evaluated by the Python interpreter running the
resolver. Allowing different Python minor versions and unpinned generator
tools therefore produces host-dependent lock files and noisy generator
metadata.

Require Python 3.12 for source and lock generation, pin the resolver tools,
and isolate their cache. Normalize annotations, headers, and package-index
directives from generated locks, then regenerate the tracked lock files.
Add CI that regenerates locks from committed source pins and requires the
container tree to remain unchanged, and document the canonical workflow.

Assisted-By: Pi gpt-5.6-sol
Signed-off-by: Sean Mooney <work@seanmooney.info>
@SeanMooney
SeanMooney force-pushed the recovery/pr62-python312-locks-main branch from 5da406d to fca5b8f Compare August 14, 2026 16:07
@openshift-ci openshift-ci Bot added the lgtm label Aug 14, 2026
@amoralej

amoralej commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

/approve

@openshift-ci

openshift-ci Bot commented Aug 14, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amoralej

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit 7676c86 into openstack-k8s-operators:main Aug 14, 2026
6 checks passed
@karelyatin karelyatin mentioned this pull request Aug 17, 2026
Merged
@rebtoor rebtoor mentioned this pull request Aug 17, 2026
Merged
4 tasks
rebtoor added a commit to rebtoor/s2i-openstack-containers that referenced this pull request Aug 17, 2026
@rebtoor @SeanMooney @cursoragent
Add a Zuul image content provider
dcf1db1 
Rebase and rework the content provider from PR openstack-k8s-operators#66 onto the current
main branch. The provider builds and publishes OpenStack service
container images to a Zuul buildset registry so that dependent jobs
can consume exact image references.

Changes from the original PR openstack-k8s-operators#66:
- Drop the "Make source updates atomic" commit (keep existing
  test_update_sources.sh per amoralej's feedback).
- Drop the "Standardize lock generation on Python 3.12" commit
  (already merged as part of PR openstack-k8s-operators#80).
- Remove auto-base insertion from resolve_targets() as requested
  by amoralej; the caller is now responsible for including base.
- Drop openssl-libs from watcher (transitive, already in UBI).
- Remove hardcoded watcher entrypoint validation from the shared
  run playbook (SeanMooney ack'd).

Review feedback addressed:
- Compute buildset registry container name as a fact once instead
  of repeating the expression 4 times (rebtoor).
- Add SELinux workaround comment explaining the container
  remove/recreate sequence (rebtoor).
- Record socat tunnel PID in the ownership marker and kill by PID
  in post-run instead of using fragile pgrep patterns (rebtoor).
- Document the "null" string sentinel in content-provider-return
  explaining why it cannot be actual null (rebtoor).
- Increase test_provider_shell.py parallel output deadline from
  5s to 30s to avoid CI flakiness (rebtoor).

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Assisted-By: Claude (Anthropic)
Co-authored-by: Cursor <cursoragent@cursor.com>
rebtoor added a commit to rebtoor/s2i-openstack-containers that referenced this pull request Aug 18, 2026
@rebtoor @SeanMooney @cursoragent
Add a Zuul image content provider
d744294 
Rebase and rework the content provider from PR openstack-k8s-operators#66 onto the current
main branch. The provider builds and publishes OpenStack service
container images to a Zuul buildset registry so that dependent jobs
can consume exact image references.

Changes from the original PR openstack-k8s-operators#66:
- Drop the "Make source updates atomic" commit (keep existing
  test_update_sources.sh per amoralej's feedback).
- Drop the "Standardize lock generation on Python 3.12" commit
  (already merged as part of PR openstack-k8s-operators#80).
- Remove auto-base insertion from resolve_targets() as requested
  by amoralej; the caller is now responsible for including base.
- Drop openssl-libs from watcher (transitive, already in UBI).
- Remove hardcoded watcher entrypoint validation from the shared
  run playbook (SeanMooney ack'd).

Review feedback addressed:
- Compute buildset registry container name as a fact once instead
  of repeating the expression 4 times (rebtoor).
- Add SELinux workaround comment explaining the container
  remove/recreate sequence (rebtoor).
- Record socat tunnel PID in the ownership marker and kill by PID
  in post-run instead of using fragile pgrep patterns (rebtoor).
- Document the "null" string sentinel in content-provider-return
  explaining why it cannot be actual null (rebtoor).
- Increase test_provider_shell.py parallel output deadline from
  5s to 30s to avoid CI flakiness (rebtoor).

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Assisted-By: Claude (Anthropic)
Co-authored-by: Cursor <cursoragent@cursor.com>
rebtoor added a commit to rebtoor/s2i-openstack-containers that referenced this pull request Aug 18, 2026
@rebtoor @SeanMooney @cursoragent
Add Zuul image content provider with speculative build support
14823b1 
Rebase and rework the content provider from PR openstack-k8s-operators#66 onto the current
main branch. The provider builds and publishes OpenStack service
container images to a Zuul buildset registry so that dependent jobs
can consume exact image references.

Additionally, incorporates the speculative build support from PR openstack-k8s-operators#49
(reimplemented without OIB) to enable automatic detection of affected
images and source staging for Zuul-driven speculative builds:

- `build.sh auto-detect <project> [stream]` scans sources.txt files
  to find which images reference a given upstream project.
- `build.sh list-sources <image> [stream]` lists source dependencies
  in a structured format for Ansible consumption.
- `shared/resolve-auto-images.yaml` resolves `s2i_ci_images: auto`
  using the Zuul change queue.
- `shared/stage-zuul-sources.yaml` copies Zuul checkouts into
  container build contexts for speculative builds.
- `shared/run.yaml` is updated with hooks for auto-detection and
  source staging, invoked before input validation and build steps.

Changes from the original PR openstack-k8s-operators#66:
- Drop the "Make source updates atomic" commit (keep existing
  test_update_sources.sh per amoralej's feedback).
- Drop the "Standardize lock generation on Python 3.12" commit
  (already merged as part of PR openstack-k8s-operators#80).
- Remove auto-base insertion from resolve_targets() as requested
  by amoralej; the caller is now responsible for including base.
- Drop openssl-libs from watcher (transitive, already in UBI).
- Remove hardcoded watcher entrypoint validation from the shared
  run playbook (SeanMooney ack'd).

Review feedback addressed:
- Compute buildset registry container name as a fact once instead
  of repeating the expression 4 times (rebtoor).
- Add SELinux workaround comment explaining the container
  remove/recreate sequence (rebtoor).
- Record socat tunnel PID in the ownership marker and kill by PID
  in post-run instead of using fragile pgrep patterns (rebtoor).
- Document the "null" string sentinel in content-provider-return
  explaining why it cannot be actual null (rebtoor).
- Increase test_provider_shell.py parallel output deadline from
  5s to 30s to avoid CI flakiness (rebtoor).

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Assisted-By: Claude (Anthropic)
Co-authored-by: Cursor <cursoragent@cursor.com>
rebtoor added a commit to rebtoor/s2i-openstack-containers that referenced this pull request Aug 18, 2026
@rebtoor @SeanMooney @cursoragent
Add a Zuul image content provider
7d8d9ab 
Rebase and rework the content provider from PR openstack-k8s-operators#66 onto the current
main branch. The provider builds and publishes OpenStack service
container images to a Zuul buildset registry so that dependent jobs
can consume exact image references.

Changes from the original PR openstack-k8s-operators#66:
- Drop the "Make source updates atomic" commit (keep existing
  test_update_sources.sh per amoralej's feedback).
- Drop the "Standardize lock generation on Python 3.12" commit
  (already merged as part of PR openstack-k8s-operators#80).
- Remove auto-base insertion from resolve_targets() as requested
  by amoralej; the caller is now responsible for including base.
- Drop openssl-libs from watcher (transitive, already in UBI).
- Remove hardcoded watcher entrypoint validation from the shared
  run playbook (SeanMooney ack'd).

Review feedback addressed:
- Compute buildset registry container name as a fact once instead
  of repeating the expression 4 times (rebtoor).
- Add SELinux workaround comment explaining the container
  remove/recreate sequence (rebtoor).
- Record socat tunnel PID in the ownership marker and kill by PID
  in post-run instead of using fragile pgrep patterns (rebtoor).
- Document the "null" string sentinel in content-provider-return
  explaining why it cannot be actual null (rebtoor).
- Increase test_provider_shell.py parallel output deadline from
  5s to 30s to avoid CI flakiness (rebtoor).

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Assisted-By: Claude (Anthropic)
Co-authored-by: Cursor <cursoragent@cursor.com>
rebtoor added a commit to rebtoor/s2i-openstack-containers that referenced this pull request Aug 18, 2026
@rebtoor @SeanMooney @cursoragent
Add a Zuul image content provider
a454ce7 
Rebase and rework the content provider from PR openstack-k8s-operators#66 onto the current
main branch. The provider builds and publishes OpenStack service
container images to a Zuul buildset registry so that dependent jobs
can consume exact image references.

Changes from the original PR openstack-k8s-operators#66:
- Drop the "Make source updates atomic" commit (keep existing
  test_update_sources.sh per amoralej's feedback).
- Drop the "Standardize lock generation on Python 3.12" commit
  (already merged as part of PR openstack-k8s-operators#80).
- Remove auto-base insertion from resolve_targets() as requested
  by amoralej; the caller is now responsible for including base.
- Drop openssl-libs from watcher (transitive, already in UBI).
- Remove hardcoded watcher entrypoint validation from the shared
  run playbook (SeanMooney ack'd).

Review feedback addressed:
- Compute buildset registry container name as a fact once instead
  of repeating the expression 4 times (rebtoor).
- Add SELinux workaround comment explaining the container
  remove/recreate sequence (rebtoor).
- Record socat tunnel PID in the ownership marker and kill by PID
  in post-run instead of using fragile pgrep patterns (rebtoor).
- Document the "null" string sentinel in content-provider-return
  explaining why it cannot be actual null (rebtoor).
- Increase test_provider_shell.py parallel output deadline from
  5s to 30s to avoid CI flakiness (rebtoor).

Co-Authored-By: Sean Mooney <work@seanmooney.info>
Assisted-By: Claude (Anthropic)
Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@amoralej amoralej amoralej approved these changes

Assignees

@amoralej amoralej

Labels

approved lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@SeanMooney @amoralej