Repository navigation
fix(workflows): hash-lock AgentRx runtime dependencies - #70866
Merged
Merged
Conversation
Sync a complete wheel-only dependency closure with SHA-256 enforcement instead of dynamically installing the AgentRx source project. Preserve the pinned checkout and run.py path, regenerate the compiled workflow, and cover source/compiled parity and lock integrity. Refs #69885, #68043 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
|
🔎 PR Code Quality Reviewer is reviewing code quality for this pull request... |
Contributor
|
✂️ Ponytail Reviewer has started processing this pull request |
Contributor
|
🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills... |
Contributor
|
🔬 Test Quality Sentinel is analyzing test quality on this pull request... |
Contributor
|
🔍 Design Decision Gate 🏗️ is checking for design decision records on this pull request... |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Independent verification of dependency completeness and sandbox runtime compatibility remains incomplete.
1 open issue
What changed in this PR
Hardens AgentRx dependency installation while preserving its pinned source revision and execution paths.
Changes:
- Replace dynamic installation with 52 version-pinned, hash-verified dependencies.
- Regenerate the workflow and add lock integrity and setup-parity checks.
- Document lock refresh commands.
| File | Description |
|---|---|
pkg/workflow/agentrx_workflow_test.go |
Checks dependency pins, hashes, revision alignment, and setup parity. |
.gitignore |
Allows tracking the AgentRx requirements lock. |
.github/workflows/requirements-agentrx.txt |
Adds hashed dependency pins and refresh instructions. |
.github/workflows/daily-agentrx-trace-optimizer.md |
Uses hash-enforced, binary-only dependency synchronization. |
.github/workflows/daily-agentrx-trace-optimizer.lock.yml |
Updates compiled setup and workflow metadata. |
Review effort: Max
| require.Len(t, revision, 2, "AgentRx source must remain pinned to an immutable commit") | ||
| require.Contains(t, string(lock), "# AgentRx "+revision[1]+" runtime dependencies.") | ||
|
|
||
| entry := regexp.MustCompile(`^[a-z0-9][a-z0-9.-]*==[0-9][a-zA-Z0-9.]* \\\n --hash=sha256:[0-9a-f]{64}$`) |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uv pip installof its source checkout withuv pip sync --require-hashes --only-binary=:all:against a checked-in lock covering all 52 dependencies.run.pypaths; direct script execution imports the checkout without invoking its source-build backend.Refs #69885 and #68043. The live code-scanning API showed one remaining generated-install alert, 1035, in this workflow. Historical npm/uv alert counts are not presented as current exposure. This is a focused correction, not a claim that all compiler-managed dependency graphs are fully locked. Image upgrades and the separate #69880 backlog are intentionally excluded; alert closure requires a subsequent scan of the adopted revision.
Validation
make build,make fmt,make recompile(346/346 workflows), focusedTestAgentRxSetupUsesHashedDependencyLock, impacted unit tests, custom Go linters, schema freshness and complete workflow drift check passed.make agent-report-progressencountered another session's golangci-lint process lock. Its other groups passed; rerunning the missing lint check with--allow-serial-runners --new-from-rev=origin/main ./pkg/workflowreported 0 issues. The workflow drift check was then run separately and passed.uv pip check, imported native/API dependencies and ran pinned-sourcerun.py --help; altered hashes and unpinned requirements were both rejected.concurrency.queue/job.workflow_refcompatibility diagnostics as the baseline. Native offline zizmor results are unchanged (14 low-severity findings).