Skip to content

build: add check-dependency-minmax agent skill - #5580

Open
lgritz wants to merge 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-deprange
Open

build: add check-dependency-minmax agent skill#5580
lgritz wants to merge 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-deprange

Conversation

@lgritz

@lgritz lgritz commented Oct 18, 2026

Copy link
Copy Markdown
Collaborator

This is my attempt to build an agent skill that cross-references

  • The versions of all dependencies we actually use in CI (by checking the workflow logs), across all tests
  • The range we claim to support and test as documented in INSTALL.md
  • The minimum versions we accept, enforced in externalpackages.cmake
  • The actual latest versions available (as near as we can determine, looking at those projects' release tags in their own repos)

and reconciles any differences, for example: bump the "latest" CI jobs to new versions of deps that have come out, ensure INSTALL reflects the actual range that we support and test, etc. It writes a report summarizing all the findings, and makes suggestions for what to adjust in the project.

I've been testing this for a while and it works great and saves me a lot of tedious checking of different dependency projects, and ensures that the various files listed above aren't drifting away from each other. This is something I need to do as the project maintainer frequently, at least monthly so that the patch releases are tested on the real latest.

I want to check it into the repo both so that it can be versioned and always lives with the project, but also so that people other than me can also perform these checks.

Assisted-by: Claude Code / Sonnet 5

@lgritz
build: add check-dependency-minmax agent skill
afc6ed5 
This is my attempt to build an agent skill that cross-references

- The versions of all dependencies we actually use in CI (by checking
  the workflow logs), across all tests
- The range we claim to support and test as documented in INSTALL.md
- The minimum versions we accept, enforced in externalpackages.cmake
- The actual latest versions available (as near as we can determine,
  looking at those projects' release tags in their own repos)

and reconciles any differences, for example: bump the "latest" CI jobs
to new versions of deps that have come out, ensure INSTALL reflects
the actual range that we support and test, etc. It writes a report
summarizing all the findings, and makes suggestions for what to adjust
in the project.

I've been testing this for a while and it works great and saves me a
lot of tedious checking of different dependency projects, and ensures
that the various files listed above aren't drifting away from each
other. This is something I need to do as the project maintainer
frequently, at least monthly so that the patch releases are tested
on the real latest.

I want to check it into the repo both so that it can be versioned and
always lives with the project, but also so that people other than me
can also perform these checks.

Assisted-by: Claude Code / Sonnet 5

Signed-off-by: Larry Gritz <lg@larrygritz.com>
@lgritz

lgritz commented Oct 18, 2026

Copy link
Copy Markdown
Collaborator Author

Here's an example of the report it generates:

Dependency audit, 2026-10-17

Run

  • Repo: lgritz/OpenImageIO (fork; the default repo has no successful ci.yml run on lg-deprange)
  • Run: https://github.com/lgritz/OpenImageIO/actions/runs/37174642570
  • Run SHA: 7bb7e6b (2026-10-04). Local HEAD is 2c5a03d, so the SHA differs.
    ci.yml differences since the run: path filters, two comment edits, and the
    MacOS-14-ARM aclang15/C++20/py3.13 job was REMOVED from HEAD (it ran in this
    run, so Apple clang 15 / macOS 14 is no longer tested going forward).
  • 29 jobs fetched. Jobs without buildinfo (ABI check x3, clang-format) excluded.

Local build (dist/bin/oiiotool, 2026-10-16 21:09, OIIO 3.3.0.0dev)

Apple clang 21.0 C++17, CMake 4.4.4, Python3 3.14.8, NumPy 2.5.4 (system python3
is 3.15.0; bindings were built with 3.14.8, NumPy for that interpreter unverified).
Deps: DCMTK 3.7.0, FFmpeg 9.0.2, fmt 12.2.0, Freetype 2.15.0, GIF 6.1.3, Imath 3.2.3,
JXL 0.12.0, Libheif 1.23.6, libjpeg-turbo 3.2.0, LibRaw 0.22.2, libuhdr 2.0.2,
nanobind 3.1.0, OCIO 2.6.0, OpenCV 5.0.0, OpenEXR 3.5.2, OpenJPEG 2.5.4, openjph 0.32.0,
OpenVDB 13.1.0, PNG 1.6.59, Ptex 2.4, Qt6 6.12.0, Robinmap 1.4.1, TBB 2023.1.0,
TIFF 4.7.2, WebP 1.6.0, ZLIB 1.2.12, zstd 1.5.7.

A. Table

Bold min/max = not matched by CI; bold Latest = newer than CI tests.

Dependency INSTALL min/max CI versions Latest
gcc 9.3 - 16 9.5, 11.2, 12.3, 14.2, 15.2, 16.0 16
clang 10 - 22 11.1, 16.0, 18.1, 19.1, 21.1 23.1.3
Apple clang (not documented) 15.0, 17.0, 21.0 -
MSVC 2017 - 2026 19.44 (VS2022), 19.51 (VS2026) -
icx 2022+ "17.0" (buildinfo's number, not a release year) -
CMake 3.23.0 - 4.4 3.23.0, 3.27.2, 3.31.6, 3.31.11, 4.0.6, 4.3.3, 4.4.2, 4.4.3 4.4.4
Python 3.9 - 3.14 3.9.25, 3.10.11, 3.10.12, 3.11.15, 3.12.3, 3.12.10, 3.13.14, 3.13.15, 3.14.7 3.14.8 (3.15.0 released)
NumPy - 2.5.3 not reported by buildinfo 2.5.4
Imath 3.1 - 3.2 and main 3.1.1, 3.1.9, 3.1.12, 3.2.0 (main), 3.2.3 3.2.3
OpenEXR 3.1 - 3.5 and main 3.1.0, 3.1.11, 3.2.12, 3.3.14, 3.4.15, 3.5.2, 4.0.0 (main) 3.5.2
libTIFF 4.1 - 4.7 and master 4.1.0, 4.4.0, 4.5.1, 4.7.1, 4.7.2 (master) 4.7.2
OCIO 2.3 - 2.6 and main 2.3.0, 2.3.2, 2.4.2, 2.5.1, 2.5.2, 2.6.0, 2.7.0 (main) 2.6.0
libjpeg 9 - jpeg-10 not tested (buildinfo says only API 80) -
libjpeg-turbo 2.1 - 3.2 and main 3.0.4, 3.1.0, 3.1.2, 3.2.0, 3.2.1 (main) 3.2.0
zlib 1.2.7 - 1.3.2 1.2.11, 1.2.12, 1.3, 1.3.1, 1.3.2 1.3.2
fmt 9.0 - 12.2 and master 9.0.0, 10.1.0, 11.2.0, 12.1.0, 12.2.0, 12.2.1 (main) 12.2.0
robin-map 1.3 - 1.4 1.3.0, 1.4.0, 1.4.1 1.4.1
Qt5 5.6 - 5.15 5.15.9 EOL
Qt6 - 6.11 6.5.6, 6.8.3, 6.11.1, 6.11.2 6.12.0
nanobind 2.8 - 3.1 and master 2.8.0, 2.13.0, 3.0.0, 3.0.1, 3.1.0, 3.2.0 (master) 3.1.0
pybind11 2.7 - 3.1 and master 2.7.0, 2.10.0, 2.12.0, 2.13.6, 3.0.0, 3.0.1, 3.0.4, 3.1.0 3.1.0
libPNG 1.6.0 - 1.6.59 and master 1.6.34, 1.6.37, 1.6.43, 1.6.58, 1.6.59, 1.6.60.git (master) 1.6.59
LibRaw 0.21.0 - 0.22.2 and master 0.21.0, 0.21.2, 0.21.4, 0.22.0, 0.22.2 0.22.2
ffmpeg 4.0 - 9.0 4.4.2, 6.1.1, 9.0.1 9.0.2
OpenJPEG 2.0 - 2.5.4 and master 2.4.0, 2.5.4 2.5.4
OpenVDB 9.0 - 13.1 10.0.1, 11.0.0, 12.1.1, 13.0.0 13.1.0
TBB 2018 - 2021 and OneTBB 2023.1 2020.3, 2021.5.0, 2021.10.0, 2021.11.0, 2021.13.0, 2022.1.0, 2023.1.0 2023.1.0
OpenCV 4.x - 5.0 4.5.4, 4.6.0, 5.0.0 5.0.0
giflib 5.0 - 6.1.3 5.1.4, 5.1.9, 5.2.1, 5.2.2, 6.1.3 6.1.3
libheif 1.11 - 1.23.5 1.19.8, 1.23.1, 1.23.2, 1.23.4 1.23.6
DCMTK 3.6.2 - 3.7.0 3.7.0 3.7.1
WebP 1.1 - 1.6 and main 1.1.0, 1.3.2, 1.5.0, 1.6.0 1.6.0
Ptex 2.3.1 - 2.5 and main 2.4, 2.5 (min pin v2.3.2 reports only "present") 2.5.4
Freetype 2.10.0 - 2.14 and master 2.10.0, 2.11.1, 2.13.2, 2.14.3 2.15.0
libultrahdr 1.3 - 2.0.2 and main 1.3.0, 1.4.0, 2.0.2 2.0.2
libjxl 0.10.1 - 0.12.0 0.11.1, 0.12.0 0.12.0
OpenJPH 0.21.2 - 0.32 0.32.0 0.32.0
pugixml 1.11 - 1.16 and master 1.11, 1.13, 1.14, 1.15, 1.16 1.16

Notes: libheif INSTALL 1.23.5 is above CI's 1.23.4. OpenVDB INSTALL 13.1 is above
CI's 13.0.0. Neither lowered (rule), listed only. Ptex "latest" read from tags; the
buildinfo version string is the header (2.5).

B. Oldest / hobbled vs INSTALL minimum

Not at minimum in oldest gcc9 (clang11 identical except nanobind 2.8.0 and both backend):

  • libjpeg-turbo 3.1.2 (min 2.1): locally built default; no pin.
  • zlib 1.2.11 (min 1.2.7): system.
  • libPNG 1.6.37 (min 1.6.0): system, do not pin (known issue: pinning broke other deps).
  • ffmpeg 4.4.2 (min 4.0), OpenJPEG 2.4.0 (min 2.0; pin is commented out), TBB 2021.5.0
    (min 2018), giflib 5.1.9 (min 5.0), libheif 1.19.8 (min 1.11): Ubuntu 22.04 system.
  • OpenVDB, DCMTK absent (min 9.0, 3.6.2).
  • Freetype 2.11.1 (min 2.10.0): not pinned in oldest (hobbled does pin 2.10.0).
  • libjxl 0.12.0 (min 0.10.1; 0.11.1 lowest seen in CI), OpenJPH 0.32.0 (min 0.21.2):
    always the build script default.
  • Ptex pinned v2.3.2 (min 2.3.1).
  • gcc 9.5 ok (9.3 min). clang 11.1 (min 10).
    hobbled additionally: no LibRaw, libuhdr, OpenCV, DCMTK; libjpeg-turbo absent from
    buildinfo, so -DUSE_libjpeg-turbo=0 now works (system libjpeg used); libheif/ffmpeg/etc as above.
    At minimum everywhere else: CMake 3.23.0, Imath 3.1.1, OpenEXR 3.1.0, OCIO 2.3.0,
    libTIFF 4.1.0, fmt 9.0.0, robin-map 1.3.0, pugixml 1.11, WebP 1.1.0, LibRaw 0.21.0,
    libuhdr 1.3.0, pybind11 2.7.0, nanobind 2.8.0 (clang job), Python 3.9.

C. latest releases gcc15 vs newest tags

At latest: fmt, Imath, OpenEXR, OCIO, libTIFF, libjpeg-turbo, robin-map, pugixml,
nanobind, pybind11, libPNG, LibRaw, OpenJPEG, libjxl, WebP, Ptex, libuhdr, OpenJPH (all pinned by us).
Not at latest:

  • Freetype 2.14.3 pinned (FREETYPE_VERSION=VER-2-14-3); latest 2.15.0. Pin stale.
  • zlib 1.3 (system; latest 1.3.2), libheif 1.19.8 (system; 1.23.6), ffmpeg 6.1.1 (9.0.2),
    giflib 5.2.2 (6.1.3), TBB 2021.11.0 (2023.1.0), OpenCV 4.6.0 (5.0.0), Python 3.12.3,
    CMake 3.31.6 (4.4.4): all apt/runner packages.
  • DCMTK absent (optional; latest 3.7.1), OpenVDB disabled (USE_OPENVDB=0; latest 13.1.0).
  • Qt absent. gcc 15.2 (16 exists; bleeding edge uses it).

D. bleeding edge

Confirmed cloned and checked out at main/master: fmt (12.2.1), OCIO 2.7.0, OpenEXR 4.0.0,
Imath 3.2.0 (follows OpenEXR main; resolves the old open question), pybind11, nanobind 3.2.0,
libjpeg-turbo 3.2.1, libPNG 1.6.60.git, LibRaw, libTIFF, OpenJPEG, Ptex, pugixml, WebP,
Freetype, libuhdr.
Tags/defaults, not main: libjxl 0.12.0, robin-map 1.4.1, OpenJPH 0.32.0.
System packages: ffmpeg 6.1.1, giflib 5.2.2, TBB 2021.11.0, zlib 1.3, libheif 1.19.8, Python 3.12.3, CMake 3.31.6.
Disabled/absent: OpenCV, OpenVDB, Qt, DCMTK, CUDA.

E. Descriptions

All 25 buildinfo jobs match desc (compiler, py, exr, ocio). Stale comments found
(fixed, see below): hobbled claim that jpeg-turbo is not disabled; oldest-clang claim
that libuhdr is not pinned (it is pinned to 1.3.0). Not a desc issue: MacOS-14-ARM
exists in the run but not in HEAD ci.yml.

F. "and main/master" claims

Every claim in INSTALL (Imath, OpenEXR, libTIFF, OCIO, libjpeg-turbo, fmt, nanobind,
pybind11, libPNG, LibRaw, OpenJPEG, WebP, Ptex, Freetype, libuhdr, pugixml) is backed by
the bleeding-edge job. Imath is main only indirectly via OpenEXR main.
Not claimed and not tested from main: libjxl, robin-map, OpenJPH, DCMTK.

G. Minimums with no exercising job / below documented minimum

  • Never exercised: libjpeg 9, libjpeg-turbo 2.1, zlib 1.2.7 to 1.2.10, libPNG 1.6.0 to 1.6.33,
    OpenJPEG < 2.4, OpenVDB 9, TBB 2018 to 2019, giflib 5.0, ffmpeg 4.0 to 4.3, libheif < 1.19,
    libjxl < 0.11.1, DCMTK < 3.7 (3.7.0 only), Qt5 < 5.15, clang 10, MSVS 2017/2019, icx 2022.
  • Below documented minimum: none. The "libTIFF 4.0.9" in ASWF container jobs is a
    reporting bug (see below): the system 4.0.9 is rejected, 4.7.1 is built locally and
    used, but buildinfo and the cmake summary keep the stale 4.0.9 string.

H. Pin sanity

Every pin variable used in ci.yml is read by the build scripts and shows up in buildinfo.
One note: latest releases Freetype pin is outdated, not misnamed. Commented-out OpenJPEG
pins in both oldest jobs do nothing (known).

I. Local build newer than CI (candidate INSTALL maxima, need confirmation)

  • Freetype 2.15.0 (INSTALL 2.14, CI 2.14.3)
  • Qt6 6.12.0 (INSTALL 6.11, CI 6.11.2)
  • libheif 1.23.6 (INSTALL says 1.23.5, CI 1.23.4)
  • NumPy 2.5.4 (INSTALL 2.5.3; interpreter match unverified)
    Same minor as CI (no change needed): FFmpeg 9.0.2, Python 3.14.8, CMake 4.4.4, Apple clang 21.
    Nothing local is older than an INSTALL minimum.

Reporting bug found: stale version after local rebuild

In checked_find_package, a system package rejected by find_package's own version
check (so <Pkg>_FOUND is false and reject_out_of_range_versions never runs) leaves
<Pkg>_VERSION set. After the local build and refind, the fallback only fills
<Pkg>_VERSION when empty, so the stale value is reported ("Found TIFF 4.0.9",
buildinfo TIFF 4.0.9). Seen in 9 ASWF container jobs. Fixed in
src/cmake/dependency_utils.cmake (refind cleanup now also unsets the _VERSION and
_VERSION_STRING variables). Not yet verified in CI; the next audit should show
TIFF 4.7.1 in those jobs. Other deps rejected then rebuilt locally may have had the
same wrong version reported.

Not verified

NumPy (buildinfo omits it), libjpeg/libjpeg-turbo version for system JPEG 80, Ptex when
reported as "present", exact icx release, whether jobs without buildinfo (ABI checks) matter.

Changes made

  • ci.yml: oldest clang11 comment no longer says libuhdr is unpinned.
  • ci.yml: hobbled comment restored: libjpeg-turbo is disabled (system libjpeg).
  • INSTALL.md: Freetype 2.15, Qt6 6.12, libheif 1.23.6, NumPy 2.5.4 (local-build maxima, confirmed).
  • ci.yml: Freetype pin VER-2-14-3 -> VER-2-15-0 in the three latest-releases jobs.
  • dependency_utils.cmake: stale-version fix above (untested).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lgritz