Repository navigation
Conversation
Use the resolved source release when no upstream purl is configured, so local wheel version overrides do not misidentify the source. AI-Assisted-By: Hermes Agent Closes: python-wheel-build#1376 Signed-off-by: Emre K <110906681+kocaemre@users.noreply.github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely describes the primary change: preserving the source version in the upstream SBOM entry. |
| Description check | |
The description directly explains the SBOM version and PURL change, the regression test, the issue addressed, and the verification performed. |
| Linked Issues check | |
Issue #1376 requires the fallback upstream SBOM entry to retain the resolved source version when purl.upstream is unset. _build_upstream_purl now uses version for that fallback and keeps explici… |
| Out of Scope Changes check | |
The reviewed changes are limited to upstream purl construction and a focused SBOM regression test. Both changes directly support issue #1376. No unrelated change is shown in the supplied pull request … |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
There was a problem hiding this comment.
Couple minor comments:
- The doc string in
PurlConfig.upstreaminsrc/fromager/packagesettings/_models.pyis now outdated after this change. - Nit: the repo conventions ask that you use
Co-Authored-Byas commit trailer, notAI-Assisted-By.
Otherwise, lgtm!
|
This looks good to me as well and I agree with @mprpic 's comment above |
This branch has not been deployed
3 participants
Pull Request Description
What
purl.upstreamis unset;purl.versioncontinues to identify the built wheel.Why
Closes #1376. A locally versioned wheel must not make the
GENERATED_FROMsource reference point to a non-existent upstream release.Verification
uvx --from hatch hatch run test:test tests/test_sbom.py::test_generate_sbom_upstream_uses_source_version_without_upstream_override -q --no-cov --tb=short— 1 failed as expected (upstream.versionInfo:0.5.5+local.1instead of0.5.5).uvx --from hatch hatch run test:test tests/test_sbom.py tests/test_packagesettings.py -q --no-cov --tb=short— 108 passed.uvx --from hatch hatch run mypy:check src/fromager/sbom.py— 77 source, 51 test, 7 e2e files checked without errors (repo wrapper checks all three).uvx --from hatch hatch run lint:checkandgit diff --check— passed.AI assistance: Hermes Agent prepared this focused change and its regression; local checks above were run. Commit is DCO signed-off.