Repository navigation
feat(xtask): add cargo xtask bump-pins and a weekly bump workflow - #1829
Open
nathan-weinberg wants to merge 3 commits into
Open
nathan-weinberg wants to merge 3 commits into
nathan-weinberg wants to merge 3 commits into
Conversation
First of three changes automating pinned-client bumps. This one cuts the number of sites a bump must touch and closes the existing drift, with no new tooling yet. - Claude Code: move the CPU lane from 2.1.267 to the manifest's 2.1.278, which the GPU lane already runs, and make the CPU job assert the installed version. Drop the duplicate constant in claude_code_vllm.rs in favor of CLAUDE_CODE_PINNED_VERSION, add a major_series tripwire, and add offline tests tying the manifest, constant, URL, and CI env. - Codex: add codex-cli/pin.toml and CODEX_PINNED_VERSION. Each Codex CI job now derives every path, URL, and version check from one job-level CODEX_VERSION, and the cache key hashes the checksum fixture instead of embedding it. The WebSocket replay fixture is tied to the pinned version, so a bump must recapture it. codex_pin.rs enforces it all. - OpenCode 1.x: add the checksum fixture test 2.x and pi already have. - vllm/Containerfile: pin the base image by tag@digest, matching every other vLLM reference. - Reword compaction-reserve comments that claimed 2.1.267 was pinned to say where the value was measured. Signed-off-by: Nathan Weinberg <nweinber@redhat.com>
…y#1798) Second of three changes automating pinned-client bumps. The GPU workflow's `pins` job validated the manifests in ~270 lines of inline Python that only ran on schedule, dispatch, or the vllm-full-suite label. Port it to a Rust xtask so it runs locally, in `make lint` on every PR, and later inside bump-pins. - New light `pins` xtask feature (`dev` includes it) depends only on `toml`, so the `pins` job builds check-pins without compiling the proxy. - Every Python invariant is ported: Claude context and compaction arithmetic, OpenCode major/lane tripwires, provider/backend window agreement, the 2.x and pi shared-backend rules, models.json agreement, and explicit example-config routes. - New: a site table records every file location that embeds a client version or the vLLM image (manifests, harness constants, workflow env, dev-endpoint image, Containerfile) with an exact expected count. Checksum fixtures must exist, name the downloaded artifact, and have no stale sibling. Both [vllm] blocks must pin one tag@sha256 image. - `--github-output` exports the same keys the job emitted; a unit test holds them to the job's `outputs:` map, and the values were diffed identical against the Python script. - Unit tests mutate one real file in memory per invariant. Signed-off-by: Nathan Weinberg <nweinber@redhat.com>
…axis-proxy#1798) Third of three changes automating pinned-client bumps. Closes praxis-proxy#1798. `cargo xtask bump-pins [--pin <pin>]... [--dry-run] [--report PATH]` automates the mechanical half of a bump: - Discovers the newest release per pin within each manifest's major_series: npm dist-tags for Claude Code and OpenCode 1.x/2.x (falling back to the newest in-series version when `latest` crosses the boundary), GitHub releases for pi, Codex, and vLLM, and the Docker Hub manifest-list digest for the vLLM image tag. - Fetches checksums from the release's own metadata where upstream publishes one (Claude Code manifest.json, GitHub asset digests) and streams the OpenCode npm tarballs through sha256 otherwise, without buffering them. - Stages every rewrite in memory through the same site table check-pins uses, with exact-count anchored replacement that fails on drift, swaps the checksum fixtures, and runs check-pins on the staged tree before writing anything. - Never touches behavioral pins. The markdown report is a per-client re-validation checklist plus every remaining line that still names the old version. The Bump Pins workflow runs it weekly (and on dispatch) and opens or updates a draft PR from `bot/bump-pins` with the praxis-bot-app token, using the report as the body. It never auto-merges, and it never force-pushes over a bump PR that a person has committed to. Signed-off-by: Nathan Weinberg <nweinber@redhat.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Third of three stacked PRs. Stacked on #1828 (which stacks on #1827). Review only the last commit,
feat(xtask): add cargo xtask bump-pins and a weekly bump workflow.cargo xtask bump-pins [--pin <pin>]... [--dry-run] [--report PATH]automates the mechanical half of a bump. The behavioral half stays human.major_series:latestcrosses the major boundary.manifest.json, GitHub asset digests). npm only publishes sha512 integrity, so the OpenCode tarballs are streamed through sha256 without buffering.check-pinsuses, with exact-count anchors that fail on drift. Checksum fixtures are swapped, andcheck-pinsruns on the staged tree before anything is written.The
Bump Pinsworkflow runs it weekly (Mondays 05:23 UTC) and on dispatch. It opens or updates a draft PR frombot/bump-pinswith thepraxis-bot-apptoken, using the report as the body. It never auto-merges, and it never force-pushes over a bump PR that a person has committed to.The client guide gains a "Pinned client versions" section, and the bump-instruction comments in
integration.yamlnow point atbump-pins.Needs a maintainer before the workflow can work
praxis-bot-appneeds Contents, Pull requests and Workflows write access on this repo. Workflows is required because bumps edit files under.github/workflows/, and GitHub rejects such pushes without it.Signed-off-by.close-stale-draftscloses it, and the next weekly run opens a fresh one.Open question
Claude Code follows npm
latest(2.1.310 today), which is where the current pin came from. npmstable(2.1.308) lagslatestand would have skipped the 2.1.265–2.1.267 regressions. Switching is a one-line change.Related issue
Closes #1798
Validation
cargo test -p xtask --features openai-all,store-all pins::: 32 tests, covering site rewrites and canned npm, GitHub, Claude-manifest and Docker Hub JSON. No network access.cargo clippy -p xtask --all-targets -- -D warnings(both feature sets),make fmt,make lint-license-headers,cargo xtask lint-markdown-links,cargo xtask check-pins.Ran a live
cargo xtask bump-pins --dry-run. It found Claude Code 2.1.310, OpenCode 1.19.4 and 2.1.4, and Codex 0.164.0; pi and vLLM were current.Ran a real
bump-pinson a scratch tree, then reverted it:curl | sha256sumdownloads.codex_pin::websocket_recording_matches_the_pinned_version.Not run locally:
actionlint. The workflow YAML parses.Unit tests
Integration or functional tests
make lintChecklist
Signed-off-bytrailer.Breaking changes
None.
🤖 Generated with Claude Code