boost-skill-cli 1.0.273__tar.gz → 1.0.275__tar.gz

{boost_skill_cli-1.0.273/boost_skill_cli.egg-info → boost_skill_cli-1.0.275}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.273
+Version: 1.0.275
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.273 → boost_skill_cli-1.0.275}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.273'
-__version_tuple__ = version_tuple = (1, 0, 273)
+__version__ = version = '1.0.275'
+__version_tuple__ = version_tuple = (1, 0, 275)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.273 → boost_skill_cli-1.0.275/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.273
+Version: 1.0.275
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.273 → boost_skill_cli-1.0.275}/boost_skill_cli.egg-info/SOURCES.txt

@@ -184,6 +184,7 @@ docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md
 docs/roadmap/items/demo-gif-workflow-has-never-succeeded.md
 docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md
 docs/roadmap/items/dependabot-missing-pip-ecosystem.md
+docs/roadmap/items/dependabot-regeneration-drops-platform-pins.md
 docs/roadmap/items/dependabot-root-pip-entry-duplicates-requirements.md
 docs/roadmap/items/dependency-cve-gate-pip-audit.md
 docs/roadmap/items/docsite-chrome-and-content-audit.md

boost_skill_cli-1.0.275/docs/roadmap/items/dependabot-regeneration-drops-platform-pins.md

@@ -0,0 +1,46 @@
+---
+id: dependabot-regeneration-drops-platform-pins
+board: code
+section: internals
+status: planned
+category: Build · Bug
+complexity: M
+impact: High
+wow: 3
+note: every pip bump PR is unmergeable — 2 of 2 observed, both red on the install step
+order: 36
+owner:
+pr:
+title: Dependabot cannot regenerate the hash-pinned locks
+---
+<b>Every Dependabot PR that touches <code>requirements/*.txt</code> is unmergeable</b>, and the
+failure is not in the bumped package. Dependabot re-resolves the lock on Linux and writes that
+resolution back, which silently <b>drops entries whose environment marker excludes them on the
+resolving platform</b> — but the lock is installed with <code>--require-hashes</code> on Windows and
+macOS too, so the dropped pins become install failures on the platforms that need them.
+
+Two of two observed in one scheduled run. The hypothesis bump (<code>#300</code>/<code>#303</code>)
+deleted <code>colorama==0.4.6 ; sys_platform == 'win32'</code> — pytest's Windows terminal
+dependency — from <b>all three</b> of <code>test-tools</code>, <code>coverage-tools</code> and
+<code>mutation-tools</code>, so <code>tests (windows-latest, 3.12)</code> and
+<code>(windows-latest, 3.14)</code> both died in the <code>install test deps</code> step with the
+suite never running. The twine bump (<code>#301</code>/<code>#302</code>) deleted
+<code>colorama</code> and <code>pywin32-ctypes</code> (keyring's Windows backend, and keyring is
+twine's own dependency) plus <code>pip</code> and <code>setuptools</code> from
+<code>release-tools.txt</code>, failing the <code>metadata</code> job in <code>Install build +
+validation tools</code>. The GitHub-Actions bumps in the same run were all fine: they are pure SHA
+pins in workflow YAML and involve no resolution.
+
+<code>scripts/lock_toolchain.py</code> is the source of truth precisely because it resolves for
+every supported platform and keeps the conditional pins. Dependabot has no equivalent. The same run
+also rewrote the provenance comments from <code>-r requirements/test-tools.in</code> to
+<code>-r test-tools.in</code>, i.e. it compiled from a different working directory — the
+machine-independence that <code>test_header_is_machine_independent</code> already guards.
+
+The cheapest honest fix is to stop asking Dependabot to do this: drop the version-update side of the
+pip entries (or set <code>open-pull-requests-limit: 0</code>, which leaves <b>security</b> updates
+firing, since those are what the entries are actually worth) and regenerate the locks on a schedule
+with <code>lock_toolchain.py</code> instead. Whatever is chosen, it needs a guard: a lock that
+<i>loses</i> a platform-markered pin should fail its own gate rather than fail three Windows jobs
+two steps later, because the current failure names the install step and never mentions the missing
+package. Related: [[dependabot-root-pip-entry-duplicates-requirements]].

{boost_skill_cli-1.0.273 → boost_skill_cli-1.0.275}/docs/roadmap.html

@@ -110,7 +110,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>166</b><span>Loop finds</span></div>
+      <div class="stat"><b>167</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -1191,6 +1191,48 @@ lock file silently clobbers it and still reports "created," even though it overw
         </div>
       </article>
 
+      <article class="cap rcard" id="dependabot-regeneration-drops-platform-pins">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Build · Bug</span></div>
+        <h3>Dependabot cannot regenerate the hash-pinned locks</h3>
+        <p><b>Every Dependabot PR that touches <code>requirements/*.txt</code> is unmergeable</b>, and the
+failure is not in the bumped package. Dependabot re-resolves the lock on Linux and writes that
+resolution back, which silently <b>drops entries whose environment marker excludes them on the
+resolving platform</b> — but the lock is installed with <code>--require-hashes</code> on Windows and
+macOS too, so the dropped pins become install failures on the platforms that need them.
+
+Two of two observed in one scheduled run. The hypothesis bump (<code>#300</code>/<code>#303</code>)
+deleted <code>colorama==0.4.6 ; sys_platform == 'win32'</code> — pytest's Windows terminal
+dependency — from <b>all three</b> of <code>test-tools</code>, <code>coverage-tools</code> and
+<code>mutation-tools</code>, so <code>tests (windows-latest, 3.12)</code> and
+<code>(windows-latest, 3.14)</code> both died in the <code>install test deps</code> step with the
+suite never running. The twine bump (<code>#301</code>/<code>#302</code>) deleted
+<code>colorama</code> and <code>pywin32-ctypes</code> (keyring's Windows backend, and keyring is
+twine's own dependency) plus <code>pip</code> and <code>setuptools</code> from
+<code>release-tools.txt</code>, failing the <code>metadata</code> job in <code>Install build +
+validation tools</code>. The GitHub-Actions bumps in the same run were all fine: they are pure SHA
+pins in workflow YAML and involve no resolution.
+
+<code>scripts/lock_toolchain.py</code> is the source of truth precisely because it resolves for
+every supported platform and keeps the conditional pins. Dependabot has no equivalent. The same run
+also rewrote the provenance comments from <code>-r requirements/test-tools.in</code> to
+<code>-r test-tools.in</code>, i.e. it compiled from a different working directory — the
+machine-independence that <code>test_header_is_machine_independent</code> already guards.
+
+The cheapest honest fix is to stop asking Dependabot to do this: drop the version-update side of the
+pip entries (or set <code>open-pull-requests-limit: 0</code>, which leaves <b>security</b> updates
+firing, since those are what the entries are actually worth) and regenerate the locks on a schedule
+with <code>lock_toolchain.py</code> instead. Whatever is chosen, it needs a guard: a lock that
+<i>loses</i> a platform-markered pin should fail its own gate rather than fail three Windows jobs
+two steps later, because the current failure names the install step and never mentions the missing
+package. Related: [[dependabot-root-pip-entry-duplicates-requirements]].</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">every pip bump PR is unmergeable — 2 of 2 observed, both red on the install step</span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="negative-limit-inverts-log-pulse-output">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">CLI ergonomics</span></div>
         <h3>Negative <code>-n</code> silently inverts <code>log</code>/<code>pulse</code> output</h3>