odoo-dev 1.2.0__tar.gz → 1.2.2__tar.gz

odoo_dev-1.2.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.2.2"
+}

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [1.2.2](https://github.com/bemade/odoo-dev/compare/v1.2.1...v1.2.2) (2026-08-14)
+
+
+### Bug Fixes
+
+* **vendor:** exclude python bytecode from the vendored tree comparison ([eab5a0a](https://github.com/bemade/odoo-dev/commit/eab5a0a0779821432724e2be31dcb416e5a60c6b)), closes [#11](https://github.com/bemade/odoo-dev/issues/11)
+* **vendor:** fail when .gitignore would strip files out of vendored/ ([6880616](https://github.com/bemade/odoo-dev/commit/6880616fb3f8d503171f7a6e0f5f6bfe98b667a8)), closes [#13](https://github.com/bemade/odoo-dev/issues/13)
+* **vendor:** pin from the recorded gitlink, refuse uninitialized submodules ([001f86f](https://github.com/bemade/odoo-dev/commit/001f86ff1ae4b89b89681aa8e9878cf2bd9f1f1c)), closes [#12](https://github.com/bemade/odoo-dev/issues/12)
+* **vendor:** three failure modes found in vendoring + CI cycles ([051715a](https://github.com/bemade/odoo-dev/commit/051715a10a17163ebe79cd2fe05a7bbe42328511))
+
+## [1.2.1](https://github.com/bemade/odoo-dev/compare/v1.2.0...v1.2.1) (2026-07-14)
+
+
+### Bug Fixes
+
+* **test:** make full-suite runs work under a dev odoo.conf ([2a1b752](https://github.com/bemade/odoo-dev/commit/2a1b7527d29b3bf8bb776e41ce739b4864543b73))
+* **vendor:** bump clears stale version when pinning to a commit ([19544ba](https://github.com/bemade/odoo-dev/commit/19544bac55a3dded4b912cc9f2ac7226f5d72d61))
+* **vendor:** constrain `vendor update` to the pin's own major series ([5b58e26](https://github.com/bemade/odoo-dev/commit/5b58e2676de6c1b63a678d1dd365efca9e4c8b99))
+* **vendor:** migrate sets version only when the tag resolves to the pin ([ea59b1d](https://github.com/bemade/odoo-dev/commit/ea59b1d62c9844fb831925d9973b4ec179b803e6))
+
 ## [1.2.0](https://github.com/bemade/odoo-dev/compare/v1.1.0...v1.2.0) (2026-07-07)
 
 

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: odoo-dev
-Version: 1.2.0
+Version: 1.2.2
 Summary: Odoo Development Environment Helper
 Project-URL: Homepage, https://git.bemade.org/bemade/odoo-dev
 Project-URL: Repository, https://git.bemade.org/bemade/odoo-dev
@@ -175,8 +175,20 @@ something other than the current pin.
 
 `vendor check` verifies, per addon: the vendored files byte-match the pinned
 commit; a `version` tag (if set) still resolves to that commit; every manifest
-`external_dependencies['python']` is named in `requirements.txt`; and no addon
-name collides between `addons/` and `vendored/`.
+`external_dependencies['python']` is named in `requirements.txt`; no addon
+name collides between `addons/` and `vendored/`; and no file under `vendored/` is
+gitignored. Python bytecode (`__pycache__/`, `*.pyc`) is excluded from the byte
+comparison, so running the test suite doesn't turn the check red.
+
+That last assertion catches a trap specific to migration: repo-wide ignore rules
+(`node_modules`, `package.json`, …) are harmless while shared addons live in
+submodules, but they start applying the moment those addons become real files
+under `vendored/` — and `git add` then skips the matching files without a word,
+so the committed tree is incomplete while everything looks fine locally.
+`vendor migrate` appends a `!vendored/**` negation to `.gitignore` when it
+detects the situation. Pins themselves come from the gitlink the branch records,
+not from whatever the submodule happens to be checked out at; migrate refuses to
+run against uninitialized submodules.
 
 `vendor update` is the **pull** side: each client owns its pins. For every addon
 that tracks upstream — a `version` (bump to the newest `<addon>/<version>` tag) or

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/README.md

@@ -161,8 +161,20 @@ something other than the current pin.
 
 `vendor check` verifies, per addon: the vendored files byte-match the pinned
 commit; a `version` tag (if set) still resolves to that commit; every manifest
-`external_dependencies['python']` is named in `requirements.txt`; and no addon
-name collides between `addons/` and `vendored/`.
+`external_dependencies['python']` is named in `requirements.txt`; no addon
+name collides between `addons/` and `vendored/`; and no file under `vendored/` is
+gitignored. Python bytecode (`__pycache__/`, `*.pyc`) is excluded from the byte
+comparison, so running the test suite doesn't turn the check red.
+
+That last assertion catches a trap specific to migration: repo-wide ignore rules
+(`node_modules`, `package.json`, …) are harmless while shared addons live in
+submodules, but they start applying the moment those addons become real files
+under `vendored/` — and `git add` then skips the matching files without a word,
+so the committed tree is incomplete while everything looks fine locally.
+`vendor migrate` appends a `!vendored/**` negation to `.gitignore` when it
+detects the situation. Pins themselves come from the gitlink the branch records,
+not from whatever the submodule happens to be checked out at; migrate refuses to
+run against uninitialized submodules.
 
 `vendor update` is the **pull** side: each client owns its pins. For every addon
 that tracks upstream — a `version` (bump to the newest `<addon>/<version>` tag) or

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "odoo-dev"
-version = "1.2.0"
+version = "1.2.2"
 description = "Odoo Development Environment Helper"
 readme = "README.md"
 requires-python = ">=3.12"

odoo_dev-1.2.2/src/odoo_dev/__init__.py

@@ -0,0 +1,3 @@
+"""Odoo Development Environment Helper."""
+
+__version__ = "1.2.2"  # x-release-please-version

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/commands/run.py

@@ -235,17 +235,18 @@ def test(
             break
 
     # Auto-load exclusions from repo_deps.yaml when not explicitly provided
-    if exclude is None and repo_deps_file is not None:
+    no_ci_modules: list[str] = []
+    if repo_deps_file is not None:
         try:
             import yaml
 
             data = yaml.safe_load(repo_deps_file.read_text()) or {}
-            no_ci = data.get("no_ci", [])
-            if no_ci:
-                exclude = ",".join(no_ci)
-                info(f"Excluding (from {repo_deps_file} no_ci): {exclude}")
+            no_ci_modules = list(data.get("no_ci", []) or [])
         except Exception:
-            pass
+            no_ci_modules = []
+    if exclude is None and no_ci_modules:
+        exclude = ",".join(no_ci_modules)
+        info(f"Excluding (from {repo_deps_file} no_ci): {exclude}")
 
     # Verify setup
     if not cfg.venv_path.exists():
@@ -376,6 +377,9 @@ def test(
             "--stop-after-init",
             "--http-port",
             str(http_port),
+            # No need to fork prefork workers for a stop-after-init install.
+            "--workers",
+            "0",
         ],
     )
 
@@ -422,11 +426,36 @@ def test(
                 "--stop-after-init",
                 "--http-port",
                 str(http_port),
+                # HttpCase needs the threaded server (ThreadedServer.httpd);
+                # a prefork/multi-worker conf raises
+                # "'PreforkServer' object has no attribute 'httpd'" in
+                # setUpClass. Force single-process regardless of odoo.conf.
+                "--workers",
+                "0",
+                # A restrictive dbfilter in odoo.conf (e.g. `dbfilter = ^rwi$`)
+                # never matches the ephemeral test DB, so HttpCase requests get
+                # "dbfilter rejects it; logging session out" -> auth='user'
+                # routes 404 and JSON endpoints return non-JSON. Scope the
+                # filter to this run's test DB so the test server serves it.
+                f"--db-filter=^{db_name}$",
             ]
         )
 
-        if test_tags:
-            test_cmd.extend(["--test-tags", test_tags])
+        # Excluding no_ci modules from the tested-module *list* is not enough:
+        # they still install as transitive deps, and Odoo's button_upgrade
+        # cascades 'to upgrade' to downstream dependents of any upgraded target
+        # module (`-u modules`). A no_ci module that depends on a tested module
+        # thus gets re-upgraded and its post_install tests run. Exclude their
+        # tests explicitly via Odoo test-tags. The TagsSelector auto-adds
+        # '+standard' when only '-' filters are present, so this keeps running
+        # every standard test except those belonging to a no_ci module.
+        effective_test_tags = test_tags
+        if effective_test_tags is None and no_ci_modules:
+            effective_test_tags = ",".join(f"-/{m}" for m in no_ci_modules)
+            info(f"Excluding no_ci module tests via --test-tags: {effective_test_tags}")
+
+        if effective_test_tags:
+            test_cmd.extend(["--test-tags", effective_test_tags])
 
         result = subprocess.run(test_cmd)
         test_exit_code = result.returncode

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/commands/vendor.py

@@ -14,16 +14,22 @@ from typing import Annotated, Optional
 import typer
 
 from odoo_dev.config import load_config
-from odoo_dev.utils.console import error, info, success
+from odoo_dev.utils.console import error, info, success, warning
 from odoo_dev.vendor.develop import (
     DevelopError,
     develop_state,
+    ensure_addons_path,
     start_develop,
     stop_develop,
 )
 from odoo_dev.vendor.edit import EditError, add_addon, bump_addon
 from odoo_dev.vendor.lock import Lockfile
-from odoo_dev.vendor.migrate import migrate_repo, plan_migration
+from odoo_dev.vendor.migrate import (
+    MigrateError,
+    ensure_vendored_not_ignored,
+    migrate_repo,
+    plan_migration,
+)
 from odoo_dev.vendor.sync import sync_addons
 from odoo_dev.vendor.update import apply_update, find_updates
 from odoo_dev.vendor.verify import verify
@@ -146,8 +152,23 @@ def migrate_cmd(
 ) -> None:
     """Convert addons/ symlinks into .repos submodules to vendored/ + addons.lock."""
     cfg = load_config()
-    if dry_run:
+    try:
         plans = plan_migration(cfg.project_dir, addon or None)
+    except MigrateError as exc:
+        error(str(exc))
+        raise typer.Exit(2)
+
+    # The pin is the gitlink the branch records. Say so when the submodule is
+    # checked out somewhere else, since that checkout is what the dev sees.
+    for p in plans:
+        if p["checkout"] and p["checkout"] != p["commit"]:
+            warning(
+                f"{p['name']}: {p['sub_path']} is checked out at "
+                f"{p['checkout'][:12]} but this branch records "
+                f"{p['commit'][:12]} — pinning the recorded commit."
+            )
+
+    if dry_run:
         if not plans:
             info("Nothing to migrate (no symlinked submodule addons found).")
             return
@@ -159,6 +180,23 @@ def migrate_cmd(
 
     lock, unused = migrate_repo(cfg.project_dir, addons=addon or None, deinit=deinit)
     success(f"Migrated {len(lock.entries)} addon(s) to vendored/ (see addons.lock).")
+
+    # Wire vendored/ into the local conf's addons_path. A fresh `setup` adds it,
+    # but `setup` won't overwrite an existing conf, so a repo vendored for the
+    # first time would otherwise leave Odoo unable to find the new addons
+    # ("invalid module names, ignored"). Local conf only — never Docker/CI.
+    if cfg.config_file.exists() and cfg.vendored_dir.is_dir():
+        if ensure_addons_path(cfg.config_file, str(cfg.vendored_dir)):
+            info(f"Added {cfg.vendored_dir} to {cfg.config_file} addons_path.")
+
+    # Repo-wide ignore rules that were harmless against submodule content now
+    # apply to real files under vendored/, where git would drop them from the
+    # commit without a word. Negate them at the point of damage.
+    if ensure_vendored_not_ignored(cfg.project_dir):
+        info(
+            "Added a '!vendored/**' negation to .gitignore (rules matched "
+            "vendored files, which git would have silently skipped)."
+        )
     if unused:
         info("")
         if deinit:

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/vendor/develop.py

@@ -167,6 +167,21 @@ def remove_addons_path(conf_file: Path, path: str) -> None:
     _write_addons_path(conf_file, [p for p in read_addons_path(conf_file) if p != path])
 
 
+def ensure_addons_path(conf_file: Path, path: str) -> bool:
+    """Append ``path`` to the conf's addons_path if it isn't already listed.
+
+    Idempotent; returns True only when it actually added the entry. Used by
+    ``vendor migrate`` to wire ``vendored/`` into a conf that predates vendoring
+    (``setup`` adds it for fresh confs but never overwrites an existing one).
+    """
+    paths = read_addons_path(conf_file)
+    if path in paths:
+        return False
+    paths.append(path)
+    _write_addons_path(conf_file, paths)
+    return True
+
+
 # --- overlay / gitignore / state ------------------------------------------------
 
 

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/vendor/edit.py

@@ -76,8 +76,15 @@ def bump_addon(
     entry = lock.entries[name]
     sha = _resolve_pin(name, entry.source, version, commit, entry.branch, cache_dir)
     entry.commit = sha
-    if version is not None:
-        entry.version = version
+    # ``version`` is the tag-intent metadata, and ``vendor check``'s moved-tag
+    # tripwire (verify.py) requires ``<name>/<version>`` to still resolve to
+    # ``commit``. A ``--commit`` / branch-HEAD bump moves the pin off the tagged
+    # commit, so the old ``version`` is now stale and would (correctly) fail the
+    # tripwire. Set it to whatever the bump was keyed on: the new tag for a
+    # ``--version`` bump, or ``None`` for a raw ``--commit`` / branch bump — a
+    # commit pin carries no version metadata (matching how ``migrate`` renders
+    # untagged pins).
+    entry.version = version
     lock.entries[name] = entry
     lock.dump(project_dir / "addons.lock")
     sync_addons(project_dir, lock, cache_dir=cache_dir, names=[name])

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/vendor/materialize.py

@@ -5,6 +5,11 @@ modes and symlinks survive verbatim — the vendored copy is byte-identical to t
 source subtree. :func:`tree_diff` then compares two trees on content, the
 executable bit, and symlink targets (a plain ``diff -r`` silently ignores the
 latter two and follows symlinks), which is what makes ``vendor check`` trustworthy.
+
+Python bytecode (``__pycache__/``, ``*.pyc``, ``*.pyo``) is excluded from the
+comparison: running or testing a vendored addon locally compiles it in place, and
+those artifacts are gitignored build output that is neither part of the pinned
+source nor present in a fresh CI checkout.
 """
 
 from __future__ import annotations
@@ -60,12 +65,18 @@ def extract_subtree(repo: Path, commit: str, addon: str, dest: Path) -> None:
         )
 
 
+_BYTECODE_DIRS = {"__pycache__"}
+_BYTECODE_SUFFIXES = (".pyc", ".pyo")
+
+
 def _entries(root: Path) -> dict:
     """Map each path relative to ``root`` to a comparable fingerprint.
 
     - symlink -> ("link", target)          (never dereferenced)
     - file    -> ("file", exec_bit, sha1)
     - dir     -> ("dir",)
+
+    Python bytecode is skipped entirely (see the module docstring).
     """
     root = Path(root)
     out: dict = {}
@@ -73,6 +84,8 @@ def _entries(root: Path) -> dict:
         # Do not descend into symlinked directories; record them as links.
         real_dirs = []
         for d in dirnames:
+            if d in _BYTECODE_DIRS:
+                continue
             p = Path(dirpath) / d
             rel = str(p.relative_to(root))
             if p.is_symlink():
@@ -82,6 +95,8 @@ def _entries(root: Path) -> dict:
                 real_dirs.append(d)
         dirnames[:] = real_dirs
         for f in filenames:
+            if f.endswith(_BYTECODE_SUFFIXES):
+                continue
             p = Path(dirpath) / f
             rel = str(p.relative_to(root))
             if p.is_symlink():

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/vendor/migrate.py

@@ -1,8 +1,10 @@
 """``vendor migrate``: convert a submodule+symlink repo to a vendored one.
 
 Reads the ``addons/<addon>`` symlinks that point into ``.repos/*`` submodules,
-derives a per-addon pin (submodule remote URL = source, submodule HEAD = commit,
-manifest version -> version when a matching ``<addon>/<version>`` tag exists),
+derives a per-addon pin (submodule remote URL = source, recorded gitlink = commit,
+manifest version -> version ONLY when the ``<addon>/<version>`` tag resolves to
+the pinned commit; a commit that isn't the tagged release (a pin behind or ahead
+of the tag, or any intermediate commit) is left commit-only, no version),
 writes ``addons.lock``, materializes ``vendored/<addon>/`` from the submodule,
 and removes the now-redundant symlink. Client-private real dirs under ``addons/``
 are left untouched; only symlinks into submodules are migrated. Submodule removal
@@ -19,13 +21,47 @@ from typing import Iterable, Optional
 
 from odoo_dev.utils.manifest import manifest_path, read_version
 from odoo_dev.vendor.lock import LockEntry, Lockfile
+from odoo_dev.vendor.sources import tag_resolves_to
 from odoo_dev.vendor.sync import sync_addons
+from odoo_dev.vendor.verify import gitignored_under_vendored
 
 
 class MigrateError(Exception):
     pass
 
 
+_NEGATION = "!vendored/**"
+_NEGATION_BLOCK = (
+    "\n# Vendored addons must match addons.lock byte-for-byte, so no repo-wide\n"
+    "# ignore rule may strip files out of them. Keep last.\n"
+    f"{_NEGATION}\n"
+)
+
+
+def ensure_vendored_not_ignored(project_dir: Path) -> bool:
+    """Append a ``!vendored/**`` negation when ``.gitignore`` would eat vendored files.
+
+    ``migrate`` is the command that creates the hazard — it turns submodule content
+    (governed by the submodule's own ignore rules) into real files under the
+    superproject's — so it is the right place to repair it, in the same shape as
+    ``ensure_addons_path`` fixing up ``conf/odoo.conf``. Idempotent; returns True
+    only when it actually wrote.
+    """
+    project_dir = Path(project_dir)
+    if not gitignored_under_vendored(project_dir):
+        return False
+    gitignore = project_dir / ".gitignore"
+    text = gitignore.read_text() if gitignore.exists() else ""
+    if any(line.strip() == _NEGATION for line in text.splitlines()):
+        # Already negated yet still ignored: a later rule re-excludes the path, or
+        # the negation cannot apply. Leave it — `vendor check` reports the files.
+        return False
+    if text and not text.endswith("\n"):
+        text += "\n"
+    gitignore.write_text(text + _NEGATION_BLOCK)
+    return True
+
+
 def read_gitmodules(project_dir: Path) -> list:
     """Return [(name, path, url)] for each submodule declared in .gitmodules."""
     gm = Path(project_dir) / ".gitmodules"
@@ -54,29 +90,82 @@ def read_gitmodules(project_dir: Path) -> list:
     ]
 
 
-def _submodule_head(project_dir: Path, sub_path: str) -> str:
-    return subprocess.run(
-        ["git", "-C", str(Path(project_dir) / sub_path), "rev-parse", "HEAD"],
-        check=True,
+def _gitlink_commit(project_dir: Path, sub_path: str) -> str:
+    """The commit the SUPERPROJECT records for ``sub_path`` — the authoritative pin.
+
+    Read from the superproject tree, never from the submodule working copy. An
+    uninitialized submodule is an empty directory, so ``git -C <sub> rev-parse
+    HEAD`` walks up to the enclosing repo, returns the SUPERPROJECT's head and
+    exits 0 — pinning every addon across every source repo to one wrong sha, in a
+    lockfile that ``vendor check`` then happily validates against itself.
+    ``ls-tree`` cannot walk up, and the ``160000`` mode proves it is a gitlink.
+    """
+    res = subprocess.run(
+        ["git", "-C", str(project_dir), "ls-tree", "HEAD", "--", sub_path],
+        capture_output=True,
+        text=True,
+    )
+    line = res.stdout.strip()
+    if res.returncode != 0 or not line:
+        raise MigrateError(
+            f"{sub_path}: no submodule recorded at this path in HEAD — cannot "
+            f"derive a pin (commit the submodule, or fix .gitmodules)."
+        )
+    mode, _, rest = line.partition(" ")
+    obj_type, _, rest = rest.partition(" ")
+    sha = rest.split("\t", 1)[0].strip()
+    if mode != "160000" or obj_type != "commit":
+        raise MigrateError(
+            f"{sub_path}: recorded in HEAD as a {obj_type}, not a submodule "
+            f"gitlink — cannot derive a pin."
+        )
+    return sha
+
+
+def _submodule_checkout(project_dir: Path, sub_path: str) -> Optional[str]:
+    """The commit the submodule working copy is actually on, or None if absent.
+
+    Only meaningful for an initialized submodule (which owns a ``.git``); the
+    caller uses it to warn when the checkout has drifted off the gitlink.
+    """
+    sub_root = Path(project_dir) / sub_path
+    if not (sub_root / ".git").exists():
+        return None
+    res = subprocess.run(
+        ["git", "-C", str(sub_root), "rev-parse", "HEAD"],
         capture_output=True,
         text=True,
-    ).stdout.strip()
+    )
+    return res.stdout.strip() if res.returncode == 0 else None
 
 
-def _tag_exists(repo: Path, tag: str) -> bool:
-    return (
-        subprocess.run(
-            ["git", "-C", str(repo), "rev-parse", f"refs/tags/{tag}"],
-            capture_output=True,
-        ).returncode
-        == 0
+def uninitialized_submodules(project_dir: Path) -> list:
+    """Submodule paths git reports as not checked out (``-`` prefix)."""
+    res = subprocess.run(
+        ["git", "-C", str(project_dir), "submodule", "status"],
+        capture_output=True,
+        text=True,
     )
+    paths = []
+    for line in res.stdout.splitlines():
+        if not line.startswith("-"):
+            continue
+        parts = line[1:].split()
+        if len(parts) >= 2:
+            paths.append(parts[1])
+    return paths
 
 
 def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) -> list:
     """Return a list of planned pins without changing anything.
 
-    Each item: dict(name, source, commit, version, symlink, sub_path).
+    Each item: dict(name, source, commit, version, checkout, symlink, sub_path).
+    ``checkout`` is the submodule's actual HEAD, so the caller can warn when it
+    has drifted off the recorded gitlink the pin comes from.
+
+    Raises :class:`MigrateError` if any submodule being migrated is uninitialized:
+    its addon content and manifest are simply not on disk, and its pin cannot be
+    trusted to mean anything.
     """
     project_dir = Path(project_dir)
     addons_dir = project_dir / "addons"
@@ -84,6 +173,8 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
         return []
     subs = read_gitmodules(project_dir)
     only = set(addons) if addons is not None else None
+    uninit = set(uninitialized_submodules(project_dir))
+    blocked = []
 
     plans = []
     for link in sorted(addons_dir.iterdir()):
@@ -106,6 +197,9 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
         if sub is None:
             continue  # symlink not into a known submodule; skip
         s_name, s_path, s_url = sub
+        if s_path in uninit:
+            blocked.append((name, s_path))
+            continue
         sub_root = (project_dir / s_path).resolve()
         subpath = real.relative_to(sub_root)
         if str(subpath) != name:
@@ -113,12 +207,18 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
                 f"{name}: addon sits at '{subpath}' inside submodule {s_path}, not at "
                 f"the root as '{name}'. Nested addons aren't handled yet — migrate by hand."
             )
-        commit = _submodule_head(project_dir, s_path)
+        commit = _gitlink_commit(project_dir, s_path)
         version = None
         mf = manifest_path(real)
         if mf is not None:
             v = read_version(mf.read_text())
-            if v is not None and _tag_exists(sub_root, f"{name}/{v}"):
+            # Only claim a ``version`` when the tag actually points at the pinned
+            # commit. Checking mere tag EXISTENCE was wrong: the same manifest
+            # version can live at several commits (the tag is cut at one of
+            # them), so a pin at any other commit with that version would carry a
+            # ``version`` whose tag resolves elsewhere — tripping ``vendor
+            # check``'s moved-tag guard. A non-release pin is commit-only.
+            if v is not None and tag_resolves_to(sub_root, f"{name}/{v}", commit):
                 version = v
         plans.append(
             dict(
@@ -126,10 +226,20 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
                 source=s_url,
                 commit=commit,
                 version=version,
+                checkout=_submodule_checkout(project_dir, s_path),
                 symlink=link,
                 sub_path=s_path,
             )
         )
+
+    if blocked:
+        paths = sorted({s_path for _, s_path in blocked})
+        names = ", ".join(sorted(name for name, _ in blocked))
+        raise MigrateError(
+            f"uninitialized submodule(s): {', '.join(paths)} — needed by {names}. "
+            f"Run 'git submodule update --init' first; migrating without them "
+            f"would pin every addon to the superproject's own HEAD."
+        )
     return plans
 
 

{odoo_dev-1.2.0 → odoo_dev-1.2.2}/src/odoo_dev/vendor/update.py

@@ -24,27 +24,46 @@ def _version_key(v: str) -> tuple:
     return tuple(int(p) if p.isdigit() else 0 for p in v.replace("-", ".").split("."))
 
 
+def _series(v: str) -> str:
+    """The major-series segment of a version — the cross-series guard.
+
+    An Odoo addon carries both ``18.0.*`` and ``19.0.*`` version tags in its source;
+    version-tracking must stay within the pin's own series (``18`` vs ``19``), since
+    moving across Odoo series is a deliberate migration, never an auto-update.
+    """
+    return v.split(".", 1)[0]
+
+
 def list_addon_versions(
-    source: str, addon: str, cache_dir: Optional[Path] = None
+    source: str,
+    addon: str,
+    cache_dir: Optional[Path] = None,
+    series: Optional[str] = None,
 ) -> list[str]:
-    """All ``<addon>/<version>`` tag versions present in ``source``."""
+    """``<addon>/<version>`` tag versions in ``source``, optionally same-series only."""
     repo = _ensure_clone(source, cache_dir)
     r = subprocess.run(
         ["git", "-C", str(repo), "tag", "-l", f"{addon}/*"],
         capture_output=True,
         text=True,
     )
-    return [
+    versions = [
         t.split("/", 1)[1]
         for t in r.stdout.split()
         if t.startswith(f"{addon}/") and "/" in t
     ]
+    if series is not None:
+        versions = [v for v in versions if _series(v) == series]
+    return versions
 
 
 def latest_version(
-    source: str, addon: str, cache_dir: Optional[Path] = None
+    source: str,
+    addon: str,
+    cache_dir: Optional[Path] = None,
+    series: Optional[str] = None,
 ) -> Optional[str]:
-    versions = list_addon_versions(source, addon, cache_dir)
+    versions = list_addon_versions(source, addon, cache_dir, series)
     return max(versions, key=_version_key) if versions else None
 
 
@@ -65,8 +84,8 @@ def find_updates(
     for name, e in lock.entries.items():
         if only is not None and name not in only:
             continue
-        if e.version:  # version-tracked
-            latest = latest_version(e.source, name, cache_dir)
+        if e.version:  # version-tracked (within the pin's own major series)
+            latest = latest_version(e.source, name, cache_dir, series=_series(e.version))
             if latest and _version_key(latest) > _version_key(e.version):
                 updates.append(
                     {