odoo-dev 1.2.1__tar.gz → 1.2.3__tar.gz

odoo_dev-1.2.3/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.2.3"
+}

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [1.2.3](https://github.com/bemade/odoo-dev/compare/v1.2.2...v1.2.3) (2026-09-02)
+
+
+### Bug Fixes
+
+* point project URLs at the GitHub source, not the retired GitLab ([61d7348](https://github.com/bemade/odoo-dev/commit/61d734858e50fb8080b508959b9566b4b3134ba0))
+
+## [1.2.2](https://github.com/bemade/odoo-dev/compare/v1.2.1...v1.2.2) (2026-08-14)
+
+
+### Bug Fixes
+
+* **vendor:** exclude python bytecode from the vendored tree comparison ([eab5a0a](https://github.com/bemade/odoo-dev/commit/eab5a0a0779821432724e2be31dcb416e5a60c6b)), closes [#11](https://github.com/bemade/odoo-dev/issues/11)
+* **vendor:** fail when .gitignore would strip files out of vendored/ ([6880616](https://github.com/bemade/odoo-dev/commit/6880616fb3f8d503171f7a6e0f5f6bfe98b667a8)), closes [#13](https://github.com/bemade/odoo-dev/issues/13)
+* **vendor:** pin from the recorded gitlink, refuse uninitialized submodules ([001f86f](https://github.com/bemade/odoo-dev/commit/001f86ff1ae4b89b89681aa8e9878cf2bd9f1f1c)), closes [#12](https://github.com/bemade/odoo-dev/issues/12)
+* **vendor:** three failure modes found in vendoring + CI cycles ([051715a](https://github.com/bemade/odoo-dev/commit/051715a10a17163ebe79cd2fe05a7bbe42328511))
+
 ## [1.2.1](https://github.com/bemade/odoo-dev/compare/v1.2.0...v1.2.1) (2026-07-14)
 
 

odoo_dev-1.2.1/README.md → odoo_dev-1.2.3/PKG-INFO

@@ -1,3 +1,17 @@
+Metadata-Version: 2.5
+Name: odoo-dev
+Version: 1.2.3
+Summary: Odoo Development Environment Helper
+Project-URL: Homepage, https://github.com/bemade/odoo-dev
+Project-URL: Repository, https://github.com/bemade/odoo-dev
+Project-URL: Issues, https://github.com/bemade/odoo-dev/issues
+License-Expression: LGPL-3.0
+Requires-Python: >=3.12
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: typer>=0.9.0
+Description-Content-Type: text/markdown
+
 # odoo-dev
 
 A CLI tool for managing Odoo development environments. Handles local Python setup, Docker containers, database operations, and more.
@@ -161,8 +175,20 @@ something other than the current pin.
 
 `vendor check` verifies, per addon: the vendored files byte-match the pinned
 commit; a `version` tag (if set) still resolves to that commit; every manifest
-`external_dependencies['python']` is named in `requirements.txt`; and no addon
-name collides between `addons/` and `vendored/`.
+`external_dependencies['python']` is named in `requirements.txt`; no addon
+name collides between `addons/` and `vendored/`; and no file under `vendored/` is
+gitignored. Python bytecode (`__pycache__/`, `*.pyc`) is excluded from the byte
+comparison, so running the test suite doesn't turn the check red.
+
+That last assertion catches a trap specific to migration: repo-wide ignore rules
+(`node_modules`, `package.json`, …) are harmless while shared addons live in
+submodules, but they start applying the moment those addons become real files
+under `vendored/` — and `git add` then skips the matching files without a word,
+so the committed tree is incomplete while everything looks fine locally.
+`vendor migrate` appends a `!vendored/**` negation to `.gitignore` when it
+detects the situation. Pins themselves come from the gitlink the branch records,
+not from whatever the submodule happens to be checked out at; migrate refuses to
+run against uninitialized submodules.
 
 `vendor update` is the **pull** side: each client owns its pins. For every addon
 that tracks upstream — a `version` (bump to the newest `<addon>/<version>` tag) or

odoo_dev-1.2.1/PKG-INFO → odoo_dev-1.2.3/README.md

@@ -1,17 +1,3 @@
-Metadata-Version: 2.4
-Name: odoo-dev
-Version: 1.2.1
-Summary: Odoo Development Environment Helper
-Project-URL: Homepage, https://git.bemade.org/bemade/odoo-dev
-Project-URL: Repository, https://git.bemade.org/bemade/odoo-dev
-Project-URL: Issues, https://git.bemade.org/bemade/odoo-dev/-/issues
-License-Expression: LGPL-3.0
-Requires-Python: >=3.12
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: rich>=13.0.0
-Requires-Dist: typer>=0.9.0
-Description-Content-Type: text/markdown
-
 # odoo-dev
 
 A CLI tool for managing Odoo development environments. Handles local Python setup, Docker containers, database operations, and more.
@@ -175,8 +161,20 @@ something other than the current pin.
 
 `vendor check` verifies, per addon: the vendored files byte-match the pinned
 commit; a `version` tag (if set) still resolves to that commit; every manifest
-`external_dependencies['python']` is named in `requirements.txt`; and no addon
-name collides between `addons/` and `vendored/`.
+`external_dependencies['python']` is named in `requirements.txt`; no addon
+name collides between `addons/` and `vendored/`; and no file under `vendored/` is
+gitignored. Python bytecode (`__pycache__/`, `*.pyc`) is excluded from the byte
+comparison, so running the test suite doesn't turn the check red.
+
+That last assertion catches a trap specific to migration: repo-wide ignore rules
+(`node_modules`, `package.json`, …) are harmless while shared addons live in
+submodules, but they start applying the moment those addons become real files
+under `vendored/` — and `git add` then skips the matching files without a word,
+so the committed tree is incomplete while everything looks fine locally.
+`vendor migrate` appends a `!vendored/**` negation to `.gitignore` when it
+detects the situation. Pins themselves come from the gitlink the branch records,
+not from whatever the submodule happens to be checked out at; migrate refuses to
+run against uninitialized submodules.
 
 `vendor update` is the **pull** side: each client owns its pins. For every addon
 that tracks upstream — a `version` (bump to the newest `<addon>/<version>` tag) or

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "odoo-dev"
-version = "1.2.1"
+version = "1.2.3"
 description = "Odoo Development Environment Helper"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -12,9 +12,9 @@ dependencies = [
 license = "LGPL-3.0"
 
 [project.urls]
-Homepage = "https://git.bemade.org/bemade/odoo-dev"
-Repository = "https://git.bemade.org/bemade/odoo-dev"
-Issues = "https://git.bemade.org/bemade/odoo-dev/-/issues"
+Homepage = "https://github.com/bemade/odoo-dev"
+Repository = "https://github.com/bemade/odoo-dev"
+Issues = "https://github.com/bemade/odoo-dev/issues"
 
 [project.scripts]
 odoo-dev = "odoo_dev.cli:app"

odoo_dev-1.2.3/src/odoo_dev/__init__.py

@@ -0,0 +1,3 @@
+"""Odoo Development Environment Helper."""
+
+__version__ = "1.2.3"  # x-release-please-version

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/src/odoo_dev/commands/vendor.py

@@ -14,7 +14,7 @@ from typing import Annotated, Optional
 import typer
 
 from odoo_dev.config import load_config
-from odoo_dev.utils.console import error, info, success
+from odoo_dev.utils.console import error, info, success, warning
 from odoo_dev.vendor.develop import (
     DevelopError,
     develop_state,
@@ -24,7 +24,12 @@ from odoo_dev.vendor.develop import (
 )
 from odoo_dev.vendor.edit import EditError, add_addon, bump_addon
 from odoo_dev.vendor.lock import Lockfile
-from odoo_dev.vendor.migrate import migrate_repo, plan_migration
+from odoo_dev.vendor.migrate import (
+    MigrateError,
+    ensure_vendored_not_ignored,
+    migrate_repo,
+    plan_migration,
+)
 from odoo_dev.vendor.sync import sync_addons
 from odoo_dev.vendor.update import apply_update, find_updates
 from odoo_dev.vendor.verify import verify
@@ -147,8 +152,23 @@ def migrate_cmd(
 ) -> None:
     """Convert addons/ symlinks into .repos submodules to vendored/ + addons.lock."""
     cfg = load_config()
-    if dry_run:
+    try:
         plans = plan_migration(cfg.project_dir, addon or None)
+    except MigrateError as exc:
+        error(str(exc))
+        raise typer.Exit(2)
+
+    # The pin is the gitlink the branch records. Say so when the submodule is
+    # checked out somewhere else, since that checkout is what the dev sees.
+    for p in plans:
+        if p["checkout"] and p["checkout"] != p["commit"]:
+            warning(
+                f"{p['name']}: {p['sub_path']} is checked out at "
+                f"{p['checkout'][:12]} but this branch records "
+                f"{p['commit'][:12]} — pinning the recorded commit."
+            )
+
+    if dry_run:
         if not plans:
             info("Nothing to migrate (no symlinked submodule addons found).")
             return
@@ -168,6 +188,15 @@ def migrate_cmd(
     if cfg.config_file.exists() and cfg.vendored_dir.is_dir():
         if ensure_addons_path(cfg.config_file, str(cfg.vendored_dir)):
             info(f"Added {cfg.vendored_dir} to {cfg.config_file} addons_path.")
+
+    # Repo-wide ignore rules that were harmless against submodule content now
+    # apply to real files under vendored/, where git would drop them from the
+    # commit without a word. Negate them at the point of damage.
+    if ensure_vendored_not_ignored(cfg.project_dir):
+        info(
+            "Added a '!vendored/**' negation to .gitignore (rules matched "
+            "vendored files, which git would have silently skipped)."
+        )
     if unused:
         info("")
         if deinit:

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/src/odoo_dev/vendor/materialize.py

@@ -5,6 +5,11 @@ modes and symlinks survive verbatim — the vendored copy is byte-identical to t
 source subtree. :func:`tree_diff` then compares two trees on content, the
 executable bit, and symlink targets (a plain ``diff -r`` silently ignores the
 latter two and follows symlinks), which is what makes ``vendor check`` trustworthy.
+
+Python bytecode (``__pycache__/``, ``*.pyc``, ``*.pyo``) is excluded from the
+comparison: running or testing a vendored addon locally compiles it in place, and
+those artifacts are gitignored build output that is neither part of the pinned
+source nor present in a fresh CI checkout.
 """
 
 from __future__ import annotations
@@ -60,12 +65,18 @@ def extract_subtree(repo: Path, commit: str, addon: str, dest: Path) -> None:
         )
 
 
+_BYTECODE_DIRS = {"__pycache__"}
+_BYTECODE_SUFFIXES = (".pyc", ".pyo")
+
+
 def _entries(root: Path) -> dict:
     """Map each path relative to ``root`` to a comparable fingerprint.
 
     - symlink -> ("link", target)          (never dereferenced)
     - file    -> ("file", exec_bit, sha1)
     - dir     -> ("dir",)
+
+    Python bytecode is skipped entirely (see the module docstring).
     """
     root = Path(root)
     out: dict = {}
@@ -73,6 +84,8 @@ def _entries(root: Path) -> dict:
         # Do not descend into symlinked directories; record them as links.
         real_dirs = []
         for d in dirnames:
+            if d in _BYTECODE_DIRS:
+                continue
             p = Path(dirpath) / d
             rel = str(p.relative_to(root))
             if p.is_symlink():
@@ -82,6 +95,8 @@ def _entries(root: Path) -> dict:
                 real_dirs.append(d)
         dirnames[:] = real_dirs
         for f in filenames:
+            if f.endswith(_BYTECODE_SUFFIXES):
+                continue
             p = Path(dirpath) / f
             rel = str(p.relative_to(root))
             if p.is_symlink():

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/src/odoo_dev/vendor/migrate.py

@@ -1,7 +1,7 @@
 """``vendor migrate``: convert a submodule+symlink repo to a vendored one.
 
 Reads the ``addons/<addon>`` symlinks that point into ``.repos/*`` submodules,
-derives a per-addon pin (submodule remote URL = source, submodule HEAD = commit,
+derives a per-addon pin (submodule remote URL = source, recorded gitlink = commit,
 manifest version -> version ONLY when the ``<addon>/<version>`` tag resolves to
 the pinned commit; a commit that isn't the tagged release (a pin behind or ahead
 of the tag, or any intermediate commit) is left commit-only, no version),
@@ -23,12 +23,45 @@ from odoo_dev.utils.manifest import manifest_path, read_version
 from odoo_dev.vendor.lock import LockEntry, Lockfile
 from odoo_dev.vendor.sources import tag_resolves_to
 from odoo_dev.vendor.sync import sync_addons
+from odoo_dev.vendor.verify import gitignored_under_vendored
 
 
 class MigrateError(Exception):
     pass
 
 
+_NEGATION = "!vendored/**"
+_NEGATION_BLOCK = (
+    "\n# Vendored addons must match addons.lock byte-for-byte, so no repo-wide\n"
+    "# ignore rule may strip files out of them. Keep last.\n"
+    f"{_NEGATION}\n"
+)
+
+
+def ensure_vendored_not_ignored(project_dir: Path) -> bool:
+    """Append a ``!vendored/**`` negation when ``.gitignore`` would eat vendored files.
+
+    ``migrate`` is the command that creates the hazard — it turns submodule content
+    (governed by the submodule's own ignore rules) into real files under the
+    superproject's — so it is the right place to repair it, in the same shape as
+    ``ensure_addons_path`` fixing up ``conf/odoo.conf``. Idempotent; returns True
+    only when it actually wrote.
+    """
+    project_dir = Path(project_dir)
+    if not gitignored_under_vendored(project_dir):
+        return False
+    gitignore = project_dir / ".gitignore"
+    text = gitignore.read_text() if gitignore.exists() else ""
+    if any(line.strip() == _NEGATION for line in text.splitlines()):
+        # Already negated yet still ignored: a later rule re-excludes the path, or
+        # the negation cannot apply. Leave it — `vendor check` reports the files.
+        return False
+    if text and not text.endswith("\n"):
+        text += "\n"
+    gitignore.write_text(text + _NEGATION_BLOCK)
+    return True
+
+
 def read_gitmodules(project_dir: Path) -> list:
     """Return [(name, path, url)] for each submodule declared in .gitmodules."""
     gm = Path(project_dir) / ".gitmodules"
@@ -57,19 +90,82 @@ def read_gitmodules(project_dir: Path) -> list:
     ]
 
 
-def _submodule_head(project_dir: Path, sub_path: str) -> str:
-    return subprocess.run(
-        ["git", "-C", str(Path(project_dir) / sub_path), "rev-parse", "HEAD"],
-        check=True,
+def _gitlink_commit(project_dir: Path, sub_path: str) -> str:
+    """The commit the SUPERPROJECT records for ``sub_path`` — the authoritative pin.
+
+    Read from the superproject tree, never from the submodule working copy. An
+    uninitialized submodule is an empty directory, so ``git -C <sub> rev-parse
+    HEAD`` walks up to the enclosing repo, returns the SUPERPROJECT's head and
+    exits 0 — pinning every addon across every source repo to one wrong sha, in a
+    lockfile that ``vendor check`` then happily validates against itself.
+    ``ls-tree`` cannot walk up, and the ``160000`` mode proves it is a gitlink.
+    """
+    res = subprocess.run(
+        ["git", "-C", str(project_dir), "ls-tree", "HEAD", "--", sub_path],
         capture_output=True,
         text=True,
-    ).stdout.strip()
+    )
+    line = res.stdout.strip()
+    if res.returncode != 0 or not line:
+        raise MigrateError(
+            f"{sub_path}: no submodule recorded at this path in HEAD — cannot "
+            f"derive a pin (commit the submodule, or fix .gitmodules)."
+        )
+    mode, _, rest = line.partition(" ")
+    obj_type, _, rest = rest.partition(" ")
+    sha = rest.split("\t", 1)[0].strip()
+    if mode != "160000" or obj_type != "commit":
+        raise MigrateError(
+            f"{sub_path}: recorded in HEAD as a {obj_type}, not a submodule "
+            f"gitlink — cannot derive a pin."
+        )
+    return sha
+
+
+def _submodule_checkout(project_dir: Path, sub_path: str) -> Optional[str]:
+    """The commit the submodule working copy is actually on, or None if absent.
+
+    Only meaningful for an initialized submodule (which owns a ``.git``); the
+    caller uses it to warn when the checkout has drifted off the gitlink.
+    """
+    sub_root = Path(project_dir) / sub_path
+    if not (sub_root / ".git").exists():
+        return None
+    res = subprocess.run(
+        ["git", "-C", str(sub_root), "rev-parse", "HEAD"],
+        capture_output=True,
+        text=True,
+    )
+    return res.stdout.strip() if res.returncode == 0 else None
+
+
+def uninitialized_submodules(project_dir: Path) -> list:
+    """Submodule paths git reports as not checked out (``-`` prefix)."""
+    res = subprocess.run(
+        ["git", "-C", str(project_dir), "submodule", "status"],
+        capture_output=True,
+        text=True,
+    )
+    paths = []
+    for line in res.stdout.splitlines():
+        if not line.startswith("-"):
+            continue
+        parts = line[1:].split()
+        if len(parts) >= 2:
+            paths.append(parts[1])
+    return paths
 
 
 def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) -> list:
     """Return a list of planned pins without changing anything.
 
-    Each item: dict(name, source, commit, version, symlink, sub_path).
+    Each item: dict(name, source, commit, version, checkout, symlink, sub_path).
+    ``checkout`` is the submodule's actual HEAD, so the caller can warn when it
+    has drifted off the recorded gitlink the pin comes from.
+
+    Raises :class:`MigrateError` if any submodule being migrated is uninitialized:
+    its addon content and manifest are simply not on disk, and its pin cannot be
+    trusted to mean anything.
     """
     project_dir = Path(project_dir)
     addons_dir = project_dir / "addons"
@@ -77,6 +173,8 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
         return []
     subs = read_gitmodules(project_dir)
     only = set(addons) if addons is not None else None
+    uninit = set(uninitialized_submodules(project_dir))
+    blocked = []
 
     plans = []
     for link in sorted(addons_dir.iterdir()):
@@ -99,6 +197,9 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
         if sub is None:
             continue  # symlink not into a known submodule; skip
         s_name, s_path, s_url = sub
+        if s_path in uninit:
+            blocked.append((name, s_path))
+            continue
         sub_root = (project_dir / s_path).resolve()
         subpath = real.relative_to(sub_root)
         if str(subpath) != name:
@@ -106,7 +207,7 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
                 f"{name}: addon sits at '{subpath}' inside submodule {s_path}, not at "
                 f"the root as '{name}'. Nested addons aren't handled yet — migrate by hand."
             )
-        commit = _submodule_head(project_dir, s_path)
+        commit = _gitlink_commit(project_dir, s_path)
         version = None
         mf = manifest_path(real)
         if mf is not None:
@@ -125,10 +226,20 @@ def plan_migration(project_dir: Path, addons: Optional[Iterable[str]] = None) ->
                 source=s_url,
                 commit=commit,
                 version=version,
+                checkout=_submodule_checkout(project_dir, s_path),
                 symlink=link,
                 sub_path=s_path,
             )
         )
+
+    if blocked:
+        paths = sorted({s_path for _, s_path in blocked})
+        names = ", ".join(sorted(name for name, _ in blocked))
+        raise MigrateError(
+            f"uninitialized submodule(s): {', '.join(paths)} — needed by {names}. "
+            f"Run 'git submodule update --init' first; migrating without them "
+            f"would pin every addon to the superproject's own HEAD."
+        )
     return plans
 
 

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/src/odoo_dev/vendor/verify.py

@@ -6,7 +6,8 @@ Assertions (any failure => non-empty problem list => CI red):
   3. moved-tag tripwire (when the entry carries a ``version`` tag);
   4. external python deps of vendored manifests are present in ``requirements.txt``;
   5. no addon name in both ``addons/`` and ``vendored/`` (double-load);
-  6. (``allow_hybrid=False`` only) no ``addons/`` symlink still points into a
+  6. no file under ``vendored/`` is gitignored (it would be dropped at commit);
+  7. (``allow_hybrid=False`` only) no ``addons/`` symlink still points into a
      ``.repos/`` submodule — i.e. the repo is fully vendored, not a hybrid.
 The gate writes nothing.
 """
@@ -16,6 +17,7 @@ from __future__ import annotations
 import ast
 import os
 import re
+import subprocess
 import tempfile
 from pathlib import Path
 from typing import Optional
@@ -108,6 +110,45 @@ def hybrid_submodule_addons(project_dir: Path) -> list:
     return hybrids
 
 
+def gitignored_under_vendored(project_dir: Path) -> list:
+    """Paths under ``vendored/`` that git would silently refuse to add.
+
+    Assertions 1-2 compare the pinned subtree against the WORKING TREE, which
+    ``sync``/``migrate`` just materialized in full — so they always match, and are
+    blind to a repo-wide ignore rule (``node_modules``, ``package.json``, …) that
+    is harmless while shared addons live in submodules but starts applying the
+    moment they become real files here. ``git add`` then skips those files without
+    a word and the committed tree is incomplete: green locally, red only once CI
+    checks out a fresh copy, with an error that reads like an upstream problem.
+
+    ``check-ignore`` (not a tracked-vs-on-disk comparison) is the right probe: it
+    reports exactly the paths git would drop, and consults the index, so neither a
+    not-yet-staged ``vendor add`` nor a deliberate ``git add -f`` is a false alarm.
+    """
+    project_dir = Path(project_dir)
+    vendored = project_dir / "vendored"
+    if not vendored.is_dir() or not (project_dir / ".git").exists():
+        return []
+    rels = [
+        str(p.relative_to(project_dir))
+        for p in sorted(vendored.rglob("*"))
+        if p.is_symlink() or p.is_file()
+    ]
+    if not rels:
+        return []
+    res = subprocess.run(
+        ["git", "-C", str(project_dir), "check-ignore", "--stdin"],
+        input="\n".join(rels) + "\n",
+        capture_output=True,
+        text=True,
+    )
+    # 0 = at least one path is ignored, 1 = none are; anything else is an error
+    # (no git, not a work tree) and must not fail the gate on its own.
+    if res.returncode not in (0, 1):
+        return []
+    return [line for line in res.stdout.splitlines() if line.strip()]
+
+
 def verify(
     project_dir: Path,
     lock: Lockfile,
@@ -179,6 +220,13 @@ def verify(
                 f"{name}: present in BOTH addons/ and vendored/ (double-load)"
             )
 
+    for rel in gitignored_under_vendored(project_dir):
+        problems.append(
+            f"{rel}: under vendored/ but ignored by .gitignore — git will drop it "
+            f"from the commit and the pushed tree will not match addons.lock "
+            f"(add a '!vendored/**' negation, keep it last)"
+        )
+
     if not allow_hybrid:
         for name in hybrid_submodule_addons(project_dir):
             problems.append(

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/tests/test_vendor_materialize.py

@@ -137,6 +137,37 @@ def test_tree_diff_detects_missing_and_extra_files(tmp_path):
     assert any("thing.py" in d for d in diffs)
 
 
+def test_tree_diff_ignores_bytecode_artifacts(tmp_path):
+    """Running the addon compiles it; ``__pycache__`` is not part of the pin.
+
+    The .pyc are gitignored and absent from a fresh CI checkout, so treating them
+    as "extra" made ``vendor check`` fail locally right after ``odoo-dev test``.
+    """
+    repo, sha = _make_source_repo(tmp_path)
+    a = tmp_path / "a"
+    b = tmp_path / "b"
+    extract_subtree(repo, sha, "my_addon", a)
+    extract_subtree(repo, sha, "my_addon", b)
+    cache = b / "models" / "__pycache__"
+    cache.mkdir()
+    (cache / "thing.cpython-312.pyc").write_bytes(b"\x00compiled")
+    (b / "models" / "thing.pyo").write_bytes(b"\x00compiled")
+    assert tree_diff(a, b) == []
+
+
+def test_tree_diff_still_detects_real_change_beside_bytecode(tmp_path):
+    """Ignoring bytecode must not mask a genuine drift in the same directory."""
+    repo, sha = _make_source_repo(tmp_path)
+    a = tmp_path / "a"
+    b = tmp_path / "b"
+    extract_subtree(repo, sha, "my_addon", a)
+    extract_subtree(repo, sha, "my_addon", b)
+    (b / "models" / "__pycache__").mkdir()
+    (b / "models" / "__pycache__" / "thing.cpython-312.pyc").write_bytes(b"\x00")
+    (b / "models" / "thing.py").write_text("x = 2\n")
+    assert any("thing.py" in d for d in tree_diff(a, b))
+
+
 def test_extract_bad_commit_raises(tmp_path):
     repo, _ = _make_source_repo(tmp_path)
     with pytest.raises(Exception):

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/tests/test_vendor_migrate.py

@@ -6,9 +6,14 @@ from pathlib import Path
 
 import pytest
 
-from odoo_dev.vendor.migrate import migrate_repo, plan_migration, MigrateError
+from odoo_dev.vendor.migrate import (
+    MigrateError,
+    ensure_vendored_not_ignored,
+    migrate_repo,
+    plan_migration,
+)
 from odoo_dev.vendor.lock import Lockfile
-from odoo_dev.vendor.verify import verify
+from odoo_dev.vendor.verify import gitignored_under_vendored, verify
 
 
 def _git(repo: Path, *args: str) -> str:
@@ -171,3 +176,81 @@ def test_migrate_is_idempotent(tmp_path):
     # second run: symlink already gone -> nothing to plan, no error
     lock, unused = migrate_repo(client, cache_dir=tmp_path / "cache")
     assert unused == []
+
+
+# --- pins come from the recorded gitlink, never the submodule working copy -----
+
+
+def test_plan_hard_fails_on_uninitialized_submodule(tmp_path):
+    """Regression: an uninitialized submodule is an EMPTY DIR, so
+    ``git -C <sub> rev-parse HEAD`` walks up to the superproject, returns ITS head
+    and exits 0. Every addon across every source repo got pinned to that one sha,
+    and the lock looked perfectly valid.
+    """
+    source, sha = _source_repo(tmp_path)
+    client = _client_repo(tmp_path, source)
+    _git(client, "submodule", "deinit", "-f", ".repos/sale-workflow")
+    (client / ".repos" / "sale-workflow").mkdir(exist_ok=True)
+    superproject_head = _git(client, "rev-parse", "HEAD")
+
+    with pytest.raises(MigrateError) as exc:
+        plan_migration(client)
+    assert ".repos/sale-workflow" in str(exc.value)
+    assert "submodule update --init" in str(exc.value)
+    # and the sha that WOULD have been written is not the superproject's
+    assert sha != superproject_head
+
+
+def test_plan_pins_recorded_gitlink_not_local_checkout(tmp_path):
+    """A submodule checked out somewhere other than the recorded gitlink (a common
+    state while debugging a shared addon) must not silently redefine the pin: the
+    lock has to describe the branch being migrated.
+    """
+    source, first = _source_repo(tmp_path)
+    client = _client_repo(tmp_path, source)  # gitlink records `first`
+    # move the source forward and check the submodule out there, without
+    # committing the gitlink bump in the superproject
+    (source / "shared_addon" / "models" / "m.py").write_text("z = 99\n")
+    _git(source, "add", "-A")
+    _git(source, "commit", "-qm", "local debugging")
+    later = _git(source, "rev-parse", "HEAD")
+    sub = client / ".repos" / "sale-workflow"
+    _git(sub, "fetch", "-q", "origin")
+    _git(sub, "checkout", "-q", later)
+
+    plans = plan_migration(client)
+    assert plans[0]["commit"] == first  # the gitlink, not the checkout
+    assert plans[0]["checkout"] == later  # surfaced so the CLI can warn
+
+
+# --- migrate repairs the .gitignore it just made dangerous --------------------
+
+
+def _vendored_project(tmp_path: Path, gitignore: str) -> Path:
+    proj = tmp_path / "proj"
+    (proj / "vendored" / "shared_addon" / "static").mkdir(parents=True)
+    (proj / "vendored" / "shared_addon" / "static" / "package.json").write_text("{}\n")
+    _git(proj, "init", "-q")
+    (proj / ".gitignore").write_text(gitignore)
+    return proj
+
+
+def test_ensure_vendored_not_ignored_appends_negation(tmp_path):
+    proj = _vendored_project(tmp_path, "node_modules\npackage.json\n")
+    assert gitignored_under_vendored(proj)  # the trap is armed
+
+    assert ensure_vendored_not_ignored(proj) is True
+    assert "!vendored/**" in (proj / ".gitignore").read_text()
+    assert gitignored_under_vendored(proj) == []  # and disarmed
+
+
+def test_ensure_vendored_not_ignored_is_idempotent(tmp_path):
+    proj = _vendored_project(tmp_path, "node_modules\npackage.json\n")
+    assert ensure_vendored_not_ignored(proj) is True
+    assert ensure_vendored_not_ignored(proj) is False
+
+
+def test_ensure_vendored_not_ignored_leaves_a_clean_repo_alone(tmp_path):
+    proj = _vendored_project(tmp_path, "*.pyc\n")
+    assert ensure_vendored_not_ignored(proj) is False
+    assert "!vendored/**" not in (proj / ".gitignore").read_text()

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/tests/test_vendor_verify.py

@@ -17,9 +17,17 @@ def _git(repo: Path, *args: str) -> str:
 
 
 def _source_repo(
-    tmp_path: Path, *, python_dep: str | None = None, tag: str | None = None
+    tmp_path: Path,
+    *,
+    python_dep: str | None = None,
+    tag: str | None = None,
+    extra: dict | None = None,
 ):
-    """A source repo with addon ``shared_addon``; optional python dep + version tag."""
+    """A source repo with addon ``shared_addon``; optional python dep + version tag.
+
+    ``extra`` maps addon-relative paths to contents, for files whose NAME is what
+    matters (e.g. a bundled ``package.json`` a repo-wide ignore rule would eat).
+    """
     repo = tmp_path / "src"
     (repo / "shared_addon").mkdir(parents=True)
     manifest = {"name": "shared_addon", "version": "18.0.1.0.0"}
@@ -27,6 +35,10 @@ def _source_repo(
         manifest["external_dependencies"] = {"python": [python_dep]}
     (repo / "shared_addon" / "__manifest__.py").write_text(repr(manifest) + "\n")
     (repo / "shared_addon" / "models.py").write_text("y = 2\n")
+    for rel, content in (extra or {}).items():
+        p = repo / "shared_addon" / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(content)
     _git(repo, "init", "-q")
     _git(repo, "config", "user.email", "t@t")
     _git(repo, "config", "user.name", "t")
@@ -171,6 +183,59 @@ def test_verify_strict_green_on_fully_vendored_repo(tmp_path):
     assert verify(proj, lock, cache_dir=tmp_path / "cache", allow_hybrid=False) == []
 
 
+# --- .gitignore silently stripping files out of vendored/ ---------------------
+
+
+def _git_project(tmp_path: Path, entry: LockEntry, gitignore: str) -> tuple:
+    proj, lock = _project(tmp_path, entry)
+    _git(proj, "init", "-q")
+    _git(proj, "config", "user.email", "t@t")
+    _git(proj, "config", "user.name", "t")
+    (proj / ".gitignore").write_text(gitignore)
+    return proj, lock
+
+
+def test_verify_red_when_gitignore_would_drop_vendored_files(tmp_path):
+    """Regression: repo-wide js-tooling ignores are harmless while shared addons
+    live in submodules, but start applying the moment they become real files under
+    vendored/. ``git add`` then skips them silently and the committed tree is
+    incomplete — green locally, red only in CI, with an error that reads like an
+    upstream problem.
+    """
+    repo, sha = _source_repo(
+        tmp_path, extra={"static/src/lib/vendorlib/package.json": "{}\n"}
+    )
+    proj, lock = _git_project(
+        tmp_path,
+        LockEntry("shared_addon", str(repo), sha),
+        "node_modules\npackage.json\n",
+    )
+    sync_addons(proj, lock, cache_dir=tmp_path / "cache")
+    problems = verify(proj, lock, cache_dir=tmp_path / "cache")
+    assert any("package.json" in p and ".gitignore" in p for p in problems)
+
+
+def test_verify_green_when_vendored_negation_present(tmp_path):
+    repo, sha = _source_repo(
+        tmp_path, extra={"static/src/lib/vendorlib/package.json": "{}\n"}
+    )
+    proj, lock = _git_project(
+        tmp_path,
+        LockEntry("shared_addon", str(repo), sha),
+        "node_modules\npackage.json\n!vendored/**\n",
+    )
+    sync_addons(proj, lock, cache_dir=tmp_path / "cache")
+    assert verify(proj, lock, cache_dir=tmp_path / "cache") == []
+
+
+def test_verify_gitignore_check_is_silent_outside_a_git_repo(tmp_path):
+    """A plain (non-git) project dir must not trip the new assertion."""
+    repo, sha = _source_repo(tmp_path, extra={"package.json": "{}\n"})
+    proj, lock = _project(tmp_path, LockEntry("shared_addon", str(repo), sha))
+    sync_addons(proj, lock, cache_dir=tmp_path / "cache")
+    assert verify(proj, lock, cache_dir=tmp_path / "cache") == []
+
+
 def test_verify_strict_ignores_non_repos_symlink(tmp_path):
     proj, lock = _sync_clean(tmp_path)
     # A symlink that does NOT point into .repos/ is not a hybrid.

{odoo_dev-1.2.1 → odoo_dev-1.2.3}/uv.lock

@@ -96,7 +96,7 @@ wheels = [
 
 [[package]]
 name = "odoo-dev"
-version = "0.3.3"
+version = "1.2.2"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },

odoo_dev-1.2.1/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "1.2.1"
-}

odoo_dev-1.2.1/src/odoo_dev/__init__.py

@@ -1,3 +0,0 @@
-"""Odoo Development Environment Helper."""
-
-__version__ = "1.2.1"  # x-release-please-version