odoo-dev 1.5.0__tar.gz → 1.6.0__tar.gz

odoo_dev-1.6.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.6.0"
+}

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.6.0](https://github.com/bemade/odoo-dev/compare/v1.5.1...v1.6.0) (2026-10-05)
+
+
+### Features
+
+* **vendor:** pin upstream feature branches, gate production on merged pins ([#28](https://github.com/bemade/odoo-dev/issues/28)) ([e232daa](https://github.com/bemade/odoo-dev/commit/e232daa1eb0b040445f97046bdc79ef745153298))
+
+## [1.5.1](https://github.com/bemade/odoo-dev/compare/v1.5.0...v1.5.1) (2026-10-02)
+
+
+### Bug Fixes
+
+* **vendor:** resolve --branch to the fetched remote tip, not the clone-time local branch ([#26](https://github.com/bemade/odoo-dev/issues/26)) ([af03080](https://github.com/bemade/odoo-dev/commit/af030803ba92ba140c875d728c22994eb9271d39))
+
 ## [1.5.0](https://github.com/bemade/odoo-dev/compare/v1.4.0...v1.5.0) (2026-10-01)
 
 

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: odoo-dev
-Version: 1.5.0
+Version: 1.6.0
 Summary: Odoo Development Environment Helper
 Project-URL: Homepage, https://github.com/bemade/odoo-dev
 Project-URL: Repository, https://github.com/bemade/odoo-dev
@@ -156,6 +156,8 @@ odoo-dev vendor sync                  # Materialize vendored/ from addons.lock
 odoo-dev vendor check                 # CI gate: verify vendored/ byte-matches the pins
 odoo-dev vendor add fsm --source github.com/bemade/bemade-addons --version 18.0.1.3.2
 odoo-dev vendor bump fsm --version 18.0.1.4.0   # Move a pin and re-materialize
+odoo-dev vendor bump fsm --branch 18.0-fix-x    # Track a branch, pin its head
+odoo-dev vendor check --mainline 18.0           # Production gate: pins must be merged upstream
 odoo-dev vendor update                # Pull newest upstream for all tracked addons
 odoo-dev vendor update fsm --dry-run  # Show what would update, change nothing
 odoo-dev vendor develop fsm           # Edit fsm against a live source clone
@@ -181,6 +183,14 @@ name collides between `addons/` and `vendored/`; and no file under `vendored/` i
 gitignored. Python bytecode (`__pycache__/`, `*.pyc`) is excluded from the byte
 comparison, so running the test suite doesn't turn the check red.
 
+`vendor check --mainline <branch>` (for merge requests to production) also fails
+any pin whose commit is not in the history of that branch of its source — an
+upstream change still under test on a feature branch. A client can pin a feature
+branch while the change is tested on its staging (`vendor bump <addon> --branch
+<feature>`), but production only takes it once it is merged upstream and
+re-pinned. An entry that is meant to live on a branch (a long-lived fork) opts
+out with `allow_unmerged: true` in `addons.lock`.
+
 That last assertion catches a trap specific to migration: repo-wide ignore rules
 (`node_modules`, `package.json`, …) are harmless while shared addons live in
 submodules, but they start applying the moment those addons become real files

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/README.md

@@ -141,6 +141,8 @@ odoo-dev vendor sync                  # Materialize vendored/ from addons.lock
 odoo-dev vendor check                 # CI gate: verify vendored/ byte-matches the pins
 odoo-dev vendor add fsm --source github.com/bemade/bemade-addons --version 18.0.1.3.2
 odoo-dev vendor bump fsm --version 18.0.1.4.0   # Move a pin and re-materialize
+odoo-dev vendor bump fsm --branch 18.0-fix-x    # Track a branch, pin its head
+odoo-dev vendor check --mainline 18.0           # Production gate: pins must be merged upstream
 odoo-dev vendor update                # Pull newest upstream for all tracked addons
 odoo-dev vendor update fsm --dry-run  # Show what would update, change nothing
 odoo-dev vendor develop fsm           # Edit fsm against a live source clone
@@ -166,6 +168,14 @@ name collides between `addons/` and `vendored/`; and no file under `vendored/` i
 gitignored. Python bytecode (`__pycache__/`, `*.pyc`) is excluded from the byte
 comparison, so running the test suite doesn't turn the check red.
 
+`vendor check --mainline <branch>` (for merge requests to production) also fails
+any pin whose commit is not in the history of that branch of its source — an
+upstream change still under test on a feature branch. A client can pin a feature
+branch while the change is tested on its staging (`vendor bump <addon> --branch
+<feature>`), but production only takes it once it is merged upstream and
+re-pinned. An entry that is meant to live on a branch (a long-lived fork) opts
+out with `allow_unmerged: true` in `addons.lock`.
+
 That last assertion catches a trap specific to migration: repo-wide ignore rules
 (`node_modules`, `package.json`, …) are harmless while shared addons live in
 submodules, but they start applying the moment those addons become real files

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "odoo-dev"
-version = "1.5.0"
+version = "1.6.0"
 description = "Odoo Development Environment Helper"
 readme = "README.md"
 requires-python = ">=3.12"

odoo_dev-1.6.0/src/odoo_dev/__init__.py

@@ -0,0 +1,3 @@
+"""Odoo Development Environment Helper."""
+
+__version__ = "1.6.0"  # x-release-please-version

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/src/odoo_dev/commands/vendor.py

@@ -70,11 +70,23 @@ def check_cmd(
             ".repos/). Use in CI for repos that declare themselves fully vendored.",
         ),
     ] = False,
+    mainline: Annotated[
+        Optional[str],
+        typer.Option(
+            "--mainline",
+            help="Also fail any pin whose commit is not on this branch of its "
+            "source (e.g. 19.0): an upstream change still on a feature branch. "
+            "Use in CI on merge requests to production. Entries marked "
+            "'allow_unmerged: true' are exempt.",
+        ),
+    ] = None,
 ) -> None:
     """Verify vendored/ matches addons.lock exactly (the CI gate). Exit 1 on any problem."""
     cfg = load_config()
     lock = Lockfile.load(cfg.lockfile_path)
-    problems = verify(cfg.project_dir, lock, allow_hybrid=not no_hybrid)
+    problems = verify(
+        cfg.project_dir, lock, allow_hybrid=not no_hybrid, mainline=mainline
+    )
     if problems:
         for p in problems:
             error(p)
@@ -124,11 +136,20 @@ def bump_cmd(
     commit: Annotated[
         Optional[str], typer.Option("--commit", help="Bump to an explicit commit/ref.")
     ] = None,
+    branch: Annotated[
+        Optional[str],
+        typer.Option(
+            "--branch",
+            help="Track this branch from now on (e.g. an upstream feature branch "
+            "under test, or the mainline once merged); without --version/--commit "
+            "the pin moves to its head.",
+        ),
+    ] = None,
 ) -> None:
     """Move an addon's pin to a new version/commit (or its tracked branch HEAD) and re-sync."""
     cfg = load_config()
     try:
-        entry = bump_addon(cfg.project_dir, name, version, commit)
+        entry = bump_addon(cfg.project_dir, name, version, commit, branch=branch)
     except EditError as exc:
         error(str(exc))
         raise typer.Exit(2)

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/src/odoo_dev/vendor/edit.py

@@ -67,13 +67,21 @@ def bump_addon(
     version: Optional[str] = None,
     commit: Optional[str] = None,
     cache_dir: Optional[Path] = None,
+    branch: Optional[str] = None,
 ) -> LockEntry:
-    """Move an existing addon's pin to a new version/commit (or its branch HEAD)."""
+    """Move an existing addon's pin to a new version/commit (or its branch HEAD).
+
+    ``branch`` switches the branch the entry tracks (e.g. an upstream feature
+    branch under test, or back to the mainline once it merged); without a
+    version/commit the pin moves to that branch's head.
+    """
     project_dir = Path(project_dir)
     lock = Lockfile.load(project_dir / "addons.lock")
     if name not in lock.entries:
         raise EditError(f"{name}: not in addons.lock (use 'vendor add')")
     entry = lock.entries[name]
+    if branch:
+        entry.branch = branch
     sha = _resolve_pin(name, entry.source, version, commit, entry.branch, cache_dir)
     entry.commit = sha
     # ``version`` is the tag-intent metadata, and ``vendor check``'s moved-tag

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/src/odoo_dev/vendor/lock.py

@@ -31,6 +31,9 @@ class LockEntry:
     commit: str
     version: Optional[str] = None
     branch: Optional[str] = None
+    # An intentional pin outside the source's mainline (a long-lived fork or
+    # feature branch): exempt from ``vendor check --mainline``.
+    allow_unmerged: bool = False
 
     def to_dict(self) -> dict:
         d: dict = {"source": self.source}
@@ -39,6 +42,8 @@ class LockEntry:
         if self.branch is not None:
             d["branch"] = self.branch
         d["commit"] = self.commit
+        if self.allow_unmerged:
+            d["allow_unmerged"] = True
         return d
 
     @classmethod
@@ -59,6 +64,7 @@ class LockEntry:
             commit=str(commit),
             version=(str(data["version"]) if data.get("version") is not None else None),
             branch=(str(data["branch"]) if data.get("branch") is not None else None),
+            allow_unmerged=bool(data.get("allow_unmerged", False)),
         )
 
 

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/src/odoo_dev/vendor/sources.py

@@ -41,11 +41,15 @@ def _has_commit(repo: Path, commit: str) -> bool:
     )
 
 
+def _is_local(source: str) -> bool:
+    local = Path(source).expanduser()
+    return local.is_dir() and (local / ".git").exists()
+
+
 def _ensure_clone(source: str, cache_dir: Path | None = None) -> Path:
     """Return a local repo path for ``source`` (clone into cache if remote), fetched."""
-    local = Path(source).expanduser()
-    if local.is_dir() and (local / ".git").exists():
-        return local
+    if _is_local(source):
+        return Path(source).expanduser()
     cache_dir = cache_dir or default_cache_dir()
     repo = cache_dir / _cache_key(source)
     if not repo.exists():
@@ -67,7 +71,14 @@ def _ensure_clone(source: str, cache_dir: Path | None = None) -> Path:
 def resolve_commit(source: str, ref: str, cache_dir: Path | None = None) -> str:
     """Resolve a ref (tag, branch, or sha) in ``source`` to a full commit sha."""
     repo = _ensure_clone(source, cache_dir)
-    for candidate in (ref, f"origin/{ref}", f"refs/tags/{ref}"):
+    # A cached clone's local branches are frozen at clone time; fetch only moves
+    # origin/*, so the remote-tracking ref must win there. A local source is the
+    # user's own repo, where the local branch is the truth.
+    if _is_local(source):
+        candidates = (ref, f"origin/{ref}", f"refs/tags/{ref}")
+    else:
+        candidates = (f"origin/{ref}", ref, f"refs/tags/{ref}")
+    for candidate in candidates:
         res = subprocess.run(
             [
                 "git",
@@ -126,6 +137,37 @@ def get_source_at(
     return repo
 
 
+def commit_on_branch(repo: Path, source: str, commit: str, branch: str) -> bool:
+    """True if ``commit`` is in the history of ``branch`` of ``source``.
+
+    A remote source's cache is fetched for ``branch`` first, so a merge made
+    upstream after the cache was filled is seen. Raises RuntimeError when the
+    branch does not exist.
+    """
+    if not _is_local(source):
+        subprocess.run(
+            ["git", "-C", str(repo), "fetch", "origin",
+             f"+refs/heads/{branch}:refs/remotes/origin/{branch}"],
+            capture_output=True,
+            text=True,
+        )
+    for ref in (f"refs/remotes/origin/{branch}", f"refs/heads/{branch}"):
+        known = subprocess.run(
+            ["git", "-C", str(repo), "rev-parse", "--verify", "-q", ref],
+            capture_output=True,
+            text=True,
+        )
+        if known.returncode == 0:
+            return (
+                subprocess.run(
+                    ["git", "-C", str(repo), "merge-base", "--is-ancestor", commit, ref],
+                    capture_output=True,
+                ).returncode
+                == 0
+            )
+    raise RuntimeError(f"{source}: no branch {branch!r}")
+
+
 def tag_resolves_to(repo: Path, tag: str, commit: str) -> bool:
     """True if ``tag`` in ``repo`` dereferences to ``commit`` (the moved-tag tripwire)."""
     res = subprocess.run(

{odoo_dev-1.5.0 → odoo_dev-1.6.0}/src/odoo_dev/vendor/verify.py

@@ -25,7 +25,7 @@ from typing import Optional
 
 from odoo_dev.vendor.lock import Lockfile
 from odoo_dev.vendor.materialize import extract_subtree, is_bytecode, tree_diff
-from odoo_dev.vendor.sources import get_source_at, tag_resolves_to
+from odoo_dev.vendor.sources import commit_on_branch, get_source_at, tag_resolves_to
 
 _MANIFEST_NAMES = ("__manifest__.py", "__openerp__.py")
 
@@ -192,12 +192,18 @@ def verify(
     lock: Lockfile,
     cache_dir: Optional[Path] = None,
     allow_hybrid: bool = True,
+    mainline: Optional[str] = None,
 ) -> list:
     """Return a list of human-readable problems; empty means the gate is green.
 
     ``allow_hybrid=False`` (the CI gate for a repo that declares itself fully
     vendored) additionally fails if any ``addons/`` symlink still points into a
     ``.repos/`` submodule.
+
+    ``mainline`` (the production gate, e.g. ``"19.0"``) additionally fails any
+    pin whose commit is not in the history of that branch of its source — an
+    upstream change still under test on a feature branch. Entries marked
+    ``allow_unmerged`` are exempt.
     """
     project_dir = Path(project_dir)
     vendored = project_dir / "vendored"
@@ -236,6 +242,20 @@ def verify(
             for d in tree_diff(ref, vendored / name):
                 problems.append(f"{name}: vendored copy differs from pin — {d}")
 
+        if mainline and not entry.allow_unmerged:
+            try:
+                merged = commit_on_branch(repo, entry.source, entry.commit, mainline)
+            except Exception as exc:
+                problems.append(f"{name}: cannot check mainline {mainline}: {exc}")
+            else:
+                if not merged:
+                    problems.append(
+                        f"{name}: pinned commit {entry.commit[:12]} is not on "
+                        f"{mainline} of its source (an unmerged upstream change: "
+                        f"merge it upstream and re-pin, or mark the entry "
+                        f"'allow_unmerged: true' if the branch pin is intended)"
+                    )
+
         if entry.version:
             tag = f"{name}/{entry.version}"
             if not tag_resolves_to(repo, tag, entry.commit):

odoo_dev-1.6.0/tests/test_vendor_mainline.py

@@ -0,0 +1,107 @@
+"""Pins on unmerged upstream branches: ``bump --branch`` and the mainline gate.
+
+A client may pin a shared addon to an upstream FEATURE branch while the change
+is tested on its staging. Production must only carry commits that reached the
+source's mainline: ``verify(..., mainline="18.0")`` (``vendor check
+--mainline``) fails any pin whose commit is not in the mainline's history,
+unless the entry is marked ``allow_unmerged: true`` (an intentional long-lived
+branch pin).
+"""
+
+import subprocess
+from pathlib import Path
+
+from odoo_dev.vendor.edit import add_addon, bump_addon
+from odoo_dev.vendor.lock import Lockfile, LockEntry
+from odoo_dev.vendor.sync import sync_addons
+from odoo_dev.vendor.verify import verify
+
+
+def _git(repo: Path, *args: str) -> str:
+    return subprocess.run(
+        ["git", "-C", str(repo), *args], check=True, capture_output=True, text=True
+    ).stdout.strip()
+
+
+def _source_with_feature(tmp_path: Path):
+    """Source repo: mainline ``18.0`` and an unmerged ``feat`` branch."""
+    repo = tmp_path / "src"
+    (repo / "shared_addon").mkdir(parents=True)
+    (repo / "shared_addon" / "__manifest__.py").write_text(
+        "{'name': 'shared', 'version': '18.0.1.0.0'}\n"
+    )
+    (repo / "shared_addon" / "m.py").write_text("v = 1\n")
+    _git(repo, "init", "-q", "-b", "18.0")
+    _git(repo, "config", "user.email", "t@t")
+    _git(repo, "config", "user.name", "t")
+    _git(repo, "add", "-A")
+    _git(repo, "commit", "-qm", "v1")
+    main_sha = _git(repo, "rev-parse", "HEAD")
+    _git(repo, "checkout", "-qb", "feat")
+    (repo / "shared_addon" / "m.py").write_text("v = 2\n")
+    _git(repo, "commit", "-qam", "feature")
+    feat_sha = _git(repo, "rev-parse", "HEAD")
+    _git(repo, "checkout", "-q", "18.0")
+    return repo, main_sha, feat_sha
+
+
+def _pinned(tmp_path, repo, sha, **kw):
+    proj = tmp_path / "client"
+    proj.mkdir(exist_ok=True)
+    lock = Lockfile(entries={"shared_addon": LockEntry("shared_addon", str(repo), sha, **kw)})
+    lock.dump(proj / "addons.lock")
+    sync_addons(proj, lock, cache_dir=tmp_path / "cache")
+    return proj, lock
+
+
+def test_mainline_gate_refuses_unmerged_pin(tmp_path):
+    repo, _main, feat = _source_with_feature(tmp_path)
+    proj, lock = _pinned(tmp_path, repo, feat, branch="feat")
+    problems = verify(proj, lock, cache_dir=tmp_path / "cache", mainline="18.0")
+    assert len(problems) == 1
+    assert "not on 18.0" in problems[0]
+
+
+def test_mainline_gate_passes_once_merged(tmp_path):
+    repo, _main, feat = _source_with_feature(tmp_path)
+    _git(repo, "merge", "--no-ff", "-q", "-m", "merge feat", "feat")
+    proj, lock = _pinned(tmp_path, repo, feat, branch="feat")
+    assert verify(proj, lock, cache_dir=tmp_path / "cache", mainline="18.0") == []
+
+
+def test_allow_unmerged_opts_out_and_round_trips(tmp_path):
+    repo, _main, feat = _source_with_feature(tmp_path)
+    proj, lock = _pinned(tmp_path, repo, feat, branch="feat", allow_unmerged=True)
+    assert verify(proj, lock, cache_dir=tmp_path / "cache", mainline="18.0") == []
+    reloaded = Lockfile.load(proj / "addons.lock")
+    assert reloaded.entries["shared_addon"].allow_unmerged is True
+    assert "allow_unmerged" in (proj / "addons.lock").read_text()
+
+
+def test_mainline_pin_passes_and_flag_is_omitted_by_default(tmp_path):
+    repo, main, _feat = _source_with_feature(tmp_path)
+    proj, lock = _pinned(tmp_path, repo, main, branch="18.0")
+    assert verify(proj, lock, cache_dir=tmp_path / "cache", mainline="18.0") == []
+    assert "allow_unmerged" not in (proj / "addons.lock").read_text()
+
+
+def test_without_mainline_a_branch_pin_is_fine(tmp_path):
+    repo, _main, feat = _source_with_feature(tmp_path)
+    proj, lock = _pinned(tmp_path, repo, feat, branch="feat")
+    assert verify(proj, lock, cache_dir=tmp_path / "cache") == []
+
+
+def test_bump_to_a_branch_tracks_it(tmp_path):
+    repo, main, feat = _source_with_feature(tmp_path)
+    proj = tmp_path / "client"
+    proj.mkdir()
+    add_addon(proj, "shared_addon", str(repo), commit=main, cache_dir=tmp_path / "cache")
+    entry = bump_addon(proj, "shared_addon", branch="feat", cache_dir=tmp_path / "cache")
+    assert entry.branch == "feat"
+    assert entry.commit == feat
+    assert entry.version is None
+    assert (proj / "vendored" / "shared_addon" / "m.py").read_text() == "v = 2\n"
+    # an explicit commit wins over the branch head, and the branch is recorded
+    entry = bump_addon(proj, "shared_addon", commit=main, branch="18.0",
+                       cache_dir=tmp_path / "cache")
+    assert (entry.branch, entry.commit) == ("18.0", main)

odoo_dev-1.6.0/tests/test_vendor_sources.py

@@ -0,0 +1,58 @@
+"""Tests for resolving refs against a source repo (``vendor/sources.py``)."""
+
+import subprocess
+from pathlib import Path
+
+from odoo_dev.vendor.sources import resolve_commit
+
+
+def _git(repo: Path, *args: str) -> str:
+    return subprocess.run(
+        ["git", "-C", str(repo), *args], check=True, capture_output=True, text=True
+    ).stdout.strip()
+
+
+def _commit(repo: Path, content: str) -> str:
+    (repo / "m.py").write_text(content)
+    _git(repo, "add", "-A")
+    _git(repo, "commit", "-qm", content)
+    return _git(repo, "rev-parse", "HEAD")
+
+
+def _upstream(tmp_path: Path) -> Path:
+    repo = tmp_path / "upstream"
+    repo.mkdir()
+    _git(repo, "init", "-q", "-b", "18.0")
+    _git(repo, "config", "user.email", "t@t")
+    _git(repo, "config", "user.name", "t")
+    _commit(repo, "v = 1\n")
+    return repo
+
+
+def test_branch_resolves_to_fetched_tip_not_clone_time_local_branch(tmp_path):
+    """A cached clone keeps a local branch frozen at clone time; fetch only moves
+    ``origin/<branch>``. Resolving the branch must follow the remote, or every
+    ``add``/``bump --branch`` silently pins the tip as of the first clone."""
+    upstream = _upstream(tmp_path)
+    source = f"file://{upstream}"
+    cache = tmp_path / "cache"
+    resolve_commit(source, "18.0", cache)  # first use: clones into the cache
+
+    new_tip = _commit(upstream, "v = 2\n")
+
+    assert resolve_commit(source, "18.0", cache) == new_tip
+
+
+def test_local_source_resolves_its_own_branch(tmp_path):
+    """A local-path source is the user's repo, used as-is: its local branch is
+    the truth, even when it also has a (stale) ``origin/<branch>``."""
+    upstream = _upstream(tmp_path)
+    local = tmp_path / "local"
+    subprocess.run(
+        ["git", "clone", "-q", str(upstream), str(local)], check=True, capture_output=True
+    )
+    _git(local, "config", "user.email", "t@t")
+    _git(local, "config", "user.name", "t")
+    local_tip = _commit(local, "v = local\n")
+
+    assert resolve_commit(str(local), "18.0") == local_tip

odoo_dev-1.5.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "1.5.0"
-}

odoo_dev-1.5.0/src/odoo_dev/__init__.py

@@ -1,3 +0,0 @@
-"""Odoo Development Environment Helper."""
-
-__version__ = "1.5.0"  # x-release-please-version