prefect-client 3.6.25.dev6__tar.gz → 3.6.25.dev7__tar.gz

{prefect_client-3.6.25.dev6 → prefect_client-3.6.25.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prefect-client
-Version: 3.6.25.dev6
+Version: 3.6.25.dev7
 Summary: Workflow orchestration and management.
 Project-URL: Changelog, https://github.com/PrefectHQ/prefect/releases
 Project-URL: Documentation, https://docs.prefect.io

{prefect_client-3.6.25.dev6 → prefect_client-3.6.25.dev7}/src/prefect/AGENTS.md

@@ -24,6 +24,7 @@ There is no formal public/private boundary beyond the `_` prefix convention. Mod
 - **Flow and task engines advance state differently.** The flow engine makes blocking API calls to the server to propose and advance states. The task engine emits `prefect.task_run.*` events (delivered via WebSockets) but advances state locally through `set_state` calls with polling/backoff — do not assume the two engines work the same way.
 - **Flow state transitions go through the server.** The flow engine proposes states to the server, which accepts or rejects them via orchestration rules. The task engine, by contrast, manages state transitions locally via `set_state` and emits `prefect.task_run.*` events — it does not propose states to the server.
 - **`ProcessPoolTaskRunner` requires picklable data across subprocess boundaries.** `PrefectFuture` objects are not picklable and cannot be passed to worker subprocesses. Any `wait_for` futures must be waited on in the parent process and converted to `State` objects before submission. The subprocess task engine handles `State` objects via `resolve_to_final_result`, which raises `UpstreamTaskError` for non-completed upstreams.
+- **`ProcessPoolTaskRunner` instances may be deserialized without `__init__` running.** When a runner is pickled and restored in a subprocess, `__init__` is not called, so instance attributes set there may be absent. Access any such attribute via `getattr(self, "_attr", default)` rather than `self._attr` directly — both in the property getter and in `duplicate()`. The `subprocess_message_processor_factories` property demonstrates the required pattern.
 
 ## Logging
 

prefect_client-3.6.25.dev7/src/prefect/_build_info.py

@@ -0,0 +1,5 @@
+# Generated by versioningit
+__version__ = "3.6.25.dev7"
+__build_date__ = "2026-04-03 08:23:06.380040+00:00"
+__git_commit__ = "34f66a7cfc986e5b47688ea8ea7a91f8fc58e01f"
+__dirty__ = False

{prefect_client-3.6.25.dev6 → prefect_client-3.6.25.dev7}/src/prefect/runner/AGENTS.md

@@ -77,6 +77,15 @@ Each execution mode has a ProcessStarter implementation. To add a new execution
 
 ProcessWorker (src/prefect/workers/process.py) calls `Runner.execute_flow_run()` and `Runner.execute_bundle()` via the deprecated path, suppressing `PrefectDeprecationWarning` with `warnings.catch_warnings()`. It bypasses FlowRunExecutor, ProcessManager, and ProcessStarter entirely. This is a known migration target.
 
+## GitRepository Input Validation
+
+`GitRepository.__init__` (storage.py) enforces two non-obvious constraints:
+
+- **`commit_sha`** must match `^[0-9a-fA-F]{4,64}$` — any value that fails (including git option strings like `--upload-pack=...`) raises `ValueError`. Branch/tag names must use the `branch` parameter instead.
+- **`directories`** entries starting with `--` trigger a `UserWarning` but are not rejected. The values are passed to `git sparse-checkout set --` (with a `--` separator to prevent flag injection). The warning exists because such paths are unusual; legitimate use is allowed.
+
+These validations exist to prevent git argument injection. Do not bypass them when constructing `GitRepository` programmatically.
+
 ## Reference
 
 Full refactor design and rationale: plans/completed/2026-02-18-runner-refactor.md

{prefect_client-3.6.25.dev6 → prefect_client-3.6.25.dev7}/src/prefect/runner/storage.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
+import warnings
 from copy import deepcopy
 from pathlib import Path
 from typing import (
@@ -176,6 +178,26 @@ class GitRepository:
                 "Cannot provide both a branch and a commit SHA. Please provide only one."
             )
 
+        if commit_sha and not re.match(r"^[0-9a-fA-F]{4,64}$", commit_sha):
+            raise ValueError(
+                f"Invalid commit SHA: {commit_sha!r}."
+                " Expected a hexadecimal Git commit SHA (4–64 characters)."
+                " If you are trying to specify a branch or tag name,"
+                " use the 'branch' parameter instead."
+            )
+
+        if directories:
+            for d in directories:
+                if d.startswith("--"):
+                    warnings.warn(
+                        f"Directory {d!r} starts with '--' and will be"
+                        " interpreted as a path by git sparse-checkout."
+                        " If this is not intentional, remove it from the"
+                        " directories list.",
+                        UserWarning,
+                        stacklevel=2,
+                    )
+
         self._url = url
         self._branch = branch
         self._commit_sha = commit_sha
@@ -357,7 +379,7 @@ class GitRepository:
             # Sparsely checkout the repository if directories are specified and the repo is not in sparse-checkout mode already
             if self._directories and not await self.is_sparsely_checked_out():
                 await run_process(
-                    ["git", "sparse-checkout", "set", *self._directories],
+                    ["git", "sparse-checkout", "set", "--", *self._directories],
                     cwd=self.destination,
                 )
 
@@ -486,7 +508,7 @@ class GitRepository:
         if self._directories:
             self._logger.debug("Will add %s", self._directories)
             await run_process(
-                ["git", "sparse-checkout", "set", *self._directories],
+                ["git", "sparse-checkout", "set", "--", *self._directories],
                 cwd=self.destination,
             )
 

{prefect_client-3.6.25.dev6 → prefect_client-3.6.25.dev7}/src/prefect/task_runners.py

@@ -755,7 +755,7 @@ class ProcessPoolTaskRunner(TaskRunner[PrefectConcurrentFuture[Any]]):
     def duplicate(self) -> Self:
         duplicate_runner = type(self)(max_workers=self._max_workers)
         duplicate_runner.subprocess_message_processor_factories = (
-            self._subprocess_message_processor_factories
+            self.subprocess_message_processor_factories
         )
         return duplicate_runner
 
@@ -763,7 +763,7 @@ class ProcessPoolTaskRunner(TaskRunner[PrefectConcurrentFuture[Any]]):
     def subprocess_message_processor_factories(
         self,
     ) -> tuple[_SubprocessMessageProcessorFactory, ...]:
-        return self._subprocess_message_processor_factories
+        return getattr(self, "_subprocess_message_processor_factories", ())
 
     @subprocess_message_processor_factories.setter
     def subprocess_message_processor_factories(

prefect_client-3.6.25.dev6/src/prefect/_build_info.py

@@ -1,5 +0,0 @@
-# Generated by versioningit
-__version__ = "3.6.25.dev6"
-__build_date__ = "2026-04-02 08:27:40.075452+00:00"
-__git_commit__ = "86c2ab9feb32c75def7a4e01f8b2fac8afea12a9"
-__dirty__ = False