From 4ff7b2aa4101b4aa91345bfc5f967e1db2423892 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sat, 22 Aug 2026 23:24:03 -0700 Subject: [PATCH] agents: add lockfile and dependency bump rule Automated dependency bumps and manual lockfile updates often miss platform-specific lockfile invariants, such as preserving Windows requirements entries, and overlook necessary follow-up updates to wheel overrides, patch files, and test assertions. Add a glob-triggered agent rule for uv.lock and requirements.txt files that documents lockfile regeneration commands, enforces Windows lockfile preservation, and lists required synchronization steps when dependencies are bumped. --- .agents/rules/lockfiles.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .agents/rules/lockfiles.md diff --git a/.agents/rules/lockfiles.md b/.agents/rules/lockfiles.md new file mode 100644 index 0000000000..2df03a2221 --- /dev/null +++ b/.agents/rules/lockfiles.md @@ -0,0 +1,27 @@ +--- +trigger: glob +description: Rules for updating uv.lock and requirements.txt files +globs: "*requirements*.txt,*requirements*.in,uv.lock,pyproject.toml" +--- + +# Lockfile & Dependency Rules + +## Updating Lockfiles +* Edit input files (`pyproject.toml` or `requirements.in`), never lockfiles. +* Regenerate via `bazel run :requirements.update` or `:uv_lock.update`. + +## Windows Lockfiles (`requirements_windows*.txt`) +* Linux/macOS `.update` targets do not update Windows lockfiles. +* **Never overwrite** Windows lockfiles with non-Windows lockfiles. +* Update only changed package blocks and hashes; preserve Windows dependencies + (`colorama`) and `# via` comments. + +## Dependabot & Dependency Bumps +When dependencies bump, manually synchronize: +* **Retrigger**: Comment `@dependabot recreate` on PRs via `gh pr comment`. +* **Wheel Overrides**: Update wheel filenames in `pip.override(file = "...")` + (`examples/bzlmod/MODULE.bazel`). +* **Wheel Patches**: Update versions, METADATA hashes/lengths, and RECORD + entries in `examples/bzlmod/patches/*.patch`. +* **Test Assertions**: Update hardcoded versions and `dist-info` file lists in + tests (`pip_whl_mods_test.py`, `pip_parse/test.py`, `pip_parse_test.py`).