Skip to content

Sync Gemfile.lock pinot-client version to 1.44.0 - #67

Closed
xiangfu0 wants to merge 1 commit into
mainfrom
cs_Suvd34f7qQ/xiangfu0/codex1/sync-lockfile-version
Closed

xiangfu0 wants to merge 1 commit into
mainfrom
cs_Suvd34f7qQ/xiangfu0/codex1/sync-lockfile-version

Conversation

@xiangfu0

Copy link
Copy Markdown
Contributor

Summary

The committed Gemfile.lock pinned the local path gem pinot-client at 1.29.0, stale from the 1.44.0 version bump (commit ce7e4c4). lib/pinot/version.rb and pinot.gemspec declare 1.44.0, so the lockfile's path-gem version was out of sync with the gemspec.

Why it matters

Plain bundle install (what CI uses) silently rewrites the lockfile to 1.44.0, masking the drift. But a frozen/deployment install surfaces it:

$ BUNDLE_FROZEN=true bundle install
The gemspecs for path gems changed, but the lockfile can't be updated
because frozen mode is set
# exit 16

Regenerating the lockfile brings it into agreement with the gemspec.

Change

One line only — the path gem version pin:

-    pinot-client (1.29.0)
+    pinot-client (1.44.0)

No other dependency pins move. This is pure lockfile metadata; no runtime behavior changes.

Validation (local, source @ this branch head)

  • BUNDLE_FROZEN=true bundle install → exit 0 (was exit 16 before)
  • RuboCop (bundle exec rubocop lib/ spec/) → PASS
  • Unit tests (COVERAGE_MIN=95 bundle exec rspec spec/pinot/) → 524 examples, 0 failures, 1 pending; coverage 99.72% (≥95%)
  • bundle exec bundle-audit check → no vulnerabilities
  • Integration tests against live apachepinot/pinot:1.5.0 QuickStart BATCH (spec/integration/) → 16 examples, 0 failures (unaffected by this metadata change; run on identical source)

Note: Ruby 3.3 lane not exercised locally (only 3.2 target config / 3.4 runtime available in this environment); covered by CI.

The committed Gemfile.lock pinned the local path gem pinot-client at
1.29.0, stale from the 1.44.0 version bump (commit ce7e4c4). lib/pinot/
version.rb and the gemspec declare 1.44.0, so the lockfile was out of
sync with the gemspec.

Plain `bundle install` silently rewrites the lockfile, masking the drift
in CI, but `BUNDLE_FROZEN=true bundle install` fails (exit 16:
"gemspecs for path gems changed, but the lockfile can't be updated
because frozen mode is set"). Regenerating the lockfile resolves this.

Only the path gem version line changes; no other dependency pins move.
@intentlab-ai

intentlab-ai Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Code Health Review

⏭️ Skipped — This change does not affect analyzed code.

Reviewed f5712f3

@intentlab-ai

intentlab-ai Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Code Review

✅ Passed

Reviewed f5712f3

@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.72%. Comparing base (dd6a412) to head (f5712f3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main      #67   +/-   ##
=======================================
  Coverage   99.72%   99.72%           
=======================================
  Files          27       27           
  Lines        1103     1103           
=======================================
  Hits         1100     1100           
  Misses          3        3           
Flag Coverage Δ
unit 99.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@intentlab-ai

intentlab-ai Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

PR Readiness Review

✅ Passed

Reviewed f5712f3

@xiangfu0
xiangfu0 marked this pull request as draft October 23, 2026 07:45

Copy link
Copy Markdown
Contributor Author

Superseded by #68, which fixes the root cause of this drift rather than the symptom. As noted when this PR was held as draft, auto-release-minor.yml runs bin/bump-version on every push to main, and that script only edited version.rb — so the next auto-release would recreate the pinot-client PATH-pin mismatch this one-line patch fixes.

#68 teaches bin/bump-version to sync the Gemfile.lock PATH pin (and stages it in the release commit), and includes the same current-drift fix (1.29.0 → 1.44.0). Recommend closing this PR in favor of #68 once #68 is reviewed/merged.

xiangfu0 added a commit that referenced this pull request Oct 23, 2026
## Summary

The auto-release workflow bumps `lib/pinot/version.rb` on every push to
`main` but never updated `Gemfile.lock`'s PATH gem pin. Because
`pinot.gemspec` reads `Pinot::VERSION`, each bump changed the path gem's
version while the lockfile's `pinot-client` pin stayed stale (`1.29.0`
vs. gemspec `1.44.0`).

This is the **durable fix for the recurring drift** that
[#67](#67) patched
one line at a time — it repairs the owning bump step so the mismatch
cannot reappear, validates against a frozen install, and covers **both**
release paths.

## Why it matters

Plain `bundle install` (what CI uses) silently rewrites the lockfile to
match, masking the drift. A frozen/deployment install surfaces it:

```
$ BUNDLE_FROZEN=true bundle install
The gemspecs for path gems changed, but the lockfile can't be updated
because frozen mode is set
```

Since `bin/bump-version` only touched `version.rb`, the drift reappeared
on every release. PR #67's one-line edit fixed the symptom once; the
next release recreated it.

## Change

1. **`bin/bump-version`** — after writing `version.rb`, sync the
`Gemfile.lock` PATH pin. Prefers `bundle lock --local` (canonical
lockfile); falls back to a targeted, anchored in-place edit when Bundler
is unavailable.
- Preserves the committed `BUNDLED WITH` Bundler pin after `bundle
lock`, so the release commit carries no unrelated Bundler-version churn.
- Normalizes the version through RubyGems and loosens the fallback regex
so prerelease versions (`1.5.0-rc1` → `1.5.0.pre.rc1`) produce a valid,
matching lockfile pin.
2. **`.github/workflows/auto-release-minor.yml`** — the release commit
now stages `Gemfile.lock` alongside `version.rb`.
3. **`.github/workflows/release.yml`** — the manual-release commit step
likewise stages `Gemfile.lock`, so manual releases don't recreate the
drift.
4. **`Gemfile.lock`** — fixes the current drift (`1.29.0` → `1.44.0`);
the only line that changes.

No runtime/API behavior changes. The lockfile edit is pure metadata; the
rest is release-tooling.

## Validation (local, source @ this branch, Ruby 3.4.11)

- `BUNDLE_FROZEN=true bundle install` → **success** (was failing on
committed source)
- E2E auto-release simulation (`bin/bump-version 1.45.0`): version.rb +
lockfile pin move together; `BUNDLED WITH` preserved (4.0.8, not
rewritten to local 4.0.21); lockfile diff is exactly one line;
idempotent; frozen install succeeds
- Fallback path (Bundler absent): plain and prerelease versions both
produce a correct normalized pin; idempotent
- Unit tests (`COVERAGE_MIN=95 bundle exec rspec spec/pinot/`) → **524
examples, 0 failures, 1 pending**; coverage **99.72%** (≥95%)
- RuboCop (`bundle exec rubocop lib/ spec/`) → **clean**
- `bundle exec bundle-audit check` → **no vulnerabilities**
- `bash -n bin/bump-version` → OK

> Ruby 3.2/3.3 lanes covered by CI. Integration tests unaffected (no
runtime change).

## Review findings addressed

- **Medium** — `release.yml` committed only `version.rb`: fixed (now
stages `Gemfile.lock`).
- **Low** — `bundle lock` rewriting `BUNDLED WITH`: fixed (pin
preserved).
- **Low** — sed fallback breaking on prerelease: fixed (RubyGems
normalization + loosened match).

## Supersedes

Closes out the drift that #67 addressed; #67 can be closed in favor of
this once reviewed/merged.

> Note: merging a `Gemfile.lock` change triggers the
auto-release/publication path and remains subject to explicit release
authorization plus eligible independent approval.

---------

Co-authored-by: intentlab-ai[bot] <intentlab-ai[bot]@users.noreply.github.com>

Copy link
Copy Markdown
Contributor Author

Superseded by #68, which landed the durable fix for the recurring Gemfile.lock PATH-pin drift (repairs bin/bump-version plus both auto/manual release workflows, with the lockfile repair this PR made one line at a time). Closing in favor of #68 (merged as e35b636). The #67 branch's one-line edit fixed the symptom once but the next release would have recreated the drift.

@xiangfu0 xiangfu0 closed this Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant