Repository navigation
Conversation
The committed Gemfile.lock pinned the local path gem pinot-client at 1.29.0, stale from the 1.44.0 version bump (commit ce7e4c4). lib/pinot/ version.rb and the gemspec declare 1.44.0, so the lockfile was out of sync with the gemspec. Plain `bundle install` silently rewrites the lockfile, masking the drift in CI, but `BUNDLE_FROZEN=true bundle install` fails (exit 16: "gemspecs for path gems changed, but the lockfile can't be updated because frozen mode is set"). Regenerating the lockfile resolves this. Only the path gem version line changes; no other dependency pins move.
Code Health Review⏭️ Skipped — This change does not affect analyzed code. Reviewed |
Code Review✅ Passed Reviewed |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #67 +/- ##
=======================================
Coverage 99.72% 99.72%
=======================================
Files 27 27
Lines 1103 1103
=======================================
Hits 1100 1100
Misses 3 3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
PR Readiness Review✅ Passed Reviewed |
|
Superseded by #68, which fixes the root cause of this drift rather than the symptom. As noted when this PR was held as draft, #68 teaches |
## Summary The auto-release workflow bumps `lib/pinot/version.rb` on every push to `main` but never updated `Gemfile.lock`'s PATH gem pin. Because `pinot.gemspec` reads `Pinot::VERSION`, each bump changed the path gem's version while the lockfile's `pinot-client` pin stayed stale (`1.29.0` vs. gemspec `1.44.0`). This is the **durable fix for the recurring drift** that [#67](#67) patched one line at a time — it repairs the owning bump step so the mismatch cannot reappear, validates against a frozen install, and covers **both** release paths. ## Why it matters Plain `bundle install` (what CI uses) silently rewrites the lockfile to match, masking the drift. A frozen/deployment install surfaces it: ``` $ BUNDLE_FROZEN=true bundle install The gemspecs for path gems changed, but the lockfile can't be updated because frozen mode is set ``` Since `bin/bump-version` only touched `version.rb`, the drift reappeared on every release. PR #67's one-line edit fixed the symptom once; the next release recreated it. ## Change 1. **`bin/bump-version`** — after writing `version.rb`, sync the `Gemfile.lock` PATH pin. Prefers `bundle lock --local` (canonical lockfile); falls back to a targeted, anchored in-place edit when Bundler is unavailable. - Preserves the committed `BUNDLED WITH` Bundler pin after `bundle lock`, so the release commit carries no unrelated Bundler-version churn. - Normalizes the version through RubyGems and loosens the fallback regex so prerelease versions (`1.5.0-rc1` → `1.5.0.pre.rc1`) produce a valid, matching lockfile pin. 2. **`.github/workflows/auto-release-minor.yml`** — the release commit now stages `Gemfile.lock` alongside `version.rb`. 3. **`.github/workflows/release.yml`** — the manual-release commit step likewise stages `Gemfile.lock`, so manual releases don't recreate the drift. 4. **`Gemfile.lock`** — fixes the current drift (`1.29.0` → `1.44.0`); the only line that changes. No runtime/API behavior changes. The lockfile edit is pure metadata; the rest is release-tooling. ## Validation (local, source @ this branch, Ruby 3.4.11) - `BUNDLE_FROZEN=true bundle install` → **success** (was failing on committed source) - E2E auto-release simulation (`bin/bump-version 1.45.0`): version.rb + lockfile pin move together; `BUNDLED WITH` preserved (4.0.8, not rewritten to local 4.0.21); lockfile diff is exactly one line; idempotent; frozen install succeeds - Fallback path (Bundler absent): plain and prerelease versions both produce a correct normalized pin; idempotent - Unit tests (`COVERAGE_MIN=95 bundle exec rspec spec/pinot/`) → **524 examples, 0 failures, 1 pending**; coverage **99.72%** (≥95%) - RuboCop (`bundle exec rubocop lib/ spec/`) → **clean** - `bundle exec bundle-audit check` → **no vulnerabilities** - `bash -n bin/bump-version` → OK > Ruby 3.2/3.3 lanes covered by CI. Integration tests unaffected (no runtime change). ## Review findings addressed - **Medium** — `release.yml` committed only `version.rb`: fixed (now stages `Gemfile.lock`). - **Low** — `bundle lock` rewriting `BUNDLED WITH`: fixed (pin preserved). - **Low** — sed fallback breaking on prerelease: fixed (RubyGems normalization + loosened match). ## Supersedes Closes out the drift that #67 addressed; #67 can be closed in favor of this once reviewed/merged. > Note: merging a `Gemfile.lock` change triggers the auto-release/publication path and remains subject to explicit release authorization plus eligible independent approval. --------- Co-authored-by: intentlab-ai[bot] <intentlab-ai[bot]@users.noreply.github.com>
|
Superseded by #68, which landed the durable fix for the recurring Gemfile.lock PATH-pin drift (repairs |
Summary
The committed
Gemfile.lockpinned the local path gempinot-clientat 1.29.0, stale from the 1.44.0 version bump (commitce7e4c4).lib/pinot/version.rbandpinot.gemspecdeclare 1.44.0, so the lockfile's path-gem version was out of sync with the gemspec.Why it matters
Plain
bundle install(what CI uses) silently rewrites the lockfile to 1.44.0, masking the drift. But a frozen/deployment install surfaces it:Regenerating the lockfile brings it into agreement with the gemspec.
Change
One line only — the path gem version pin:
No other dependency pins move. This is pure lockfile metadata; no runtime behavior changes.
Validation (local, source @ this branch head)
BUNDLE_FROZEN=true bundle install→ exit 0 (was exit 16 before)bundle exec rubocop lib/ spec/) → PASSCOVERAGE_MIN=95 bundle exec rspec spec/pinot/) → 524 examples, 0 failures, 1 pending; coverage 99.72% (≥95%)bundle exec bundle-audit check→ no vulnerabilitiesapachepinot/pinot:1.5.0QuickStart BATCH (spec/integration/) → 16 examples, 0 failures (unaffected by this metadata change; run on identical source)