Public Access
48 lines
1.7 KiB
Markdown
48 lines
1.7 KiB
Markdown
# DEVX-166: create_dependency_pr must clone the target repo
|
|
|
|
## Problem
|
|
|
|
`create_dependency_pr` resolves the pinned-version file and runs all
|
|
git operations in the current working directory. Producer post-merge
|
|
workflows (grm, sso-bridge) invoke it from the *producer* checkout, so
|
|
it searches/modifies the wrong repository: `find_pinned_version` reads
|
|
files that do not exist there, and the git fetch/checkout/commit/push
|
|
sequence runs in the producer clone. The failure is silent — producer
|
|
workflows append `|| echo warning`, so a no-op looks like success.
|
|
|
|
## Approach
|
|
|
|
REQ-1: Clone the target repo (`--repo`) into a temporary directory with
|
|
an authenticated `http.extraHeader`, then run every file lookup and git
|
|
operation (fetch, checkout, add, commit, push) inside that clone. The
|
|
push uses the same auth header config.
|
|
|
|
REQ-2: Tests mock `subprocess.run` so no real clone happens in the unit
|
|
suite (test-isolation gate).
|
|
|
|
## Files Affected
|
|
|
|
- `src/devx/ci/create_dependency_pr.py`
|
|
- `tests/unit/test_create_dependency_pr.py`
|
|
|
|
## Test Plan
|
|
|
|
- Existing CLI tests keep passing with the subprocess mock in place.
|
|
- Verify the clone command targets the `--repo` URL and that git ops
|
|
run with `cwd=<clone>` (asserted via the mock's call list).
|
|
|
|
## Deploy Plan
|
|
|
|
Merge via auto-merge after green CI. The fix takes effect the next time
|
|
a producer post-merge workflow invokes `create_dependency_pr`.
|
|
|
|
## Rollback Plan
|
|
|
|
Revert the squash-merge commit on master; the previous (broken) CWD
|
|
behavior returns, which is strictly worse — no state is created.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [x] REQ-1: target repo cloned to tempdir; all file/git ops run in the clone
|
|
- [x] REQ-2: unit tests never spawn a real git subprocess
|