Skip to content

CI: update-pinned-requirements is a little too fast #782

Open
@woodruffw

Description

@woodruffw

Defect during 2.0 release: https://github.com/sigstore/sigstore-python/actions/runs/6342972187/job/17229957076

Run cd install
  ERROR: Could not find a version that satisfies the requirement sigstore==2.0.0 (from versions: 0.0.1rc1, 0.0.1rc2, 0.0.1rc3, 0.1.0, 0.2.0, 0.3.1, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1rc1, 0.5.1rc2, 0.5.1, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.6.7, 0.6.8, 0.7.0, 0.8.3, 0.9.0, 0.10.0, 1.0.0rc1, 1.0.0, 1.1.0, 1.1.1rc1, 1.1.1, 1.1.2rc1, 1.1.2, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3)
Traceback (most recent call last):
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/pip/_vendor/resolvelib/resolvers.py", line 397, in resolve
    self._add_to_criteria(self.state.criteria, r, parent=None)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/pip/_vendor/resolvelib/resolvers.py", line 174, in _add_to_criteria
    raise RequirementsConflicted(criterion)
pip._vendor.resolvelib.resolvers.RequirementsConflicted: Requirements conflict: SpecifierRequirement('sigstore==2.0.0')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 92, in resolve
    result = self._result = resolver.resolve(
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/pip/_vendor/resolvelib/resolvers.py", line 546, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/pip/_vendor/resolvelib/resolvers.py", line 399, in resolve
    raise ResolutionImpossible(e.criterion.information)
pip._vendor.resolvelib.resolvers.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('sigstore==2.0.0'), parent=None)]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/hostedtoolcache/Python/3.9.16/x64/bin/pip-compile", line 8, in <module>
    sys.exit(cli())
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/click/decorators.py", line [33](https://github.com/sigstore/sigstore-python/actions/runs/6342972187/job/17229957076#step:9:34), in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/piptools/scripts/compile.py", line 659, in cli
    results = resolver.resolve(max_rounds=max_rounds)
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/piptools/resolver.py", line 604, in resolve
    is_resolved = self._do_resolve(
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/piptools/resolver.py", line 6[36](https://github.com/sigstore/sigstore-python/actions/runs/6342972187/job/17229957076#step:9:37), in _do_resolve
    resolver.resolve(
  File "/opt/hostedtoolcache/Python/3.9.16/x64/lib/python3.9/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 101, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: No matching distribution found for sigstore==2.0.0
Error: Process completed with exit code 1.

TL;DR is that we run this workflow right after successful PyPI publish, which means that PyPI may not actually be serving the new release just yet.

Possible resolutions:

  • Make this workflow manual-only, include a note in our release process reminding someone to run it
  • Make the workflow poll PyPI for the new version, and only continue once present
  • Make the workflow wait for 1-2 minutes before attempting to do anything (the lazy way)

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions